DEV Community

OnaEiuspkz
OnaEiuspkz

Posted on

ISC BIND's September 2026 Patch Batch: 14 CVEs, One DNS Server, and a Wide Blast Radius

#dns #iscbind #vulnerability #denialofservice

ISC BIND's September 2026 Patch Batch: 14 CVEs, One DNS Server, and a Wide Blast Radius

CERT-In published vulnerability note CIVN-2026-0467 on 21 September 2026, covering 14 CVEs in ISC BIND, the reference open-source implementation of the Domain Name System. The note rates the overall severity HIGH and groups flaws that can crash a resolver, bypass security checks, enable spoofing or cache poisoning, and in some configurations inject unauthorized data into a DNS zone.

Vulnerability overview

The advisory covers 14 CVEs: CVE-2026-19033, CVE-2026-19662, CVE-2026-19666, CVE-2026-19667, CVE-2026-19668, CVE-2026-19941, CVE-2026-75029, CVE-2026-76163, CVE-2026-77119, CVE-2026-77692, CVE-2026-78301, CVE-2026-80274, CVE-2026-81563, and CVE-2026-81736. CERT-In assigns a HIGH severity rating to the set and lists denial of service, security-restriction bypass, spoofing, cache poisoning, and unauthorized DNS zone modification as the possible outcomes.
The affected release ranges are broad. CERT-In lists BIND 9.11.0 through 9.18.50, BIND 9.20.0 through 9.20.27, BIND 9.21.0 through 9.21.25, BIND Supported Preview Edition 9.11.3-S1 through 9.18.50-S1, and BIND Supported Preview Edition 9.20.9-S1 through 9.20.27-S1. That spans the long-lived 9.11 and 9.16 branches still common in enterprise and ISP deployments, the current 9.18 and 9.20 stable branches, and the 9.21 development branch.

Mechanism and exploitation conditions

CERT-In attributes the defects to a specific set of weakness classes rather than a single root cause. The list includes use-after-free, a numeric truncation error, excessive platform resource consumption within a loop, missing release of memory after its effective lifetime, a reachable assertion, acceptance of extraneous untrusted data with trusted data, null pointer dereference, origin validation error, asymmetric resource consumption (amplification), insufficient verification of data authenticity, and inefficient algorithmic complexity.
That mix matters because it maps to different attack surfaces inside a name server. Memory-safety defects such as use-after-free and null pointer dereference typically surface as process termination when a malformed message reaches the affected code path. Resource-consumption and algorithmic-complexity issues degrade throughput instead of crashing outright, which makes them harder to notice until latency climbs. Origin validation and data-authenticity weaknesses sit closer to the trust boundary and can let a crafted response be treated as legitimate.
CERT-In states that exploitation requires sending specially crafted DNS queries, DNS responses, DNSSEC-related records, zone-transfer data, TKEY requests, SVCB/HTTPS records, or DNS-over-HTTPS requests. The practical precondition is therefore network reachability to a BIND instance that processes the relevant message type. A recursive resolver that answers arbitrary clients, an authoritative server that accepts dynamic updates or zone transfers from a defined peer set, and a DNS-over-HTTPS front end all expose different subsets of that surface.
The advisory does not publish per-CVE exploitability detail, and it does not claim that any of the 14 flaws is being exploited in the wild. Treat the individual severity and exploitability of each CVE as unconfirmed until ISC's own advisories are reviewed.

Impact

The operational consequences follow the weakness classes. A successful denial-of-service attack removes name resolution for every client that depends on the affected server, which for a recursive resolver means the users behind it and for an authoritative server means the zone it serves. Cache poisoning is more durable: a poisoned record can persist for the record's TTL and redirect traffic well after the original attack ends. Spoofing and origin-validation failures undermine the assurance that an answer came from the legitimate authority for a name. Unauthorized zone data insertion changes what the server publishes, which can redirect mail, web traffic, or service discovery for an entire domain.
Because BIND commonly sits at the base of an organization's name resolution path, a single compromised or unavailable instance can affect authentication flows, service discovery, and outbound connectivity at once. The blast radius is a function of how many clients trust that resolver, not of how many servers run BIND.

Affected products and scope

The affected products are ISC BIND and ISC BIND Supported Preview Edition within the version ranges listed above. CERT-In does not enumerate which CVE maps to which release range, so an operator cannot assume that running the newest build in a branch removes every listed defect; the fixed builds are identified in ISC's own advisories and changelog.
Two scope caveats are worth stating plainly. First, the advisory groups 14 CVEs under one note, and the individual CVSS scores, attack vectors, and prerequisites are not included. Second, the affected-version list is a range, not a confirmation that every build inside it is vulnerable to every CVE. Confirm the specific fixed release for each CVE against ISC's advisory index before concluding that a given deployment is patched.

Exposure context

A ZoomEye search for app="ISC BIND" returned 19,364,144 matching assets at the time of writing. That figure describes the population of internet-reachable assets that ZoomEye fingerprints as BIND; it is not a count of confirmed-vulnerable hosts, and it does not distinguish recursive resolvers from authoritative-only servers or from instances that are not exposed to untrusted networks. It does establish that BIND is widely reachable and that the patch batch applies to a very large installed base.

Remediation and mitigations

Apply the vendor updates referenced by CERT-In. The note points to the BIND 9.21.26 changelog and to ISC's advisory index at https://kb.isc.org/docs/all-bind-advisories. Use those primary sources to map each CVE to its fixed release, because the CERT-In note does not do that mapping itself.
Until every instance is updated, reduce the reachable attack surface. Restrict recursive service to known client networks instead of answering the open internet. Limit zone transfers to explicitly authorized secondaries and require TSIG. Disable dynamic update where it is not operationally required. Put rate limiting in front of DNS-over-HTTPS endpoints. Monitor for resolver process restarts, unexpected latency spikes, and anomalous query patterns, since several of the listed weakness classes manifest as availability problems before they manifest as data integrity problems.
After patching, verify the running version rather than the installed package, and confirm that the resolver still answers correctly for a known-good name and that DNSSEC validation behaves as expected.

References

Top comments (0)