DEV Community

StarkMan
StarkMan

Posted on

BIND Memory-Safety and Resource Flaws: What the CERT-In Weakness List Actually Tells You

#dns #iscbind #vulnerability

BIND Memory-Safety and Resource Flaws: What the CERT-In Weakness List Actually Tells You

CERT-In note CIVN-2026-0467 covers 14 ISC BIND CVEs, and instead of a generic "multiple vulnerabilities" description it enumerates the underlying weakness classes. That enumeration is the most actionable part of the advisory, because it tells operators what failure mode to expect.

Vulnerability overview

The note, issued 21 September 2026, carries a HIGH severity rating and lists CVE-2026-19033, CVE-2026-19662, CVE-2026-19666, CVE-2026-19667, CVE-2026-19668, CVE-2026-19941, CVE-2026-75029, CVE-2026-76163, CVE-2026-77119, CVE-2026-77692, CVE-2026-78301, CVE-2026-80274, CVE-2026-81563, and CVE-2026-81736.

Mechanism and exploitation conditions

CERT-In attributes the batch to use-after-free, a numeric truncation error, excessive platform resource consumption within a loop, missing release of memory after its effective lifetime, a reachable assertion, acceptance of extraneous untrusted data with trusted data, null pointer dereference, origin validation error, asymmetric resource consumption (amplification), insufficient verification of data authenticity, and inefficient algorithmic complexity.
Read as a group, these fall into three operational families. The first is memory safety: use-after-free, null pointer dereference, missing release of memory after its effective lifetime, and a numeric truncation error. These typically cause a process to abort when a malformed message reaches the affected path, which makes them denial-of-service primitives. The second is resource exhaustion: excessive platform resource consumption within a loop, asymmetric resource consumption (amplification), and inefficient algorithmic complexity. These degrade service rather than killing it, so they show up as latency and load rather than a clean outage. The third is trust-boundary failure: origin validation error, insufficient verification of data authenticity, and acceptance of extraneous untrusted data with trusted data. These are the ones that can turn into spoofing or cache poisoning.
Delivery requires specially crafted DNS queries, DNS responses, DNSSEC-related records, zone-transfer data, TKEY requests, SVCB/HTTPS records, or DNS-over-HTTPS requests. The relevant precondition is that the server processes that message type from an untrusted source.

Impact

The three families produce different incidents. Memory-safety flaws produce resolver crashes and outage. Resource flaws produce slow or saturated resolvers that may be mistaken for network problems. Trust-boundary flaws produce wrong answers, which is harder to detect and longer-lived. CERT-In does not report active exploitation of any of the 14 CVEs and does not publish per-CVE severity.

Affected products and scope

Affected releases are BIND 9.11.0 through 9.18.50, BIND 9.20.0 through 9.20.27, BIND 9.21.0 through 9.21.25, BIND Supported Preview Edition 9.11.3-S1 through 9.18.50-S1, and BIND Supported Preview Edition 9.20.9-S1 through 9.20.27-S1. Because the note does not map CVEs to releases, treat the range as a prompt to check ISC's advisory index rather than as a patched/unpatched boundary.

Exposure context

ZoomEye reports 19,364,144 assets matching app="ISC BIND". That is an exposure estimate for the product fingerprint, not a vulnerability count, and it includes servers that may never accept untrusted input.

Remediation and mitigations

Update to the fixed builds named in ISC's advisories. Then reduce the number of paths that can reach the vulnerable code: close recursion to the open internet, require TSIG for transfers, disable dynamic update you do not use, and rate-limit DNS-over-HTTPS. Instrument the resolver so that process restarts and query-latency outliers are alerted on, since those are the observable signatures of the memory-safety and resource families respectively.

References

Top comments (0)