This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] BIND 9 fixes 14 vulnerabilities
BIND 9 fixes 14 vulnerabilities [1]. Selected high-severity vulnerabilities are described below, the rest can be found at [2]. Products and their fixed versions: BIND 9 - 9.20.29, 9.21.26 BIND Supported Preview Edition - 9.20.29-S1 Debian releases and their fixed versions [3]: trixie (security) - 1:9.20.29-1~deb13u1 (all vulnerabilities except CVE-2026-78301, CVE-2026-19941) sid (unstable) - 1:9.20.29-1
An unauthenticated remote attacker can cause a DoS by sending a specific query for SVCB/HTTPS AliasMode records stored in a tree structure in the resolver cache [4].
The vulnerability is present in products:
- BIND; >=9.18.0, <=9.18.50; >=9.20.0, <=9.20.27; >=9.21.0, <=9.21.25;
- BIND Supported Preview Edition; >=9.18.11-S1, <=9.18.50-S1; >=9.20.9-S1, <=9.20.27-S1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2026-81736 at cve.org, NVD
- CWE-1050: Excessive Platform Resource Consumption within a Loop at cwe.mitre.org
The vulnerability was publicly disclosed 16. 9. 2026.
An unauthenticated remote attacker can cause a DoS by sending a specially crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, which triggers premature termination of the connection.
The vulnerability is present in products:
- BIND; >=9.20.0, <=9.20.27; >=9.21.0, <=9.21.25;
- BIND Supported Preview Edition; >=9.20.9-S1, <=9.20.27-S1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2026-77692 at cve.org, NVD
- CWE-476: NULL Pointer Dereference at cwe.mitre.org
The vulnerability was publicly disclosed 16. 9. 2026.
An unauthenticated remote attacker who operates an authoritative DNS server (or spoofs its communication) can cause a DoS by sending a specially crafted response to a query from a vulnerable resolver directed at a DNSSEC-signed authoritative zone, where this malicious response must contain a valid wildcard answer with a signed NSEC3 proof immediately followed by an unsigned NSEC record [6].
The vulnerability is present in products:
- BIND; >=9.11.0, <=9.18.50; >=9.20.0, <=9.20.27; >=9.21.0, <=9.21.25;
- BIND Supported Preview Edition; >=9.11.3-S1, <=9.18.50-S1; >=9.20.9-S1, <=9.20.27-S1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2026-80274 at cve.org, NVD
- CWE-617: Reachable Assertion at cwe.mitre.org
The vulnerability was publicly disclosed 16. 9. 2026.
Links
By CESNET, z.s.p.o. Táňa Macháčková on 18. 9. 2026.