Three High-Severity BIND Flaws Let Attackers Crash the Internet's Phone Book
ISC patched 14 vulnerabilities in BIND 9 on 16 September 2026, including three remotely exploitable bugs that can knock DNS resolvers offline with a single crafted packet.
Key points
- ISC released BIND versions 9.21.26 and 9.20.29 on 16 September 2026, fixing 14 vulnerabilities, seven of them rated high severity.
- CVE-2026-80274, CVE-2026-76163, and CVE-2026-19666 each score 7.5 (HIGH) and can crash a BIND resolver remotely, without authentication.
- All three affect long-running BIND 9 release lines, some dating back to version 9.11.0.
- ISC says none of the 14 bugs are known to be exploited in the wild as of the patch release date.
- Administrators running any BIND 9 version older than 9.20.29 or 9.21.26 should update immediately.
BIND is the software that runs a large share of the world's DNS resolvers. DNS, short for Domain Name System, translates a web address like "example.com" into the numerical address a computer actually uses to connect. When a resolver crashes, the websites that depend on it become unreachable, as if the internet's phone book suddenly went blank.
On 16 September 2026, the Internet Systems Consortium (ISC), the non-profit that maintains BIND, published patches for 14 vulnerabilities at once. Three of them deserve particular attention from anyone who runs a resolver.
What exactly can an attacker do?
All three high-severity flaws below let a remote attacker crash the BIND process entirely, with no login or prior access required. One malformed packet is enough.
| CVE | Affected versions | What triggers the crash |
|---|---|---|
| CVE-2026-80274 | 9.11.0 to 9.18.50, 9.20.0 to 9.20.27, 9.21.0 to 9.21.24 | A wildcard DNS reply paired with a contradictory NSEC proof record |
| CVE-2026-76163 | 9.20.0 to 9.20.27, 9.21.0 to 9.21.24 | A TKEY query sent to a server whose config file has no global options block |
The mechanics differ. BIND exits without warning in every case.
CVE-2026-80274 exploits DNSSEC validation, the security layer that lets resolvers verify DNS answers haven't been tampered with. A signed wildcard reply arriving alongside a contradictory unsigned NSEC record (a proof that a domain name does not exist) causes BIND to trip over the contradiction and terminate.
CVE-2026-76163 is narrower. It only affects servers whose configuration file is missing a global "options" block, a valid if unusual setup. On those servers, a TKEY query (a rarely used DNS message type for key exchange) triggers an assertion failure and an immediate exit.
A malformed reply from an authoritative name server sends the resolver into an unexpected exit.
Four more high-severity bugs were patched in the same release. The one to note: CVE-2026-77692, which ISC says crashes named with a single DNS-over-HTTPS request carrying a cryptographically invalid SIG(0) record, no authentication needed. It's a short list of triggers for a lot of potential disruption. This pattern of remotely crashable DNS infrastructure is something we've tracked since our NGINX coverage in July, where a single crafted request was likewise sufficient.
CVE-2026-80274 and CVE-2026-19666 cover every BIND 9.11 release made in recent years, meaning older deployments that missed routine updates are squarely in scope. Patch discipline on DNS infrastructure is historically poor. That's the quiet problem here.
Should you worry?
If you run BIND, yes. Update to 9.20.29 or 9.21.26, both available now from ISC.
End users don't need to act directly. Your internet provider or IT department controls the resolvers your devices use. If you see widespread name-resolution failures in the coming days (websites refusing to load even when your connection appears healthy), a BIND crash at an upstream provider is a plausible cause.
