BIND 9.20.29 and 9.21.26 Fix 14 Security Flaws: DNS Operators Should Update

By AiCybr Editorial · Published September 20, 2026

The Internet Systems Consortium (ISC) has released BIND 9.20.29 and 9.21.26 to address 14 security vulnerabilities disclosed on September 16, 2026. Seven are rated High and seven Medium. The affected paths include recursive DNS, DNSSEC validation, DNS-over-HTTPS (DoH), SVCB/HTTPS processing, TKEY queries, negative caching and zone transfers.

The most direct Internet-facing failure is CVE-2026-77692, a High-severity flaw that allows an unauthenticated remote client to terminate named with a crafted DoH request containing an invalid SIG(0) record followed by premature connection closure. ISC assigns it CVSS 7.5 and says it is unaware of active exploitation.

ISC recommends moving supported deployments to the patched release corresponding to their branch: 9.20.29 or 9.21.26. Supported Preview Edition users should move to 9.20.29-S1. Several advisories also cover older 9.18 releases. ISC's current fixes target supported branches, and distribution packages may carry backported patches under different version strings.

The September BIND security update at a glance

SecurityWeek independently counted the same 14-vulnerability set and seven High-severity flaws, with the High group capable of causing assertion failures, process termination, memory/resource exhaustion or other denial-of-service conditions.

Seven High-severity flaws can disrupt DNS service

The High-severity group includes CVE-2026-80274, CVE-2026-76163, CVE-2026-19666, CVE-2026-81563, CVE-2026-77692, CVE-2026-19667 and CVE-2026-81736. ISC's advisories describe remote attack paths across resolver validation, TKEY handling, DNS64, SVCB/HTTPS records, DoH and negative-response processing.

Two examples show why configuration and role matter:

• CVE-2026-76163 affects BIND 9.20.0 through 9.20.27 and 9.21.0 through 9.21.25 when named.conf has no global options block. A remote QTYPE TKEY query can trigger an assertion failure and terminate the process. ISC rates it High, CVSS 7.5.
• CVE-2026-81736 affects recursive resolvers that cache a tree of SVCB/HTTPS AliasMode records. A query for the root of that tree can force disproportionate CPU work, producing resource exhaustion and denial of service. ISC rates it High, CVSS 7.5.

CVE-2026-77692 deserves particular attention on deployments that expose BIND's DoH service. ISC says a single crafted DoH SIG(0) request can cause named to abort. The published vector is network-accessible, requires no privileges and needs no user interaction.

Medium-severity issues include DNSSEC cache poisoning and zone-integrity risks

The Medium group is operationally diverse. CVE-2026-19941 can cause a validating resolver to accept an out-of-zone NSEC record as proof that a wildcard does not exist. ISC says an attacker at the same or an upstream zone name may use that condition to mask a victim wildcard mapping, resulting in cache poisoning. ISC scores the flaw 5.9.

CVE-2026-19033 affects secondary zones whose transfers are protected by TSIG. ISC says named can begin serving IXFR data before the final TSIG signature has been verified. A sender without a valid signature can therefore supply unauthorized zone contents under the vulnerable conditions, and the server may fail to roll back to its previous state when verification never succeeds.

Other Medium advisories address memory and CPU amplification. For example, CVE-2026-19668 can exhaust resolver CPU through excessive matching of invalid DNSSEC cryptographic material. CVE-2026-75029 can increase negative-cache memory use by supplying repeated copies of singleton RDATA that BIND retains in memory.

Which BIND systems should be checked first

Prioritize systems that provide public recursive DNS or DoH, followed by authoritative servers and mixed-role deployments. The advisory set touches different code paths, so exposure is determined by server role and enabled features, with each vulnerability having its own trigger conditions.

A practical inventory should capture:

1. the running named version and distribution package build;
2. whether the server provides recursion, authoritative service, or both;
3. whether DoH is exposed;
4. use of DNSSEC validation, DNS64, SVCB/HTTPS records and TSIG-protected zone transfers;
5. the effective named.conf, including whether a global options block exists;
6. the package vendor's advisory and fixed build when BIND is supplied by a Linux or BSD distribution.

For upstream installations on the supported branches, 9.20.29 and 9.21.26 are the fixed targets published by ISC. Distribution maintainers commonly backport security fixes, so an older-looking package version can still contain the patches. Use the operating-system vendor's security tracker to determine the fixed package build before replacing a managed package based only on the upstream version number.

Upgrade is the primary remediation

ISC lists no workaround for several of the disclosed flaws, including CVE-2026-76163, CVE-2026-81736 and CVE-2026-19668. Updating is therefore the primary remediation path.

After deployment, verify the running process version and service health in addition to confirming package installation. For redundant DNS infrastructure, update nodes in a controlled sequence and confirm query resolution, authoritative answers, DNSSEC validation and any DoH endpoint before proceeding to the next node.

Operators should also review externally reachable interfaces. Recursive service should remain limited to intended clients, while authoritative and DoH exposure should match the deployment design. Network restriction reduces reachable attack surface; systems that process untrusted DNS traffic still require the security update.

Bottom line

The September 16 BIND disclosure covers a broad set of resolver, authoritative, transfer and DoH paths. All 14 vulnerabilities converge on the same supported fixed releases: BIND 9.20.29 and 9.21.26. Seven are High severity, and multiple flaws are remotely exploitable without authentication.

DNS operators should identify the package or upstream build actually running, apply the corresponding patched release, restart or reload as required by the package vendor, and verify service behavior afterward. DoH-facing and public recursive resolvers deserve the earliest attention because the advisory set includes direct remote process-termination and resource-exhaustion paths.

Sources: ISC BIND 9 security advisories and vulnerability matrix, updated September 16, 2026; ISC advisories for CVE-2026-77692, CVE-2026-76163, CVE-2026-81736, CVE-2026-19941, CVE-2026-19033, CVE-2026-19668 and CVE-2026-75029; SecurityWeek, “ISC Patches 14 Vulnerabilities in BIND 9 Security Update” (September 17, 2026).