Executive brief
A vulnerability in BIND 9, a widely used system for translating domain names into IP addresses, can cause the service to crash unexpectedly. This occurs when the system receives specific, out-of-order responses to network queries. If exploited, this could lead to a denial-of-service, disrupting internet connectivity or internal network operations for organizations relying on the affected software.
Technical details
A reachable assertion (CWE-617) exists in BIND 9's 'named' process when handling specific DNS record sequences. The vulnerability is triggered when a resolver receives an 'A' record response followed by a delayed negative DNAME response, or a delayed self-referential CNAME response. An attacker can exploit this remotely by providing these malformed or specifically ordered responses from an authoritative server, causing the 'named' service to terminate unexpectedly. The issue affects BIND versions 9.18.0 through 9.18.50 and 9.20.0 through 9.20.24, including Supported Preview Editions. Users are advised to upgrade to BIND 9.20.26 or the relevant patched version for their branch.
Affected products
- ISC BIND 9 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.24-S1
Timeline
- 2026-07-15: other: Early Notification (v1.0)
- 2026-07-22: disclosed: Public disclosure (v2.0)
- 2026-07-22: patched: Release of BIND 9.20.26 and 9.20.26-S1