Executive brief
A vulnerability in BIND 9, a widely used DNS server software, can cause the service to crash and become unavailable. An attacker with valid credentials (TSIG keys) can send a specially crafted request that triggers this failure. This results in a denial-of-service, potentially disrupting internet connectivity or internal network resolution for the organization.
Technical details
A reachable assertion (CWE-617) exists in the 'named' component of BIND 9 when processing TKEY records. The vulnerability is triggered when a correctly signed query containing a TKEY record is processed under specific conditions. Exploitation requires the attacker to possess a valid Transaction Signature (TSIG) key that is already declared in the server's configuration. Successful exploitation results in the immediate termination of the 'named' process, affecting both authoritative servers and resolvers. Patches are available in versions 9.20.21 and 9.21.20.
Affected products
- ISC BIND 9 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.20.9-S1 through 9.20.20-S1
Timeline
- 2026-03-18: other: Early notification provided
- 2026-03-25: disclosed: Public disclosure and advisory published
- 2026-03-25: patched: Patched versions 9.20.21 and 9.21.20 released