Executive brief
BIND is a widely used DNS resolver and authoritative name server software that forms a critical part of internet infrastructure. When BIND's configuration file is missing a global options block, attackers can send a specially crafted DNS query (TKEY type) that triggers an assertion failure, causing the DNS service to crash and resulting in denial of service for all users relying on that nameserver.
Technical details
This vulnerability is a denial-of-service condition caused by an assertion failure in BIND's TKEY query processing. The root cause is improper handling of TKEY queries when the named.conf configuration lacks a global options block, resulting in an uninitialized or null state that the TKEY handler does not validate before use. An unauthenticated attacker on the network can send a single malicious TKEY query to the nameserver to trigger the assertion and crash the process. The vulnerability affects BIND 9 versions 9.20.0–9.20.27, 9.21.0–9.21.25, and 9.20.9-S1–9.20.27-S1. Patches are available in versions 9.20.29 and 9.21.26 as evidenced by the release dates matching the advisory publication.
Affected products
- ISC BIND 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.20.9-S1 through 9.20.27-S1
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Patches released in versions 9.20.29 and 9.21.26