Executive brief
BIND is a widely-used DNS server that handles domain name resolution for networks and the internet. An attacker can crash the BIND service by sending a specially crafted DNS-over-HTTPS request containing an invalid cryptographic signature, followed by abruptly closing the connection. This causes the DNS server to stop responding, disrupting all DNS lookups for affected organizations until the service is restarted.
Technical details
The vulnerability exists in BIND's handling of SIG(0) (DNSSEC signature) records within DNS-over-HTTPS requests. When a crafted request with a cryptographically invalid SIG(0) record is sent and the transport connection is closed prematurely, the named daemon fails to properly handle the error condition and aborts. The attack requires network-level access to the DNS service and can be triggered without authentication. An attacker can exploit this to cause a denial of service by repeatedly sending such requests, forcing service restarts and disrupting DNS resolution. Patches are available in BIND 9.20.29, 9.21.26, and later versions.
Affected products
- ISC BIND 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.20.9-S1 through 9.20.27-S1
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Fixed in BIND 9.20.29, 9.21.26, and later versions