# CVE-2026-77692: ISC BIND DNS service denial of service via crafted DNS-over-HTTPS request

Source: https://junglewise.ai/threats/cve-2026-77692-isc-bind-dns-service-denial-of-service-via-crafted-dns-over-https  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-77692 · Severity: high · CVSS 7.5 · Published 2026-09-16

BIND is a widely-used DNS server that handles domain name resolution for networks and the internet. An attacker can crash the BIND service by sending a specially crafted DNS-over-HTTPS request containing an invalid cryptographic signature, followed by abruptly closing the connection. This causes the DNS server to stop responding, disrupting all DNS lookups for affected organizations until the service is restarted.

Technologies: [Isc Bind](https://junglewise.ai/threats/technologies/bind). Vendors: [Isc](https://junglewise.ai/threats/vendors/isc).

## Quick answers

**Is CVE-2026-77692 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77692 being exploited in the wild.

**How severe is CVE-2026-77692?** High severity, with a CVSS score of 7.5, published 16 September 2026.

**Which products and versions are affected?** Isc Bind 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.20.9-S1 through 9.20.27-S1.

**Is there a fix for CVE-2026-77692?** A patch was published on 2026-09-16: Fixed in BIND 9.20.29, 9.21.26, and later versions Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77692 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-77692?** Check whether you run Isc Bind at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in BIND's handling of SIG(0) (DNSSEC signature) records within DNS-over-HTTPS requests. When a crafted request with a cryptographically invalid SIG(0) record is sent and the transport connection is closed prematurely, the named daemon fails to properly handle the error condition and aborts. The attack requires network-level access to the DNS service and can be triggered without authentication. An attacker can exploit this to cause a denial of service by repeatedly sending such requests, forcing service restarts and disrupting DNS resolution. Patches are available in BIND 9.20.29, 9.21.26, and later versions.

## Affected products

- ISC BIND 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.20.9-S1 through 9.20.27-S1

## Timeline

- 2026-09-16: disclosed
- 2026-09-16: patched: Fixed in BIND 9.20.29, 9.21.26, and later versions

## References

- [https://downloads.isc.org/isc/bind9/9.20.29](https://downloads.isc.org/isc/bind9/9.20.29)
- [https://downloads.isc.org/isc/bind9/9.21.26](https://downloads.isc.org/isc/bind9/9.21.26)

## Related threats

- [BIND assertion failure with redirect zone and qname-minimization](https://junglewise.ai/threats/cve-2026-96888-a-bind-resolver-that-is-configured-with-both-a-redirect-zone-and)
- [BIND named GSS-TSIG replay heap corruption](https://junglewise.ai/threats/cve-2026-94300-replaying-gss-tsig-signed-udp-messages-can-result-in-memory)
- [ISC BIND resolver DNS message processing denial of service](https://junglewise.ai/threats/cve-2026-19630-in-a-bind-resolver-inbound-dns-protocol-messages-with-a)
- [ISC BIND denial of service via TKEY queries](https://junglewise.ai/threats/cve-2015-5477-isc-bind-data-processing-errors-vulnerability)
- [BIND resolver crash on DNSSEC-signed wildcard with NSEC mismatch](https://junglewise.ai/threats/cve-2026-80274-bind-resolver-crash-on-dnssec-signed-wildcard-with-nsec-mismatch)