Executive brief
BIND is DNS server software used by organizations worldwide to resolve domain names. A flaw in DNSSEC validation causes the BIND resolver to crash unexpectedly when processing certain malformed DNS responses from authoritative servers. This can lead to service disruption and denial of service attacks against DNS infrastructure.
Technical details
A denial-of-service vulnerability exists in BIND's DNSSEC validation logic. When a resolver receives a response containing a valid wildcard answer with signed NSEC3 proof followed by an unsigned NSEC record at the same owner name, the resolver encounters an unexpected condition it does not handle correctly, triggering an abnormal program termination. The attack requires the resolver to query a DNSSEC-signed authoritative zone and receive a specifically crafted malicious response. No authentication or local access is required; an attacker can exploit this by responding to recursive queries from vulnerable resolvers. Patches were released on 2026-09-16 in versions 9.20.29, 9.21.26, and corresponding stable release branches.
Affected products
- ISC BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.27-S1
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Patches released in versions 9.20.29 and 9.21.26