Is CVE-2026-80274 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-80274 being exploited in the wild.

How severe is CVE-2026-80274?

High severity, with a CVSS score of 7.5, published 16 September 2026.

Which products and versions are affected?

Isc Bind 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.27-S1.

Is there a fix for CVE-2026-80274?

A patch was published on 2026-09-16: Patches released in versions 9.20.29 and 9.21.26 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-80274 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-80274?

Check whether you run Isc Bind at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-80274: BIND resolver crash on DNSSEC-signed wildcard with NSEC mismatch

CVE-2026-80274 · Severity: high · CVSS 7.5 · Published 2026-09-16

BIND is DNS server software used by organizations worldwide to resolve domain names. A flaw in DNSSEC validation causes the BIND resolver to crash unexpectedly when processing certain malformed DNS responses from authoritative servers. This can lead to service disruption and denial of service attacks against DNS infrastructure.

Technologies: Isc Bind. Vendors: Isc.

Quick answers

Is CVE-2026-80274 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-80274 being exploited in the wild.
How severe is CVE-2026-80274?: High severity, with a CVSS score of 7.5, published 16 September 2026.
Which products and versions are affected?: Isc Bind 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.27-S1.
Is there a fix for CVE-2026-80274?: A patch was published on 2026-09-16: Patches released in versions 9.20.29 and 9.21.26 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-80274 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-80274?: Check whether you run Isc Bind at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A denial-of-service vulnerability exists in BIND's DNSSEC validation logic. When a resolver receives a response containing a valid wildcard answer with signed NSEC3 proof followed by an unsigned NSEC record at the same owner name, the resolver encounters an unexpected condition it does not handle correctly, triggering an abnormal program termination. The attack requires the resolver to query a DNSSEC-signed authoritative zone and receive a specifically crafted malicious response. No authentication or local access is required; an attacker can exploit this by responding to recursive queries from vulnerable resolvers. Patches were released on 2026-09-16 in versions 9.20.29, 9.21.26, and corresponding stable release branches.

Affected products

ISC BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.27-S1

Timeline

2026-09-16: disclosed
2026-09-16: patched: Patches released in versions 9.20.29 and 9.21.26

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.