ISC Patches 14 Vulnerabilities in BIND 9 Security Update
Source SecurityWeek
Mentioned vulnerabilities
Fixed in 9.21.26 : patch affected systems soon.
Data as of 17 Sep 2026, 12:46 UTC
Rated by Threat Radar
- Patch
- Available – fixed in 9.21.26, 9.20.29
What to do
AI-suggested
ISC has released official security updates in BIND versions 9.21.26 and 9.20.29 that address all 14 vulnerabilities. Administrators should update their BIND deployments to these versions as soon as possible to mitigate the risks. ISC is not aware of any active exploitation of these vulnerabilities in the wild. No additional mitigations beyond applying the official patches are indicated by the vendor.
Description
The Internet Systems Consortium (ISC) released security updates for BIND 9 to address 14 vulnerabilities, including seven high-severity flaws that can cause denial-of-service (DoS) conditions by triggering unexpected program exits, memory exhaustion, or termination of the named process. These vulnerabilities can be exploited remotely through various crafted DNS queries and DNS-over-HTTPS (DoH) requests, including one that allows unauthenticated remote crash of named with a single DoH SIG(0) request. Seven additional medium-severity vulnerabilities address issues such as cache poisoning, increased memory usage, CPU exhaustion, and arbitrary data injection. ISC has released fixed versions 9.21.26 and 9.20.29 to resolve these issues and recommends prompt updating. No active exploitation in the wild is currently known.