Latest BIND vulnerabilities: #
Internet Systems Consortium (ISC) has disclosed four high-severity vulnerabilities affecting certain versions of ISC BIND:
- CVE-2026-19630: Inbound DNS messages with a particular structure cause additional processing with no limit in a BIND resolver, allowing a remote attacker to exhaust CPU and memory and cause a denial of service. This vulnerability has been designated CVE-2026-19630 and has been rated high with a CVSS score of 7.5.
- CVE-2026-94300: Replaying GSS-TSIG signed UDP messages corrupts memory in the BIND "named" process. An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid and, by also sending crafted queries to a zone the attacker controls, may cause the process to abort or potentially achieve remote code execution. This vulnerability has been designated CVE-2026-94300 and has been rated high with a CVSS score of 8.1.
- CVE-2026-96888: A BIND resolver configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect, allowing a remote attacker to cause a denial of service. This vulnerability has been designated CVE-2026-96888 and has been rated high with a CVSS score of 7.5.
- CVE-2026-97313: A recursive BIND server that allows recursive queries and has at least two RPZ zones, one with the default "recursive-only yes" and one with "recursive-only no", may exit with an assertion failure when it receives a query with RD=1 followed by a query with RD=0, allowing a remote attacker to cause a denial of service. This vulnerability has been designated CVE-2026-97313 and has been rated high with a CVSS score of 7.5.
The following versions are affected:
- BIND 9.11 - 9.18: Versions 9.11.0 through 9.18.50 (CVE-2026-96888 affects versions 9.16.0 and later, and CVE-2026-97313 affects versions 9.16.0 and later)
- BIND 9.20: Versions 9.20.0 through 9.20.29
- BIND 9.21: Versions 9.21.0 through 9.21.26
- BIND Supported Preview Edition 9.11-S1 - 9.18-S1: Versions 9.11.3-S1 through 9.18.50-S1 (CVE-2026-96888 affects versions 9.16.8-S1 and later)
- BIND Supported Preview Edition 9.20-S1: Versions 9.20.9-S1 through 9.20.29-S1
No workarounds are known for any of these vulnerabilities.
What is BIND? #
ISC BIND is open-source software, maintained by the Internet Systems Consortium (ISC), that implements the Domain Name System (DNS), which is the foundational protocol for translating human-readable domain names into IP addresses.
What is the impact? #
Successful exploitation of these vulnerabilities would allow an unauthenticated remote attacker to cause a denial of service by crashing or exhausting resources on affected DNS resolvers, with the potential to execute arbitrary code on the underlying host if valid authentication messages can be captured and replayed.
Are updates or workarounds available? #
Users are encouraged to update to the latest version as quickly as possible:
- BIND 9.11 - 9.18: Migrate to a fixed release. Upgrade to 9.20.30 or later.
- BIND 9.20: Upgrade to version 9.20.30 or later.
- BIND 9.21: Upgrade to version 9.21.27 or later.
- BIND Supported Preview Edition 9.11-S1 - 9.18-S1: Migrate to a fixed release. Upgrade to 9.20.30-S1 or later.
- BIND Supported Preview Edition 9.20-S1: Upgrade to version 9.20.30-S1 or later.
BIND Supported Preview Edition 9.20-S1: Upgrade to version 9.20.30-S1 or later.
Finding exposed BIND systems with runZero #
From the Software Inventory, use the following query to locate potentially impacted assets:
vendor:=ISC AND product:=BIND AND (version:>0 AND (
(version:>=9.11.0 AND version:<=9.18.50) OR
(version:>=9.20.0 AND version:<=9.20.29) OR
(version:>=9.21.0 AND version:<=9.21.26) OR
(version:>="9.11.3-S1" AND version:<="9.18.50-S1") OR
(version:>="9.20.9-S1" AND version:<="9.20.29-S1")))
October 2025: CVE-2025-40778, CVE-2025-40780, and CVE-2025-8677 #
Internet Systems Consortium (ISC) has disclosed multiple vulnerabilities affecting certain versions of ISC BIND:
- A cache poisoning vulnerability related to unsolicited resource records (RRs) - records in a DNS response that were not directly requested by a query - is possible under certain circumstances. This vulnerability exists because BIND is too lenient when accepting such records from answers. Successful exploitation allows a remote, unauthenticated adversary to inject forged records into the cache during a query. This can affect the resolution of future queries, potentially hijacking traffic. This vulnerability has been designated CVE-2025-40778 and has been rated high with a CVSS score of 8.6.
- A cache poisoning vulnerability exists due to a weakness in the pseudo-random number generator (PRNG). This weakness allows a remote, unauthenticated adversary to predict the source port and query ID that BIND will use. In specific circumstances, BIND can be tricked into caching spoofed responses from an adversary. This vulnerability has been designated CVE-2025-40780 and has been rated high with a CVSS score of 8.6.
- A resource exhaustion vulnerability exists due to flaws in handling malformed DNSKEY records. Successful exploitation allows a remote, unauthenticated adversary to query for records within a specially crafted zone containing such records. This causes the server to consume excessive CPU resources, overwhelming it and significantly impacting performance, which leads to a denial-of-service (DoS) for legitimate clients. This vulnerability has been designated CVE-2025-8677 and has been rated high with a CVSS score of 7.5.
Authoritative services are believed to be unaffected by these vulnerabilities; however, resolvers are affected.
The following versions are affected:
- BIND versions 9.11.0 through 9.16.50
- Note: This range is only affected by CVE-2025-40778 and CVE-2025-40780. The latter (CVE-2025-40780) only affects versions 9.16.0 through 9.16.50.
- BIND versions 9.18.0 through 9.18.39
- BIND versions 9.20.0 through 9.20.13
- BIND versions 9.21.0 through 9.21.12
- BIND Supported Preview Edition versions 9.11.3-S1 through 9.16.50-S1
- Note: This range is only affected by CVE-2025-40778 and CVE-2025-40780. The latter (CVE-2025-40780) only affects versions 9.16.8-S1 through 9.16.50-S1.
- BIND Supported Preview Edition versions 9.18.11-S1 through 9.18.39-S1
- BIND Supported Preview Edition versions 9.20.9-S1 through 9.20.13-S1
Note: BIND versions prior to 9.11.0 were not specifically assessed, but are also believed to be affected.
What is the impact? #
Successful exploitation of the vulnerabilities would allow an adversary to affect the resolution of future queries, thereby potentially hijacking traffic, and disrupt service operation for legitimate clients.
Are updates or workarounds available? #
Users are encouraged to update to the latest version as quickly as possible:
- BIND versions 9.11.x through 9.18.x upgrade to version 9.18.41 or later
- BIND versions 9.20.x upgrade to version 9.20.15 or later
- BIND versions 9.21.x upgrade to version 9.21.14 or later
- BIND Supported Preview Edition versions 9.11.3-S1 through 9.18.39-S1 upgrade to version 9.18.41-S1 or later
- BIND Supported Preview Edition versions 9.20.9-S1 through 9.20.13-S1 upgrade to version 9.20.15-S1 or later
How to find potentially vulnerable systems with runZero #
From the Software Inventory, use the following query to locate potentially impacted assets:
vendor:=ISC AND product:=BIND AND (version:>0 AND (
(version:>=9 AND version:<9.11.0) OR
(version:>=9.11.0 AND version:<=9.16.50) OR
(version:>=9.18.0 AND version:<=9.18.39) OR
(version:>=9.20.0 AND version:<=9.20.13) OR
(version:>=9.21.0 AND version:<=9.21.12) OR
(version:>="9.11.3-S1" AND version:<="9.16.50-S1") OR
(version:>="9.18.11-S1" AND version:<="9.18.39-S1") OR
(version:>="9.20.9-S1" AND version:<="9.20.13-S1")))December 2024: BIND 9.20 defect in QPzone implementation #
ISC disclosed that authoritative servers might experience assertion failures or other unexpected events when using DNSSEC-signed zones using NSEC3 in the QPzone implementation which utilizes the QPDB in-memory database. This could potentially lead to a denial-of-service. There was no CVE attached to this notice.
What was the impact? #
This issue affected all BIND versions from 9.20.0 to 9.20.4.
Were updates or workarounds available? #
ISC stated they were not updating or withdrawing the 9.20 distributions. They did recommend the following either:
- Recompiling BIND 9.20 with --with-zonedb=RBTDB
- Installing the latest BIND 9.20.4 packages provided by ISC
How runZero users found potentially vulnerable systems #
From the Services Inventory, use the following query to locate systems running potentially vulnerable software:
product:bind and (_service.product:="%BIND:9.20.0%" or _service.product:="%BIND:9.20.1%" or _service.product:="%BIND:9.20.3%" or _service.product:="%BIND:9.20.4%")
