Isc Bind 9
83 CVEs affecting Isc Bind 9. Latest disclosed: 2026-09-16. Critical: 0, High: 57.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-13321 | High | 8.6 | 2026-07-22 | The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. This issue affects BIND 9 versions 9… |
CVE-2025-40780 | High | 8.6 | 2025-10-22 | In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source po… |
CVE-2025-40778 | High | 8.6 | 2025-10-22 | Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue aff… |
CVE-2025-40776 | High | 8.6 | 2025-07-16 | A `named` caching resolver that is configured to send ECS (EDNS Client Subnet) options may be vulnerable to a cache-poisoning attack. This issue affects BIND 9… |
CVE-2026-80274 | High | 7.5 | 2026-09-16 | If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 pro… |
CVE-2026-76163 | High | 7.5 | 2026-09-16 | If BIND is loaded with a "`named.conf`" file that contains no global "`options`" block, an attacker can send a query of QTYPE TKEY which may cause an assertion… |
CVE-2026-19666 | High | 7.5 | 2026-09-16 | On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process w… |
CVE-2026-81736 | High | 7.5 | 2026-09-16 | If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate C… |
CVE-2026-81563 | High | 7.5 | 2026-09-16 | A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal reso… |
CVE-2026-77692 | High | 7.5 | 2026-09-16 | An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transpo… |
CVE-2026-19667 | High | 7.5 | 2026-09-16 | If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache en… |
CVE-2026-13204 | High | 7.5 | 2026-07-22 | If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may ex… |
CVE-2026-12617 | High | 7.5 | 2026-07-22 | The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically… |
CVE-2026-11721 | High | 7.5 | 2026-07-22 | It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. Th… |
CVE-2026-11622 | High | 7.5 | 2026-07-22 | A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to b… |
CVE-2026-11605 | High | 7.5 | 2026-07-22 | The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not… |
CVE-2026-11331 | High | 7.5 | 2026-07-22 | An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condi… |
CVE-2026-5947 | High | 7.5 | 2026-05-20 | Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signed with SIG(0), it b… |
CVE-2026-5946 | High | 7.5 | 2026-05-20 | Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, o… |
CVE-2026-3039 | High | 7.5 | 2026-05-20 | BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processi… |