BIND 9 Patches 14 Flaws Including Unauthenticated DoH Crash

ISC released BIND 9.20.29 and 9.21.26 on September 16, patching fourteen security vulnerabilities in its open-source DNS server software. The most operationally urgent is an unauthenticated crash: an attacker with network access can send malformed requests over DNS-over-HTTPS and bring down the resolver without credentials.

BIND 9 runs the nameservers and recursive resolvers that underpin large portions of internet infrastructure, from ISP deployments to corporate DNS. An unauthenticated remote crash on a DoH-enabled resolver is a real denial-of-service risk, not a theoretical one.

What to do

Upgrade to one of these releases:

• 9.20.29 (current stable branch)
• 9.21.26 (current development branch)

All BIND 9 versions before these are affected by the disclosed vulnerabilities. ISC published its advisory set on September 16; the full list of CVEs is at isc.org/bind-security.

No workarounds are listed for the DoH crash. If you cannot immediately patch and your resolver has DoH enabled on an exposed interface, consider temporarily disabling DoH until the upgrade is in place. For resolvers on private networks without DoH configured, the risk is lower, but the patch set is broad enough that upgrading is still the right call.

DoH exposure

DNS-over-HTTPS has moved from browser-side experiment to enterprise resolver feature over the past two years. If your BIND 9 deployment has DoH enabled, treat this as a priority update.

This is the second DNS implementation to ship a security patch this week. Unbound 1.26.1 fixed a critical DNSSEC heap overflow earlier today. If your infrastructure runs both, both need attention.

For broader context on open-source server patching cadence, see the recent PostgreSQL logical decoding RCE fix and the Elasticsearch machine learning module RCE.

Sources: ISC BIND security advisories | ISC BIND 9 release notes