CVE-2026-76163: named aborts on a TKEY query when the user configuration has no global options statement
If BIND is loaded with a "named.conf" file that contains no global "options" block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure and subsequent unexpected program exit. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.20.29 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.21.26 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.20.29-S1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments running affected ISC BIND 9 versions are exposed only when named is loaded with a named.conf file that has no global options block. The affected ranges are 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.
What does an attacker need to trigger the failure?
An attacker only needs to send a DNS query with QTYPE TKEY to a vulnerable named instance. No privileges or user interaction are required.
What is the operational impact of successful exploitation?
The TKEY query can trigger an assertion failure that causes named to exit unexpectedly. The reported impact is loss of availability; no confidentiality or integrity impact is identified.
How can I determine whether my configuration is affected?
Inspect the named.conf file used to load named and verify whether it contains a global options block. If no such block is present and the installed BIND version falls within an affected range, the instance is affected.