CVE-2026-77692: Unauthenticated remote crash of named via a single DoH SIG(0) request
An attacker can cause named to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.20.29 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.21.26 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.20.29-S1
Event History
Frequently Asked Questions
Which deployments should be prioritized for triage?
Prioritize Internet Systems Consortium BIND 9 `named` deployments running 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, or 9.20.9-S1 through 9.20.27-S1, particularly where `named` accepts DNS-over-HTTPS requests.
Does exploitation require authentication or user interaction?
No. The stated vector is network-accessible, requires no privileges or user interaction, and consists of a crafted DNS-over-HTTPS request containing a cryptographically invalid SIG(0) record followed by prematurely closing the transport connection.
What is the expected impact of a successful exploit?
A successful request causes `named` to abort, resulting in a denial of service. The supplied severity vector indicates no confidentiality or integrity impact.
How can an administrator determine whether a server is affected?
Check the installed BIND 9 version against the listed affected ranges and determine whether the `named` instance is exposed to DNS-over-HTTPS requests. The provided information identifies DNS-over-HTTPS as the trigger but does not establish impact through other DNS transports.