UBUNTU-CVE-2026-76163: High severity ubuntu/isc-dhcp vulnerability

Q: Which deployments are exposed to this issue?

Deployments running affected BIND 9 versions are exposed only when named is loaded with a named.conf configuration that contains no global options block. The affected version ranges are 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.

Q: What does an attacker need to do to trigger the failure?

An attacker can trigger the issue by sending a DNS query with QTYPE TKEY to an affected named instance. No privileges or user interaction are required.

Q: What is the impact of successful exploitation?

The TKEY query may cause an assertion failure followed by an unexpected named program exit, resulting in a denial of service. The provided severity vector indicates no confidentiality or integrity impact.

Q: How can I determine whether my server is affected?

Check whether the installed BIND version falls within an affected range and inspect the configuration loaded by named. A server meets the described vulnerable condition if its named.conf has no global options block.

Published Sep 16, 2026

Updated

If BIND is loaded with a "named.conf" file that contains no global "options" block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure and subsequent unexpected program exit. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.

Affected Software

7 affected componentsFixes available

ubuntu/isc-dhcp*

ubuntu/bind9-libs*

ubuntu/isc-dhcp*

ubuntu/bind9<1:9.20.24-1ubuntu3.1

1:9.20.24-1ubuntu3.1

ubuntu/bind9<1:9.20.24-1ubuntu0.4

1:9.20.24-1ubuntu0.4

ubuntu/isc-dhcp*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.20.24-1ubuntu3.1
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.20.24-1ubuntu0.4

Event History

Sep 16, 2026

CVE Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments running affected BIND 9 versions are exposed only when named is loaded with a named.conf configuration that contains no global options block. The affected version ranges are 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.

What does an attacker need to do to trigger the failure?

An attacker can trigger the issue by sending a DNS query with QTYPE TKEY to an affected named instance. No privileges or user interaction are required.

What is the impact of successful exploitation?

The TKEY query may cause an assertion failure followed by an unexpected named program exit, resulting in a denial of service. The provided severity vector indicates no confidentiality or integrity impact.

How can I determine whether my server is affected?

Check whether the installed BIND version falls within an affected range and inspect the configuration loaded by named. A server meets the described vulnerable condition if its named.conf has no global options block.

UBUNTU-CVE-2026-76163: High severity ubuntu/isc-dhcp vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the failure?

What is the impact of successful exploitation?

How can I determine whether my server is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the failure?

What is the impact of successful exploitation?

How can I determine whether my server is affected?