UBUNTU-CVE-2026-80274: High severity ubuntu/bind9 vulnerability

Q: Which systems are exposed to this issue?

Systems running an affected BIND resolver version are exposed when they can send queries for DNSSEC-signed authoritative zones. The listed affected ranges include BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and the corresponding supported-preview S1 ranges.

Q: What must an attacker control or provide to trigger the failure?

The resolver must receive a specific response sequence from an authoritative server: a valid wildcard answer with signed NSEC3 proof, followed by an unsigned NSEC record at the same owner name. No privileges or user interaction are required according to the supplied severity vector.

Q: What is the security impact?

The crafted response causes an unexpected BIND program exit, resulting in a denial of service. The supplied vector indicates network reachability, low attack complexity, and impact limited to availability; it does not indicate confidentiality or integrity impact.

Q: How can I determine whether an installation is affected?

Check whether the installed BIND resolver version falls within one of the stated affected version ranges. The provided data identifies Ubuntu packages bind9, bind9-libs, and isc-dhcp as associated software.

Published Sep 16, 2026

Updated

If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

Affected Software

13 affected componentsFixes available

ubuntu/bind9<1:9.9.5.dfsg-3ubuntu0.19+esm15

1:9.9.5.dfsg-3ubuntu0.19+esm15

ubuntu/bind9<1:9.10.3.dfsg.P4-8ubuntu1.19+esm11

1:9.10.3.dfsg.P4-8ubuntu1.19+esm11

ubuntu/bind9<1:9.11.3+dfsg-1ubuntu1.19+esm6

1:9.11.3+dfsg-1ubuntu1.19+esm6

ubuntu/isc-dhcp*

ubuntu/bind9<1:9.18.30-0ubuntu0.20.04.2+esm3

1:9.18.30-0ubuntu0.20.04.2+esm3

ubuntu/bind9-libs*

ubuntu/bind9<1:9.18.39-0ubuntu0.22.04.7

1:9.18.39-0ubuntu0.22.04.7

ubuntu/bind9-libs*

ubuntu/bind9<1:9.18.39-0ubuntu0.24.04.8

1:9.18.39-0ubuntu0.24.04.8

ubuntu/isc-dhcp*

ubuntu/bind9<1:9.20.24-1ubuntu3.1

1:9.20.24-1ubuntu3.1

ubuntu/bind9<1:9.20.24-1ubuntu0.4

1:9.20.24-1ubuntu0.4

ubuntu/isc-dhcp*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.9.5.dfsg-3ubuntu0.19+esm15
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.10.3.dfsg.P4-8ubuntu1.19+esm11
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.11.3+dfsg-1ubuntu1.19+esm6
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.18.30-0ubuntu0.20.04.2+esm3
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.18.39-0ubuntu0.22.04.7
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.18.39-0ubuntu0.24.04.8
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.20.24-1ubuntu3.1
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.20.24-1ubuntu0.4

Event History

Sep 16, 2026

CVE Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed to this issue?

Systems running an affected BIND resolver version are exposed when they can send queries for DNSSEC-signed authoritative zones. The listed affected ranges include BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and the corresponding supported-preview S1 ranges.

What must an attacker control or provide to trigger the failure?

The resolver must receive a specific response sequence from an authoritative server: a valid wildcard answer with signed NSEC3 proof, followed by an unsigned NSEC record at the same owner name. No privileges or user interaction are required according to the supplied severity vector.

What is the security impact?

The crafted response causes an unexpected BIND program exit, resulting in a denial of service. The supplied vector indicates network reachability, low attack complexity, and impact limited to availability; it does not indicate confidentiality or integrity impact.

How can I determine whether an installation is affected?

Check whether the installed BIND resolver version falls within one of the stated affected version ranges. The provided data identifies Ubuntu packages bind9, bind9-libs, and isc-dhcp as associated software.

UBUNTU-CVE-2026-80274: High severity ubuntu/bind9 vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What must an attacker control or provide to trigger the failure?

What is the security impact?

How can I determine whether an installation is affected?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What must an attacker control or provide to trigger the failure?

What is the security impact?

How can I determine whether an installation is affected?