https://seclists.org/oss-sec/2026/q3/801: ISC has disclosed fourteen vulnerabilities in BIND 9 (CVE-2026-19033, CVE-2026-19662, CVE-2026-19666, CVE-2026-19667, CVE-2026-19668, CVE-2026-19941, CVE-2026-75029, CVE-2026-76163, CVE-2026-77119, CVE-2026-77692, CVE-2026-78301, CVE-2026-80274, CVE-2026-81563, CVE-2026-81736)
Affected Software
Frequently Asked Questions
Which issue can be triggered through an unauthenticated zone-transfer update?
CVE-2026-19033 applies IXFR deltas to the live zone before TSIG verification. The disclosure describes the IXFR update as unauthenticated.
Which deployments have an explicitly identified DNS64-related exposure condition?
CVE-2026-19666 is a use-after-free in query_addnoqnameproof() through the DNS64 filter64 path. Deployments not using that path are not identified by the disclosure as having this specific trigger.
Which issue specifically affects recursive resolver operation?
CVE-2026-19662 is described as a qpcache NOQNAME proof use-after-free that crashes the recursive resolver. This is the vulnerability in the disclosed details that explicitly names recursive resolver functionality.
Is there a configuration condition associated with the TKEY query crash?
Yes. CVE-2026-76163 causes named to abort on a TKEY query when the user configuration has no global options statement. Checking whether a global options statement is present can identify this stated condition.
Which disclosed issues are described as denial-of-service or resource-consumption risks?
CVE-2026-19662 can crash a recursive resolver, CVE-2026-19667 causes a remote assertion failure, CVE-2026-19668 causes resource exhaustion from excessive DNSSEC cryptographic material matching, CVE-2026-75029 enables wire-to-work amplification, and CVE-2026-76163 can abort named.