https://seclists.org/oss-sec/2026/q3/801: ISC has disclosed fourteen vulnerabilities in BIND 9 (CVE-2026-19033, CVE-2026-19662, CVE-2026-19666, CVE-2026-19667, CVE-2026-19668, CVE-2026-19941, CVE-2026-75029, CVE-2026-76163, CVE-2026-77119, CVE-2026-77692, CVE-2026-78301, CVE-2026-80274, CVE-2026-81563, CVE-2026-81736)

Published Sep 16, 2026

Updated

Affected Software

1 affected component

ISC BIND 9

Frequently Asked Questions

Which issue can be triggered through an unauthenticated zone-transfer update?

CVE-2026-19033 applies IXFR deltas to the live zone before TSIG verification. The disclosure describes the IXFR update as unauthenticated.

Which deployments have an explicitly identified DNS64-related exposure condition?

CVE-2026-19666 is a use-after-free in query_addnoqnameproof() through the DNS64 filter64 path. Deployments not using that path are not identified by the disclosure as having this specific trigger.

Which issue specifically affects recursive resolver operation?

CVE-2026-19662 is described as a qpcache NOQNAME proof use-after-free that crashes the recursive resolver. This is the vulnerability in the disclosed details that explicitly names recursive resolver functionality.

Is there a configuration condition associated with the TKEY query crash?

Yes. CVE-2026-76163 causes named to abort on a TKEY query when the user configuration has no global options statement. Checking whether a global options statement is present can identify this stated condition.

Which disclosed issues are described as denial-of-service or resource-consumption risks?

CVE-2026-19662 can crash a recursive resolver, CVE-2026-19667 causes a remote assertion failure, CVE-2026-19668 causes resource exhaustion from excessive DNSSEC cryptographic material matching, CVE-2026-75029 enables wire-to-work amplification, and CVE-2026-76163 can abort named.

Affected Software

Frequently Asked Questions

Which issue can be triggered through an unauthenticated zone-transfer update?

Which deployments have an explicitly identified DNS64-related exposure condition?

Which issue specifically affects recursive resolver operation?

Is there a configuration condition associated with the TKEY query crash?

Which disclosed issues are described as denial-of-service or resource-consumption risks?

Company

Resources

Contact

Frequently Asked Questions

Which issue can be triggered through an unauthenticated zone-transfer update?

Which deployments have an explicitly identified DNS64-related exposure condition?

Which issue specifically affects recursive resolver operation?

Is there a configuration condition associated with the TKEY query crash?

Which disclosed issues are described as denial-of-service or resource-consumption risks?