A single DoH request aborts BIND's named before the signature check finishes

named begins verifying a cryptographically invalid SIG(0) record on an incoming DNS-over-HTTPS request, the client closes the transport before that check finishes, and named aborts ^[3]. ISC wrote that "An attacker can cause named to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely" ^[5]. The sender needs no credentials and no DNS server of their own ^[3][13].

Twelve of the fourteen also affect 9.18, up to and including 9.18.50, the branch's final release ^[9]. Two do not, and they are exactly the two ISC says a bare request can trigger: CVE-2026-77692 and CVE-2026-76163, a TKEY query that crashes named when named.conf has no global options block ^[13][14][18]. The pre-authentication, single-packet exposure therefore sits on the branches that have a fix. Of the twelve still open on 9.18, the crashes need a recursive resolver to receive crafted data from a server the attacker controls ^[15]. The four data-integrity flaws each carry conditions on where the attacker sits or what they already control ^[24].

Seven of the fourteen are rated High, all at 7.5 on CVSS 3.1, and the other seven Medium, between 5.3 and 6.5 ^[16]. The High set is the crash flaws except CVE-2026-19662, plus the two SVCB/HTTPS alias-record exhaustion bugs ^[17][23]. So the DoH crash scores the same 7.5 as CVE-2026-19667, which needs a crafted response to reach a resolver on a default configuration ^[26]. ISC said in its advisories that it is not aware of any of the fourteen being exploited ^[6]. The development release, 9.21.26, fixes thirteen, because CVE-2026-19662 does not affect that branch; 9.20.29 and the 9.20.29-S1 preview edition fix all fourteen ^[7].

ISC told 9.18 users in May to plan an update to 9.20 as soon as possible ^[10], and its vulnerability matrix says "EOL versions should be assumed to be vulnerable to new CVEs" ^[11]. Distributions ship fixes on their own release schedule. Debian 12 ships a package based on 9.18.49, and the Debian security tracker had not listed any of the fourteen as of 06:20 UTC on 17 September ^[12].

Two of the Medium flaws, CVE-2026-19941 and CVE-2026-77119, let a validating resolver accept the wrong DNSSEC proof, and ISC describes both outcomes as cache poisoning ^[21]. CVE-2026-19033 matters to anyone running secondaries that accept only TSIG-signed transfers. During a multi-message incremental transfer over TCP, named could start serving the new zone data before the final message carrying the signature arrived, and it did not roll back when that signature never came. A party able to deliver the transfer could get unauthorized zone contents served without holding the key ^[19]. The fix requires a TSIG on every message of an incoming transfer, and ISC says modern name servers already sign every message, so it expects no change in practice ^[20].