CVE-2026-76163 Overview
CVE-2026-76163 is a denial-of-service vulnerability in Internet Systems Consortium (ISC) BIND 9. The flaw triggers when BIND is loaded with a named.conf file that contains no global options block. An attacker can send a specifically crafted query of QTYPE TKEY that causes an assertion failure and unexpected program exit. The issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and Supported Preview Edition versions 9.20.9-S1 through 9.20.27-S1. The vulnerability is classified under [CWE-617] Reachable Assertion and is exploitable remotely without authentication or user interaction.
Critical Impact
A remote unauthenticated attacker can crash vulnerable named processes with a single TKEY query, disrupting DNS resolution for dependent services.
Affected Products
- ISC BIND 9.20.0 through 9.20.27
- ISC BIND 9.21.0 through 9.21.25
- ISC BIND Supported Preview Edition 9.20.9-S1 through 9.20.27-S1
Discovery Timeline
- 2026-09-16 - CVE-2026-76163 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-76163
Vulnerability Analysis
The vulnerability resides in how BIND 9 processes DNS Transaction Key (TKEY) queries when the server configuration lacks a global options block. TKEY queries are defined by RFC 2930 and negotiate shared secret keys between DNS resolvers and servers. When named receives a TKEY query under this specific configuration state, an internal invariant check fails and the process terminates through an assertion.
The attack requires no authentication, no user interaction, and can be performed across the network. Confidentiality and integrity are not affected, but availability is fully compromised for the DNS service. Because DNS underpins most enterprise services, an outage of authoritative or recursive named instances cascades into broad service disruption.
Root Cause
The root cause is a reachable assertion (CWE-617) triggered by an unhandled configuration state. BIND assumes certain default parameters are populated by the global options block during startup. When that block is absent, code paths handling TKEY queries dereference or evaluate uninitialized configuration state, hitting an assertion that terminates the daemon rather than degrading gracefully.
Attack Vector
An attacker sends a single DNS query with QTYPE TKEY to a vulnerable named instance whose configuration file omits the global options block. The query causes the assertion failure and process exit. Repeated queries after service restart prolong the outage. Refer to the ISC CVE-2026-76163 Documentation for authoritative technical detail.
No verified public proof-of-concept code exists at the time of publication. See the ISC advisory for further technical context.
Detection Methods for CVE-2026-76163
Indicators of Compromise
- Unexpected named process termination logged as an assertion failure in syslog or journald.
- Inbound DNS queries with QTYPE TKEY (numeric type 249) from unexpected sources or high volumes from a single source.
- Repeated DNS service restarts on authoritative or recursive resolvers.
Detection Strategies
- Inspect BIND logs for messages containing assertion failed alongside TKEY processing functions.
- Deploy network intrusion detection signatures that flag DNS queries with QTYPE 249 from external, non-trusted sources.
- Correlate named service crash events with preceding DNS query telemetry to identify the triggering packet.
Monitoring Recommendations
- Enable BIND query logging (querylog yes;) to capture TKEY requests targeting the resolver.
- Monitor process uptime and restart counters for named through host-based agents.
- Ingest DNS server logs into a centralized analytics platform to baseline TKEY query volume and alert on deviations.
How to Mitigate CVE-2026-76163
Immediate Actions Required
- Upgrade BIND 9 to a fixed release: 9.20.29 or 9.21.26. See the ISC BIND 9.20.29 Release and ISC BIND 9.21.26 Release.
- Audit every named.conf file across DNS infrastructure and confirm a global options block is present.
- Restrict inbound DNS traffic to trusted networks where operationally feasible until patches are deployed.
Patch Information
ISC has released fixed builds in BIND 9.20.29 and BIND 9.21.26. Administrators running the Supported Preview Edition should contact ISC for the corresponding S-branch release. Verify package signatures before deployment and restart named after installation. Full advisory details are documented in the ISC CVE-2026-76163 Documentation.
Workarounds
- Add a global options { }; block to named.conf even if empty, which removes the precondition required for the assertion.
- Apply firewall or DNS access control lists that block QTYPE TKEY queries from untrusted networks.
- Deploy redundant resolvers behind load balancers so a single crashed instance does not remove DNS availability.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
