CVE-2026-77692: BIND 9 DNS-over-HTTPS DOS Vulnerability

CVE-2026-77692 Overview

CVE-2026-77692 is a denial-of-service vulnerability in ISC BIND 9. An attacker can force the named daemon to abort by sending a DNS-over-HTTPS (DoH) request that carries a cryptographically invalid SIG(0) record, then closing the transport connection before the server finishes processing. The condition triggers a null pointer dereference [CWE-476] inside named, terminating the resolver process. The flaw affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and the Supported Preview branch 9.20.9-S1 through 9.20.27-S1. Exploitation requires no authentication and can be launched remotely over the network against any resolver exposing DoH.

Critical Impact
A single crafted DoH request can crash named, disrupting DNS resolution for every downstream client of the affected resolver.

Affected Products

ISC BIND 9.20.0 through 9.20.27
ISC BIND 9.21.0 through 9.21.25
ISC BIND Supported Preview 9.20.9-S1 through 9.20.27-S1

Discovery Timeline

2026-09-16 - CVE-2026-77692 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-77692

Vulnerability Analysis

The vulnerability lives in the SIG(0) verification path exercised when named processes DNS-over-HTTPS requests. SIG(0) is a transaction signature mechanism defined by RFC 2931 that authenticates individual DNS messages using public-key cryptography. When BIND receives a DoH request containing a SIG(0) record, named validates the signature and prepares a response referencing the associated client state. If the SIG(0) record fails cryptographic verification and the client terminates the underlying HTTP/2 stream before the response is dispatched, named reaches a code path that dereferences a pointer already released or never initialized during the failed verification. The dereference triggers an assertion failure or segmentation fault, and the daemon exits. Because DNS resolution is a foundational service, a single unauthenticated request suffices to interrupt name resolution for every dependent client.

Root Cause

The root cause is a null pointer dereference [CWE-476] in the cleanup logic that runs when a DoH client aborts a session mid-flight after a failed SIG(0) validation. The error path assumes the response context remains valid, but premature transport shutdown clears the referenced structure before it is used.

Attack Vector

An attacker needs only network reachability to the DoH endpoint of a vulnerable resolver. The attacker opens a DoH connection, submits a DNS query bearing a malformed SIG(0) record, and closes the connection before named returns a response. No credentials, user interaction, or prior foothold are required.

No public proof-of-concept code is available. Refer to the ISC Security Advisory CVE-2026-77692 for technical details.

Detection Methods for CVE-2026-77692

Indicators of Compromise

Unexpected named process termination or assertion-failure entries in BIND logs shortly after DoH traffic.
Bursts of short-lived DoH/HTTP2 sessions from a single source that close before receiving a response.
Repeated DNS queries containing SIG(0) records that fail cryptographic verification.

Detection Strategies

Monitor named logs for assertion failed, REQUIRE, or abnormal exit messages correlated with DoH client activity.
Enable BIND query logging on the DoH listener and alert on SIG(0) validation failures followed by immediate client disconnect.
Inspect HTTP/2 telemetry on the DoH endpoint for RST_STREAM or GOAWAY frames sent before server response completion.

Monitoring Recommendations

Track named process uptime and restart counts through host telemetry and alert on unexpected respawns.
Aggregate resolver crash events across the fleet to identify coordinated exploitation attempts.
Correlate DoH source IPs generating repeated malformed SIG(0) requests with threat intelligence feeds.

How to Mitigate CVE-2026-77692

Immediate Actions Required

Upgrade BIND to a fixed release before exposing DoH endpoints to untrusted networks.
Restrict DoH access with firewall rules or reverse-proxy access controls until patching is complete.
Deploy resolver redundancy so a single crashed instance does not remove DNS service for clients.

Patch Information

ISC has released fixed builds. Upgrade to ISC BIND9 Version 9.20.29 or ISC BIND9 Version 9.21.26. Supported Preview subscribers should obtain the corresponding S-branch build from ISC. Full remediation details are documented in the ISC Security Advisory CVE-2026-77692.

Workarounds

Disable the DoH listener in named.conf if DNS-over-HTTPS is not required in the environment.
Terminate DoH at an upstream reverse proxy that can filter or rate-limit malformed HTTP/2 streams.
Apply strict source-address ACLs to any resolver that must continue serving DoH before patching.

bash

# Example: disable DoH listener in named.conf until patched
# options {
#     https-port 443;
#     listen-on port 443 tls none http default { any; };  // remove or comment out
# };