CVE-2026-80274 Overview
CVE-2026-80274 is a denial-of-service vulnerability in ISC BIND 9 resolvers. An authoritative server can return a crafted response containing a valid wildcard answer with signed NSEC3 proof, immediately followed by an unsigned NSEC record at the same owner name. Processing this response triggers a reachable assertion in the resolver and causes an unexpected program exit.
The flaw is categorized under [CWE-617] (Reachable Assertion). Any BIND 9 resolver that validates DNSSEC responses from an untrusted authoritative zone is exposed. Attackers can trigger the crash remotely across the network without authentication or user interaction, disrupting DNS resolution for downstream clients.
Critical Impact
A remote, unauthenticated attacker can crash BIND 9 resolvers by sending or serving a malformed DNSSEC response, causing sustained loss of DNS availability.
Affected Products
- ISC BIND 9 versions 9.11.0 through 9.18.50
- ISC BIND 9 versions 9.20.0 through 9.20.27, and 9.21.0 through 9.21.25
- ISC BIND 9 Supported Preview Edition 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1
Discovery Timeline
- 2026-09-16 - CVE-2026-80274 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-80274
Vulnerability Analysis
The vulnerability lives in the BIND 9 resolver's DNSSEC validation path. When the resolver queries a signed authoritative zone, it expects proofs of non-existence to be consistent with the zone's signing scheme. The affected code cannot correctly reconcile a valid signed NSEC3 proof accompanying a wildcard answer with an unsigned NSEC record that appears at the same owner name.
Instead of rejecting the malformed response as a validation failure, the resolver reaches an internal assertion that was never expected to fire under normal protocol behavior. The assertion terminates the named process. Downstream clients relying on the resolver lose name resolution until the daemon is restarted.
The issue is a logic gap in response handling rather than a memory corruption bug. Confidentiality and integrity are not directly impacted, but availability of DNS service is fully lost while the crash condition persists.
Root Cause
The root cause is an unhandled response combination during DNSSEC validation. The resolver assumes that a signed NSEC3 wildcard proof will not coexist with an unsigned NSEC record for the same owner name. When both appear in the same response, an internal invariant fails and BIND aborts through an assertion check ([CWE-617]).
Attack Vector
Exploitation requires that a BIND 9 resolver send a query for a DNSSEC-signed zone controlled or influenced by the attacker. The attacker returns an authoritative response containing a valid wildcard answer, a signed NSEC3 proof, and an unsigned NSEC record at the same owner name. The resolver processes the response during validation and exits.
The attack is network reachable, requires no privileges, and needs no user interaction. Any recursive resolver that follows delegations to attacker-controlled authoritative infrastructure can be crashed repeatedly by re-triggering the query.
See the ISC CVE-2026-80274 Documentation for protocol-level detail on the malformed response structure.
Detection Methods for CVE-2026-80274
Indicators of Compromise
- Unexpected named process termination with an assertion failure message in syslog or the BIND log channel.
- Repeated resolver restarts by process supervisors such as systemd immediately after outbound queries to a specific signed zone.
- Spikes in SERVFAIL responses to downstream clients correlated with resolver crash events.
Detection Strategies
- Monitor BIND logs for assertion strings and abnormal exit codes from named, and alert on any occurrence in production resolvers.
- Correlate resolver crashes with the last outbound query destination to identify hostile authoritative zones triggering the fault.
- Track version banners across the resolver fleet to flag hosts still running BIND 9 releases within the affected ranges.
Monitoring Recommendations
- Enable BIND query logging on validating resolvers and forward events to a centralized SIEM for correlation with process-exit telemetry.
- Alert on repeated named restarts within a short window, since crash-loop behavior is the primary operational symptom of exploitation.
- Baseline expected query volume to DNSSEC-signed external zones and investigate anomalies that coincide with resolver instability.
How to Mitigate CVE-2026-80274
Immediate Actions Required
- Upgrade BIND 9 resolvers to a fixed release: 9.20.29, 9.21.26, or the corresponding Supported Preview Edition build from ISC.
- Inventory all recursive resolvers and confirm none remain within the affected version ranges, including embedded appliances and container images.
- Ensure process supervision restarts named automatically to shorten outage windows while patching is scheduled.
Patch Information
ISC has released fixed builds. Apply ISC BIND 9.20.29 Release or ISC BIND 9.21.26 Release depending on the deployed branch. Supported Preview Edition customers should install the matching -S1 fix from ISC. Refer to the ISC CVE-2026-80274 Documentation for full version guidance.
Workarounds
- No configuration-based workaround is published by ISC; upgrading is the supported remediation path.
- Where immediate patching is not possible, restrict recursion to trusted clients using allow-recursion and forward external resolution to already-patched upstream resolvers.
- Consider disabling DNSSEC validation only as a last resort, since it removes protection against cache poisoning and does not fully eliminate exposure.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
