ISC выпустил обновления BIND, устраняющие 14 уязвимостей

ISC has released fixes for fourteen vulnerabilities affecting its BIND DNS server, seven of which carry a High severity rating. The most serious, CVE-2026-77692 (CVSS 7.5), allows an attacker to crash the named process on servers supporting DNS-over-HTTPS simply by sending a request with an invalid SIG(0) signature and closing the connection before verification completes — no authentication required. Another flaw, CVE-2026-76163 (also 7.5), can be triggered with a single malformed TKEY request when named.conf lacks a global options block. The remaining issues mostly affect recursive resolvers and require a malicious DNS server to send crafted responses, potentially causing crashes, excessive CPU/memory consumption, or DNSSEC validation bypass leading to cache poisoning (CVE-2026-81563, CVE-2026-81736, CVE-2026-19941, CVE-2026-77119). All fixes are included in stable BIND 9.20.29 and the 9.20.29-S1 Supported Preview Edition, while the 9.21.26 development branch addresses thirteen of the fourteen bugs since CVE-2026-19662 does not apply to it; twelve of the fourteen flaws also affect the end-of-life BIND 9.18 branch, which will not receive patches. ISC says it has no evidence of active exploitation, though the update adds system tests revealing exploitation conditions for at least six of the vulnerabilities.