CVE-2026-77692

Unauthenticated remote crash of named via a single DoH SIG(0) request

Published: Sep 16, 2026Updated: Sep 17, 2026 Sources: CVE List NVDCWE-476

7.5HIGH

Description

An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.

In plain language

AI Act now

bind 9 servers running versions 9.20.0-9.20.27, 9.21.0-9.21.25, or 9.20.9-S1-9.20.27-S1 can be knocked offline remotely, so affected small businesses should act now.

Executive summary

Unauthenticated remote denial of service in bind 9’s DNS-over-HTTPS handling: a malformed SIG(0) record followed by an abruptly closed connection triggers a null-pointer dereference and crashes named.

If affected, business impact

DNS service outageWebsite access disruptionEmail delivery disruptionInternal service interruption

What to do now

Check whether you run bind 9 and whether its DNS-over-HTTPS endpoint is enabled and reachable from the internet.
Check the installed version with named -v or your server’s package manager.
Upgrade to 9.20.29, 9.21.26, or 9.20.29-S1, choosing the patched release for your current branch.
Restart the DNS service and confirm it is answering requests normally after the upgrade.

Patch / advisory Some work to apply

What is it

This is a flaw that lets someone send one specially malformed request that makes the DNS server stop working. It is like a caller using a deliberately broken form to make a business’s switchboard shut down, preventing callers from reaching the right destination until it is restored.

Who is affected

This matters to you if you run bind 9 as a DNS server. It is only a risk when the server’s DNS-over-HTTPS endpoint is accessible to an attacker.

How urgent is it

A public exploit is available for a flaw that can remotely take the DNS service offline with a single request. There are no reported real-world attacks yet, but an affected internet-facing server should be upgraded as an urgent priority because DNS outages can immediately disrupt websites, email, and business systems.

What to do — in detail

Confirm exposure by checking the running version (named -v) and reviewing the bind 9 configuration and network controls for an enabled DNS-over-HTTPS listener reachable by untrusted networks. Affected branches are 9.20.0-9.20.27, 9.21.0-9.21.25, and 9.20.9-S1-9.20.27-S1; upgrade respectively to 9.20.29, 9.21.26, or 9.20.29-S1 using your operating system’s supported bind 9 package or ISC release process. Stay on the same release branch where possible and validate configuration syntax, service startup, and authoritative/recursive DNS responses after restarting named. No vendor workaround is known; if patching is delayed, restrict access to the DNS-over-HTTPS endpoint to trusted networks or disable that endpoint where operationally acceptable. Monitor named logs and service supervision alerts for unexpected aborts, restarts, or DNS-over-HTTPS connection failures. This CVE is not listed in CISA KEV, so no CISA due date applies.

Technical context

CVE-2026-77692 is CVSS 7.5 (High), CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. It is a CWE-476 null-pointer dereference reachable through DNS-over-HTTPS: a cryptographically invalid SIG(0) record combined with premature transport closure can abort named. No CISA KEV listing or confirmed in-the-wild exploitation is reported, although a public exploit is available. EPSS is 0.5% at the 40th percentile and flat.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

CVSS Vector Breakdown

Exploitability

AV:NAttack Vector

Network

AC:LAttack Complexity

Low

PR:NPrivileges Required

None

UI:NUser Interaction

None

Scope

S:UScope

Unchanged

Impact

C:NConfidentiality

None

I:NIntegrity

None

A:HAvailability

High

Open in CVSS calculator →

Weaknesses

CWE-476

Affected Products

ISC

commercial·USaka internet systems consortium

BIND 9

Networking Infrastructure

Exploitability

0 exploit sources identified

Exploit details including PoC links, Metasploit modules, and scanner templates are available after registration.

View exploit details

Official Patch Available

Workaround Available

Is your org exposed to CVE-2026-77692?Request an assessment to establish which checks are appropriate for your systems. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

2 techniques

Impact

Initial Access

View detailed technique mapping

References

https://kb.isc.org/docs/cve-2026-77692

kb.isc.org

https://downloads.isc.org/isc/bind9/9.20.29

downloads.isc.org

https://downloads.isc.org/isc/bind9/9.21.26

downloads.isc.org

News mentions

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-77692 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows