ISC published 14 BIND 9 security advisories on 16 September 2026, seven rated High severity by ISC: CVE-2026-80274, CVE-2026-76163, CVE-2026-19666 (use-after-free in query_addnoqnameproof() via the DNS64 filter64 path; ISC CVSS 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), CVE-2026-81563, CVE-2026-77692 (unauthenticated remote crash of named via a crafted DNS-over-HTTPS request with an invalid SIG(0) record followed by a premature connection close; ISC CVSS 7.5), CVE-2026-19667 and CVE-2026-81736. ISC describes all seven High-severity issues as denial-of-service.

Triggers per ISC include a mismatched NOQNAME proof, a QTYPE TKEY query when named.conf has no global options block, a specifically malformed authoritative answer on DNS64 resolvers, SVCB/HTTPS AliasMode records, crafted DoH requests and a negative answer of exactly 65536 bytes. The other seven advisories are rated Medium by ISC and cover a resolver crash, cache poisoning, zone-data injection and resource exhaustion.

ISC says it is not aware of any active exploits. Fixed releases per ISC: BIND 9.20.29 and 9.21.26 (9.20.29-S1 for the Supported Preview Edition).

Source: ISC KB advisories.

Correction (23 Oct 2026): re-checked against ISC's own advisories and removed a third-party news source; the card now rests on ISC alone; the set is 14 advisories, not 14 denial-of-service flaws (ISC rates seven Medium issues that include cache poisoning and zone-data injection), and the affected-version line now uses ISC's ranges.