EUVD-2026-80776
GHSA-p6fx-3c9f-wcc9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated single-query crash gives AV:N/AC:L/PR:N/UI:N; impact is process exit only, so C:N/I:N/A:H; the options-block precondition is a deployment limiter, not per-instance attack complexity.
Primary rating from Vendor (isc).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
If BIND is loaded with a "named.conf" file that contains no global "options" block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure and subsequent unexpected program exit. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.
AnalysisAI
Denial of service in ISC BIND 9 allows a remote, unauthenticated attacker to terminate the named daemon by sending a single DNS query of QTYPE TKEY, causing an assertion failure and unexpected process exit, but only on servers loaded with a named.conf file that contains no global 'options' block. Affected builds are 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1; the CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting availability-only impact with no confidentiality or integrity loss. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target BIND 9 instance to be loaded with a named.conf file that contains NO global 'options' block - this is the specific, mandatory precondition named in the advisory and the primary limiting factor, since typical production configurations define a global options block and would not be vulnerable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine availability-only denial-of-service issue in ISC BIND 9's named daemon, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is well-calibrated for a remotely reachable, unauthenticated crash with no confidentiality or integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a patched release: ISC published fixes at https://downloads.isc.org/isc/bind9/9.20.29 (9.20.x branch) and https://downloads.isc.org/isc/bind9/9.21.26 (9.21.x branch), and the corresponding maintainer/ESV rebuild should be applied for anyone on the 9.20.9-S1 through 9.20.27-S1 line - details are in the vendor advisory at https://kb.isc.org/docs/cve-2026-76163. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every BIND 9 instance and flag those running 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, or 9.20.9-S1 through 9.20.27-S1, and check each named.conf for a global 'options' block; for any affected server missing that block, add one immediately as a stopgap or restrict DNS port access to trusted client networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
BIND resolver servers performing DNSSEC validation can be forced into excessive CPU consumption when encountering a mali
Memory exhaustion in BIND 9 resolver allows unauthenticated remote attackers to cause denial of service by querying spec
Memory corruption in ISC BIND 9's DNS-over-HTTPS (DoH) implementation lets remote attackers trigger a use-after-free (CW
DNSSEC validation bypass in ISC BIND 9 resolvers (9.11.0 through 9.21.23 and S-editions) allows an attacker controlling
Denial of service in ISC BIND 9 lets a remote unauthenticated attacker exhaust resolver memory by flooding a DNSSEC-vali
Remote denial of service in ISC BIND 9 lets an attacker crash a validating resolver via a maliciously crafted DNSSEC pro
Denial of service in ISC BIND 9 resolvers (9.20.0-9.20.24, 9.21.0-9.21.23, and 9.20.9-S1-9.20.24-S1) lets remote unauthe
Cache poisoning in ISC BIND 9 recursive resolvers allows an attacker who controls an authoritative zone to inject forged
RPZ policy bypass and remote denial-of-service in ISC BIND 9 resolvers lets unauthenticated attackers defeat Response Po
Remote denial of service in ISC BIND 9 lets an off-path attacker crash a recursive resolver by controlling the timing an
Denial of service in ISC BIND 9 DNS servers configured with TKEY GSS-API authentication allows remote unauthenticated at
Remote denial of service in ISC BIND 9 named allows unauthenticated attackers to trigger assertion failures and crash th
Same weakness CWE-617 – Reachable Assertion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today