The Internet Systems Consortium released security patches for BIND 9 DNS server software on 16 September, addressing fourteen vulnerabilities across versions 9.20.29 and 9.21.26. One flaw allows unauthenticated attackers to crash any BIND server configured to answer DNS-over-HTTPS requests with a single malicious packet.
BIND powers authoritative and recursive DNS infrastructure for millions of organisations worldwide. The software handles domain name resolution for everything from email delivery to web browsing. A denial-of-service vulnerability in BIND reaches organizations running DNS-over-HTTPS endpoints, a growing standard for encrypted DNS queries that bypass traffic inspection.
The DoH vulnerability stems from improper handling of invalid SIG records within HTTPS requests. An attacker without authentication credentials can send a specially crafted DNS query containing a malformed signature record, triggering a crash of the named daemon process. This forces DNS services offline until administrators restart the service. For organisations relying on BIND for recursive or authoritative DNS, downtime directly impacts all downstream applications and services.
The scope extends beyond DoH endpoints. ISC disclosed additional vulnerabilities affecting BIND's DNS handling, query processing, and zone transfer mechanisms. While specific CVE identifiers tie to individual flaws, the fourteen-bug batch suggests systemic issues across multiple code paths. Organisations running BIND in production environments face cascading risk if they delay patching. Each unpatched server becomes a potential target for denial-of-service attacks or exploitation attempts.
The timing matters. DoH adoption accelerates across enterprise networks and public DNS resolvers. Cloudflare, Google, and other major providers now offer DoH services. Internal enterprise DNS servers increasingly support DoH to prevent user queries from leaking over unencrypted connections. This expansion creates more attack surface. Any BIND server answering DoH queries sits exposed to the crash flaw until patched.
ISC specified that versions 9.16 through 9.21 require updates. Organisations running older unsupported releases should escalate patching timelines or plan migrations. The vendor does not provide backports for versions beyond the current support window, forcing infrastructure teams to choose between upgrading BIND or accepting unpatched risk.
Network defenders should prioritise BIND patching within days, not weeks. The vulnerability requires minimal attacker resources. No exploit tools exist yet, but the low technical barrier suggests proof-of-concept releases will follow quickly. Monitoring tools should alert on unexpected named process crashes or restarts. DNS query logs may show patterns of malformed SIG records preceding outages.
BIND remains the most widely deployed DNS server software in production networks. A single-packet crash affecting DoH implementations represents systemic risk across infrastructure reliant on encrypted DNS. Organisations should verify their BIND versions, identify which servers answer DoH requests, and deploy patches systematically. DNS service continuity depends on rapid response to these flaws.