What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
ISC disclosed 14 distinct BIND 9 vulnerabilities on September 16, 2026, alongside maintenance releases BIND 9.20.29 and 9.21.26. The batch does not indicate one shared flaw: the listed issues have different causes and impacts. The likeliest reason they appeared together is release timing—ISC had already said it expected security fixes in each monthly maintenance release for the foreseeable future after a temporary surge in vulnerability reports. Operators should map their exact build to each relevant advisory and vendor notice, rather than assume one affected-version range covers all 14.
Why did 14 BIND CVEs arrive together?
The timing fits ISC’s announced release cadence, not evidence of a single incident or common root cause. On May 12, 2026, ISC said it was triaging vulnerability reports at more than ten times historic levels and attributed part of the temporary surge to large language models making vulnerability discovery easier. ISC author Vicky Risk wrote: “For the foreseeable future, users should expect security fixes in every monthly BIND maintenance release.” ISC said it would reassess the change at the end of 2026. ISC’s May 12 release-process post provides that context.
As an Amazon Associate I earn from qualifying purchases.
On September 16, ISC published 14 security advisories with BIND 9.20.29, its supported stable release at that time, and 9.21.26, its experimental development release at that time. The release announcement and disclosure list establish a shared publication date, not that the vulnerabilities were found by one method, share a cause, or were exploited together. ISC’s release announcement describes the releases; ISC’s vulnerability disclosure list enumerates the issues.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →ISC also said it was focusing vulnerability fixes on 9.20 and 9.21, with BIND 9.18 maintenance scheduled to end at the end of June 2026. That does not determine how every operating-system vendor handles older packages: distributions may maintain their own support schedules and backport fixes. Check the notice for the specific package you run.
#1 Best Overall
What are the 14 disclosed issues?
ISC’s list describes a varied set of bugs involving zone transfers, resolver proof handling, DNSSEC, message parsing, TKEY, and SVCB/HTTPS records. These titles are a map of the findings, not a complete technical analysis or a severity ranking.
- CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification.
- CVE-2026-19662: A qpcache NOQNAME proof use-after-free can crash a recursive resolver.
- CVE-2026-19666: A use-after-free in
query_addnoqnameproof()can be reached through the DNS64filter64path. - CVE-2026-19667: A 16-bit length truncation in
dns_ncache_add()can trigger a remote assertion failure. - CVE-2026-19668: Excessive matching of DNSSEC cryptographic material can exhaust resources.
- CVE-2026-19941:
checkwildcard()accepts an out-of-zone NSEC as a wildcard-nonexistence proof. - CVE-2026-75029: The message parser retains identical singleton RDATA, allowing wire-to-work amplification.
- CVE-2026-76163:
namedaborts on a TKEY query when the user configuration lacks a global options statement. - CVE-2026-77119: An NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets.
- CVE-2026-77692: A single DoH SIG(0) request can remotely crash
named. - CVE-2026-78301: Out-of-zone database nodes can become authoritative zone cuts.
- CVE-2026-80274: A validating resolver can abort while caching a mismatched NOQNAME proof.
- CVE-2026-81563: An SVCB AliasMode additional-data error leaks qpcache references.
- CVE-2026-81736: Cached SVCB/HTTPS AliasMode trees can cause remote CPU denial of service.
For any issue beyond the two examples below, consult its individual advisory before drawing conclusions about severity, affected builds, prerequisites, or mitigations.
How do the two detailed advisories differ?
The examples illustrate why “14 CVEs” is not a useful severity label. One advisory concerns a DoH request that can abort the server; the other describes resource exhaustion in a recursive resolver. Their affected ranges and mitigation guidance also differ.
| Advisory | Affected versions listed by ISC | Impact and conditions | Severity and mitigation | Fixed releases listed |
|---|---|---|---|---|
| CVE-2026-77692 | BIND 9.20.0–9.20.27 and 9.21.0–9.21.25; preview versions 9.20.9-S1–9.20.27-S1. | A remotely exploitable crafted DNS-over-HTTPS request containing a cryptographically invalid SIG(0) record, followed by prematurely closing the transport connection, can make named abort. |
High; CVSS 3.1 score 7.5. ISC says no workaround is known. ISC reported it was not aware of active exploits when the advisory was posted September 16, 2026. | 9.20.29, 9.21.26, and supported preview 9.20.29-S1. |
| CVE-2026-19668 | Affected stable releases through 9.18.50, 9.20.27, and 9.21.25, plus associated preview ranges identified in the advisory. | A recursive resolver encountering large numbers of a particular kind of invalid DNSSEC record may consume excessive resources, causing CPU exhaustion and packet loss. | Medium; CVSS 3.1 score 5.3. ISC says the default max-records-per-type and max-types-per-name limits help mitigate exposure; it lists no workarounds. ISC reported no awareness of active exploits when the advisory was posted September 16, 2026. |
9.20.29, 9.21.26, and 9.20.29-S1 for eligible preview customers. |
These version ranges are advisory-specific. For example, CVE-2026-19668 includes older 9.11–9.18 lines as well as 9.20 and 9.21 ranges, while CVE-2026-77692 lists only 9.20 and 9.21 ranges. “Not aware of active exploits” is ISC’s statement at publication, not a guarantee about the threat situation now.
Rank #3
- Sturdy, Useful and Attractive: magnetic closure pocket fits a big amount money. The pocket with a zip will keep your coin safe. Sparkly Material and fashionable design help you stand out from the crowd.
- All in one keep your organized: It has everything you need to hold cash, coins, note pads, pen, credit cards and wine/food menu specials.
- Size: 4.7" X 9" organizer fit for most apron.
- Durable and Stretch: High quality soft PU leather for this premium server book, make it light weight and high end.
- Professional:The seams and stitching are done really well and should last as long as you’re using the book. Smooth, rich black finish, looks extremely professional.
How should BIND operators respond?
- Inventory each deployment. Record the BIND version, package build and source, enabled services, and whether the server acts as a recursive resolver, authoritative server, or both. Note whether DNS-over-HTTPS is enabled where relevant.
- Match build to advisory. Compare the installed build against each applicable ISC advisory and the operating-system or vendor security bulletin. Do not apply one issue’s version range to the whole batch.
- Install the appropriate maintained update. ISC announced 9.20.29 and 9.21.26 on September 16, 2026. Those were, respectively, the supported stable and experimental development releases at announcement; check current branch status before choosing a release. If BIND came from a distribution or other vendor, follow that vendor’s package guidance and timing rather than assuming the ISC source release is already available as a package.
- Review release notes and verify the update. ISC’s release directories contain source tarballs, signatures, and release notes. Package and container availability can follow a separate schedule. Use the relevant ISC release directory and your package maintainer’s instructions, then verify the running build after deployment.
- Treat configuration limits as mitigation, not a patch substitute. For CVE-2026-19668, ISC identifies default record/type limits as mitigating exposure. For CVE-2026-77692, it says no workaround is known. Neither note removes the need to apply the appropriate fix.
- Track future notices. ISC points operators to its BIND vulnerability matrix for version mapping and its low-traffic bind-announce list for release and vulnerability notices. Recheck advisories and vendor bulletins when making an installation decision because branch status and package availability change.
What the disclosure does—and does not—establish
The September 16 disclosure establishes that ISC published 14 distinct BIND security findings alongside two maintenance releases, after announcing a period of more frequent security fixes. It does not establish a shared root cause, a single discovery source, uniform exposure across all BIND versions, or active exploitation of the batch. The Canadian Centre for Cyber Security also published a government summary of affected BIND version families; operators should still use the individual ISC advisory and their vendor’s bulletin to decide whether a particular build is affected. Canadian Centre for Cyber Security alert.
Quick Recap
Best Value
Rank #4
- Linux
- Linux DNS
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
