![isc bind]()
CVE-2026-77692 is a vulnerability in ISC BIND
Published on September 16, 2026
Unauthenticated remote crash of named via a single DoH SIG(0) request
An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely.
This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.
Vulnerability Analysis
CVE-2026-77692 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Weakness Type
NULL Pointer Dereference
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. NULL pointer dereference issues can occur through a number of flaws, including race conditions, and simple programming omissions.
Products Associated with CVE-2026-77692
Want to know whenever a new CVE is published for ISC BIND? stack.watch will email you.
Affected Versions
ISC BIND 9:- Version 9.20.0, <= 9.20.27 is affected.
- Version 9.21.0, <= 9.21.25 is affected.
- Version 9.20.9-S1, <= 9.20.27-S1 is affected.