CVE-2026-77692
published 2026-09-16CVE-2026-77692: An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the…
PriorityP352high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
6.56%
93.7th percentile
An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely.
This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| isc | bind | — | — |
| isc | bind_9 | 9.20.0 – 9.20.27 | — |
| isc | bind_9 | 9.20.9-S1 – 9.20.27-S1 | — |
| isc | bind_9 | 9.21.0 – 9.21.25 | — |
| ubuntu | bind9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_ubuntu8.6HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Bind vulnerabilities
vendor_ubuntu·2026-10-14·CVSS 8.6
CVE-2026-19033 [HIGH] Bind vulnerabilities
Title: Bind vulnerabilities
Summary: Several security issues were fixed in Bind.
Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain
malformed DNSKEY records. A remote attacker could possibly use this issue
to cause Bind to consume resources, resulting in a denial of service. This
issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04
LTS. (CVE-2025-8677)
Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan discovered that Bind
incorrectly accepted certain records from answers. A remote attacker could
possibly use this issue to perform a cache poisoning attack. This issue
only affected Ubuntu 18.04 LTS. (CVE-2025-40778)
Samy Medjahed discovered that Bind incorrectly handled insecure delegation
validation. A remote attacker could possibly use this iss
Red Hat
bind: BIND: Remote Denial of Service via crafted DNS-over-HTTPS request
vendor_redhat·2026-09-16·CVSS 7.5
CVE-2026-77692 [HIGH] CWE-617 bind: BIND: Remote Denial of Service via crafted DNS-over-HTTPS request
bind: BIND: Remote Denial of Service via crafted DNS-over-HTTPS request
An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely.
This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.
A flaw was found in BIND, a widely used Domain Name System (DNS) software. A remote attacker can exploit this vulnerability by sending a specially crafted DNS-over-HTTPS (DoH) request containing an invalid SIG(0) record. This action, combined with prematurely closing the connection, can cause the `named` daemon to unexpectedly terminate, leading to a Denial of Service (DoS) for affected systems.
Statement: Important: A
VulDB
ISC BIND 9 up to 9.20.27/9.21.25/9.20.27-S1 DNS-over-HTTPS input validation (Nessus ID 347970)
vuldb·2026-09-18·CVSS 7.5
CVE-2026-77692 [HIGH] ISC BIND 9 up to 9.20.27/9.21.25/9.20.27-S1 DNS-over-HTTPS input validation (Nessus ID 347970)
A vulnerability marked as critical has been reported in ISC BIND 9 up to 9.20.27/9.21.25/9.20.27-S1. This affects an unknown function of the component DNS-over-HTTPS. The manipulation leads to improper input validation.
This vulnerability is documented as CVE-2026-77692. The attack can be initiated remotely. There is not any exploit available.
GHSA
An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely.
ghsa_unreviewed·2026-09-16
CVE-2026-77692 [HIGH] CWE-476 An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely.
An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely.
This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.
No detection rules found.
No public exploits indexed.
Checkpoint
21st September – Threat Intelligence Report
blogs_checkpoint·2026-09-21
CVE-2026-91843 21st September – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 21st September – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 21st Setpember, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
Japan’s Digital Agency, which operates the Government Solution Service used by multiple ministries, has confirmed a data breach after attackers exploited a vulnerability in a VPN appliance. Approximately 246,000 records were exposed, including names and contact details belonging to government officials and contractors, while financial i
Hackernews
⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks
blogs_hackernews·2026-09-21·CVSS 10.0
CVE-2026-76460 [CRITICAL] ⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks
A browser. A plugin. A package. A login screen. Normal stuff. That is basically the problem this week.
The trouble keeps showing up inside things people already trust: code that takes a bad turn, old payloads coming back, exposed systems, weak checks, fake fixes, and attack paths that look almost too easy. Even the research side is getting messy, with more findings, more automation, and not always more clarity.
Nothing here needs much drama. Just a lot of small doors left open. Here’s what happened.
## ⚡ Threat of the Week
C
Hackernews
BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPS
blogs_hackernews·2026-09-17·CVSS 5.9
CVE-2026-19662 [MEDIUM] BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPS
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPS
The Internet Systems Consortium (ISC) has released BIND 9.20.29 and 9.21.26 to fix fourteen security flaws it disclosed on 16 September in BIND 9, its open-source DNS server software. One of them affects any BIND server that answers DNS-over-HTTPS (DoH).
A sender with no credentials can crash the server process, named, with a single request that carries an invalid SIG(0) signature, if the sender closes the connection before named finishes checking the signature.
ISC said in its advisories that it is not aware of any of the fourteen being ex
Bugzilla
CVE-2026-77692 bind: BIND: Remote Denial of Service via crafted DNS-over-HTTPS request
bugzilla·2026-09-16·CVSS 7.5
CVE-2026-77692 [HIGH] CVE-2026-77692 bind: BIND: Remote Denial of Service via crafted DNS-over-HTTPS request
CVE-2026-77692 bind: BIND: Remote Denial of Service via crafted DNS-over-HTTPS request
An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely.
This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.
2026-09-16
Published