CVE-2026-77692 Unauthenticated remote crash of named via a single DoH SIG(0) request
An attacker can crash the BIND DNS server by sending a malformed DNS-over-HTTPS request with an invalid signature, requiring DoH to be enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-77692?
CVE-2026-77692 is a high-severity denial of service vulnerability in ISC BIND 9, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.
Weakness: CWE-476
Which versions are affected by CVE-2026-77692?
How do I fix CVE-2026-77692?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-77692 being exploited?
There is no known exploitation of CVE-2026-77692 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-77692, AZL-103344, BELL-CVE-2026-77692, DEBIAN-CVE-2026-77692, ECHO-1b16-c971-86d1, GHSA-h634-6r6v-4pg6 and 4 more.