CVE-2026-77692

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.20.0 through 9.20.27 BIND 9 versions 9.21.0 through 9.21.25 BIND 9 versions 9.20.9-S1 through 9.20.27-S1

Description An attacker can cause the named process to abort by sending a crafted DNS-over-HTTPS request containing a cryptographically invalid SIG(0) record and prematurely closing the transport connection. Real-world incidents have occurred where attackers used single malformed SIG(0) requests to cause immediate crashes of DNS-over-HTTPS servers. This can enable lateral movement through recursive resolvers and cache poisoning across network segments.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.