Reported by 2 outlets
BIND 9.20.29 Fixes 14 Security Flaws Including DNSSEC Bypass
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 1.00 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.58 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
BIND 9.20.29 Fixes 14 Security Flaws Enabling DNSSEC Bypass and Denial-of-Service Attacks
cyberpress.org · 26d ago · September 17th, 2026
Internet Systems Consortium (ISC) has released BIND 9.20.29, an Extended Support Version update that fixes 14 security vulnerabilities affecting the named DNS server and recursive resolver. The release addresses DNSSEC validation bypasses, cache-poisoning risks, remotely triggerable crashes, and resource-exhaustion conditions that could disrupt DNS availability or weaken trust in validated answers. BIND 9.20.29 follows the withdrawn 9.20.28 release and is the recommended upgrade for affected 9.20 deployments. BIND 9.20.29 Fixes 14 Security Flaws Two medium-severity flaws stand out because they can undermine DNSSEC protections. CVE-2026-77119 allows a validating resolver to accept a validly signed NSEC3 record from an unrelated sibling zone as an insecurity proof. An attacker able to inject responses could downgrade a secure delegation, enabling forged unsigned answers and cache poisoning . ISC assigned the issue a CVSS score of 5.9 and said it affects BIND versions from 9.20.0 through 9.20.27. CVE-2026-19941 similarly enables a forged DNSSEC-validated NXDOMAIN response. A resolver could accept an NSEC record signed by an unrelated zone as proof that a wildcard record does not exist. An on-path attacker, or a malicious forwarder operating a signed zone at the same or upstream level, could therefore mask a legitimate wildcard mapping and poison resolver caches. BIND now requires wildcard-denial and name-nonexistence proofs to be signed by the same zone. The update also resolves
-
update from gbhackers.com
BIND 9.20.29 Fixes 14 Security Flaws Enabling DNSSEC Bypass and Denial-of-Service Attacks
gbhackers.com · 26d ago · September 17th, 2026
These vulnerabilities could enable remote attackers to bypass DNSSEC protections, poison resolver caches, exhaust CPU or memory resources, and crash the named service. This update is particularly important for organizations that operate recursive, DNSSEC-validating resolvers, as they are primarily exposed to […] The post BIND 9.20.29 Fixes 14 Security Flaws Enabling DNSSEC Bypass and Denial-of-Service Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .