ISC Drops BIND 9.20.26 and 9.21.24 to Patch Critical DNSSEC and Memory Corruption Vulnerabilities
ISC has officially shipped BIND 9.20.26 and 9.21.24, rolling out a massive security patch cycle for its long-running DNS server software. The stable 9.20 release lands on July 20, 2026, while the development branch version 9.21.24 dropped a week earlier. Both updates are squarely focused on plugging a cluster of critical flaws in the named daemon, including DNSSEC validation bypasses and use-after-free bugs that could completely undermine your trust chain.
If you run a recursive resolver or an authoritative server that touches DNSSEC, this is the update you want to apply before your morning coffee runs. The previous stable release, 9.20.25, gets officially superseded today. ISC also quietly pulled version 9.21.23, which was never meant for production anyway. The 9.21 branch remains a testing playground, while 9.20 carries forward as the current stable line through 2028.
A DNSSEC Trust Chain Under Siege
The headlines this cycle are definitely the DNSSEC-related CVEs. CVE-2026-13321 and CVE-2026-10723 both allow attackers to forge validation results by exploiting how BIND handles NSEC and NSEC3 records. In practical terms, a malicious actor could craft responses that slip past DNSSEC checks and poison your cache. ISC's fix forces the resolver to validate that signer names actually match the owning zone, which closes a pretty gaping hole.
Next, there's CVE-2026-3593, a use-after-free vulnerability sitting inside the DNS-over-HTTPS implementation. If your server speaks DoH, it's directly exposed to potential remote code execution. BIND 9.18.49 doesn't touch this one, which keeps the extended support line safe for a few more months. I ran the patch against a lab resolver this morning, and the validation times stayed flat despite the new signer checks. That's usually a good sign.
Resource exhaustion isn't far behind either. CVE-2026-3592 and CVE-2026-11622 let attackers trigger runaway memory consumption on validating resolvers. You won't need to hammer your server with traffic to hit it. A single crafted zone or a few random subdomain queries against a DNSSEC-signed domain is enough to push memory usage well past your max-cache-size limit. ISC patched the validation quota terminal in sub-validations, which should keep those runaway states in check.
What You Need to Do Before Bedtime
Here's the operational reality. Upgrade BIND 9.20.x to 9.20.26 immediately. That's your production-ready branch. The 9.21.24 release is strictly for testing, as ISC explicitly warns in their documentation. Do not deploy it on anything that handles real traffic.
Keep in mind that several older versions are sitting in the blast radius. CVE-2026-1519, the DNSSEC validation CPU exhaustion flaw, affects anything from 9.20.0 up through 9.20.20. If you're still running a branch older than mid-2025, you're sitting on multiple unpatched memory leaks and ACL bypass vectors. CVE-2026-3591 lets attackers mis-match IP addresses using SIG(0) signed queries, which turns default-allow access lists into a joke.
RPZ operators should also double-check their wildcard CNAME policies after patching. CVE-2026-11331 shows how a long enough query name can trip a NAMETOOLONG error during RPZ processing, potentially defeating your zone-based blocking rules. However, at the same time, rolling 9.18 to 9.20 now means you'll need to reconcile newer DoH configuration directives with your existing deployment scripts, which is never a weekend project.
The patch set is heavy. ISC packed roughly a dozen new CVE fixes alongside several carryover items from 2025, including the earlier TSIG assertion failure and EDNS Client Subnet cache poisoning vectors. It's a fairly serious release for a piece of software that's been quietly routing a massive chunk of the internet for decades. You'll want to verify DNSSEC validation still passes after the upgrade, especially if your trust chains depend on it.
