7.5High

CVE-2026-77692Unauthenticated remote crash of named via a single DoH SIG(0) request

ISC BIND 9 Published: 2026-09-16 16:55 (1 month ago)

Description

An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.

Weakness (CWE): CWE-476

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
isc	bind	9.20.0 – ≤ 9.20.27
ISC	BIND 9	9.20.0 – ≤ 9.20.27, 9.21.0 – ≤ 9.21.25, 9.20.9-S1 – ≤ 9.20.27-S1

Ubuntu fixes

USN-8969-1 Bind vulnerabilities Ubuntu 26.10, 26.04, 24.04, 22.04 · 03.11.2026 · bind9

References and patches

CVE-2026-77692 vendor-advisory
https://downloads.isc.org/isc/bind9/9.20.29 patch
https://downloads.isc.org/isc/bind9/9.21.26 patch

CVSS score

7.5High

Source: isc · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

All scores (2)

cna	CVSS 3.1	7.5High
security-officer@isc.org	CVSS 3.1	7.5High

EPSS (chance of exploitation in 30 days)

6.56%

higher than 94% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: yes
Technical impact: partial

Timeline

ID reserved2026-08-21
Published2026-09-16 16:55
Reached IP-DB2026-10-24 23:47
Last updated2026-10-27 00:10

Assigned by (CNA): isc
NVD status: Awaiting Analysis

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Ubuntu 22.04 LTS

High

CVE-2026-106023 3 days ago

Apache HTTP Server: mod_md NULL pointer dereference leads to child process crash

Apache Software Foundation Apache HTTP Server

NULL pointer dereference vulnerability in Apache HTTP Server's mod_md during HTTP request processing. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.69.

Low

CVE-2026-109163 3 days ago

Apache HTTP Server: mod_vhost_alias 1 byte stack buffer overwrite (after CVE-2026-63292)

Apache Software Foundation Apache HTTP Server

Stack-based buffer overflow vulnerability in Apache HTTP Server's mod_vhost_alias (after CVE-2026-63292) This issue affects Apache HTTP Server: 2.4.69.

8.1High

CVE-2026-119618 3 days ago

Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers

Apache Software Foundation Apache HTTP Server

Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from …

7.7High

CVE-2026-109518 10 days ago

APT RCE via hard link reuse

Debian APT; Ubuntu APT

On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into install…

7.0High

CVE-2026-84243 15 days ago

gettext: Directory traversal via the LANGUAGE environment variable

The GNU C Library glibc

The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to "..", unless the program is setuid or setgid (AT_SECURE). An attacker who can set LANGUAGE in the en…

7.8High

CVE-2026-114148 16 days ago

ASP.NET Core Elevation of Privilege Vulnerability

Microsoft .NET 10.0 installed on Linux; Microsoft .NET 10.0 installed on Mac OS; Microsoft .NET 10.0 installed on Windows; Microsoft .NET 11.0 installed on Linux

Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.