CVE-2026-77692
EUVD-2026-8076616.09.2026, 14:17
An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.Enginsight
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources
(CNA/ADP records, vendor advisories, Enginsight analysis).
| Vendor | Product | Version | Source |
|---|---|---|---|
| isc | bind | 9.20.0 ≤ 𝑥 ≤ 9.20.27 | CNA |
| isc | bind | 9.21.0 ≤ 𝑥 ≤ 9.21.25 | CNA |
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| bind9 |
| ||||||||||||||||
| isc-dhcp |
| ||||||||||||||||
| bind9-libs |
|
openSUSE / SLES Releases
Common Weakness Enumeration
Vulnerability Media Exposure