CVE-2026-77692

Published Sep 16, 2026

Last updated 17 days ago

CVSS high 7.5
Port (53)

Overview

Description
An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.
Source
security-officer@isc.org
NVD status
Awaiting Analysis

Risk scores

CVSS 3.1

Type
Secondary
Base score
7.5
Impact score
3.6
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity
HIGH

Weaknesses

security-officer@isc.org
CWE-476

Social media

Hype score
Not currently trending

Related CVEs

  1. Concurrent execution using shared resource with improper synchronization ('race condition') in DNS Server allows an unauthorized attacker to execute code over a network.•CVE-2026-69782
  2. Use after free in Windows DNS allows an unauthorized attacker to execute code over a network.•CVE-2026-69730
  3. Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.•CVE-2026-65797
  4. Use after free in Windows DNS allows an unauthorized attacker to execute code over a network.•CVE-2026-65789
  5. Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network.•CVE-2026-62878

References

Sources include official advisories and independent security research.