Internet Systems Consortium has released a broad set of BIND 9 security fixes covering 14 vulnerabilities, several rated high severity. The weaknesses span cache poisoning, predictable DNS query values, DNSSEC processing, DNS-over-HTTPS and numerous conditions that can crash the named service or exhaust its resources.

BIND remains a foundational component in enterprise, service-provider and cloud DNS infrastructure. A resolver failure can interrupt access to many otherwise healthy applications, while poisoned cache entries can silently direct users toward attacker-controlled systems. The range of affected features means administrators should not assume that a narrowly configured server is automatically safe without checking the applicable ISC advisories and release notes.

Two fixes focus on cache-poisoning resistance

CVE-2025-40778 addresses several ways forged records could enter a recursive resolver’s cache when DNSSEC is absent or validation has been disabled. ISC tightened acceptance of DNAME and unnecessary authority-section NS records. Those records are now rejected unless the response arrives through a mechanism designed to resist spoofing, such as TCP, DNS Cookies, TSIG or SIG(0).

CVE-2025-40780 concerns the pseudo-random number generator previously used when selecting UDP source ports and DNS transaction identifiers. If an attacker can predict those values, guessing a valid response becomes easier and the protection against unsolicited replies weakens. BIND now uses a cryptographically secure generator, raising the cost of attempts to race a legitimate authoritative response.

DNSSEC remains a strong defense against falsified answers when it is correctly deployed and validated, but it does not eliminate the need for robust protocol behavior. Many domains are unsigned, and operational changes sometimes leave validation disabled. Resolver-level protections therefore remain essential.

Crafted traffic can crash or overload named

Other vulnerabilities expose denial-of-service paths. CVE-2026-3593 is a use-after-free condition in DNS-over-HTTPS handling that can be triggered while BIND writes a DNS response and receives a flood of HTTP/2 SETTINGS frames. CVE-2026-5947 can crash the service when it processes SIG(0)-signed responses under load.

The wider advisory set covers risky behavior in TSIG parsing, TKEY processing, DNSKEY and NSEC3 validation, CNAME and DNAME handling, DNS64, zone transfers, server-list management and bad-server tracking. In several scenarios, an attacker controlling an authoritative zone or DNS server can return malformed data that causes an assertion failure and terminates the resolver.

ISC also introduced limits intended to contain expensive work. Crafted negative responses, excessive DNSSEC validation, very large nameserver lists, HTTPSSVCB aliases and cache-growth patterns can consume CPU or memory even when they do not immediately crash the daemon. On a busy shared resolver, resource pressure may delay legitimate lookups and produce a wider outage.

Which systems deserve immediate attention

Teams should inventory every BIND deployment and identify its role before planning upgrades. Public recursive resolvers and DNS-over-HTTPS endpoints have direct exposure, but internal resolvers can still process hostile replies generated through user browsing or malware. DNSSEC-validating servers and installations using DNS64, response-policy zones or dynamic updates also intersect with components named in the fixes.

• Upgrade to a supported BIND branch containing the full security update set.
• Restrict recursion to authorized clients and networks rather than exposing it globally.
• Review firewall policy so authoritative and recursive functions accept only necessary traffic.
• Monitor for unexpected named restarts, assertion failures, malformed-record errors and spikes in CPU or memory.
• Confirm that DNSSEC validation is enabled where operationally appropriate and test it after upgrading.

Patch quickly, then validate resilience

Because DNS is an upstream dependency for authentication, software delivery and ordinary web access, maintenance should include more than installing packages. Operators should verify configuration compatibility, exercise failover, confirm that secondary servers are healthy and ensure monitoring detects both incorrect answers and outright downtime.

The update is also a reminder to separate authoritative and recursive duties where possible. Segmentation limits the blast radius of a resolver-specific flaw and makes access policy clearer. With 14 issues touching multiple subsystems, prompt patching paired with architecture and logging checks offers the strongest response.