CVE-2026-80274: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-80274 is a Denial of Service vulnerability in ISC BIND 9 that causes an unexpected program exit in the validating resolver when processing a specially crafted DNSSEC response. Specifically, if an authoritative server replies with a valid wildcard answer and signed NSEC3 proof followed by an unsigned NSEC record at the same owner name, the resolver triggers a reachable assertion failure. Affected versions include BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and the corresponding Supported Preview Edition (S1) branches. The vulnerability was disclosed on September 16, 2026, with patches available the same day. It carries a CVSS v3.1 base score of 7.5 (High) (Red Hat Advisory, GitHub Advisory).

The root cause is a reachable assertion (CWE-617) in BIND's DNSSEC validation logic. When the resolver processes a response containing a valid wildcard answer with a signed NSEC3 proof, and the same response also includes an unsigned NSEC record at the identical owner name, an internal consistency check fails and triggers an assertion that terminates the named process. The attack vector is network-based, requires no authentication or user interaction, and has low attack complexity — an attacker only needs to control or influence an authoritative DNS server (or perform a man-in-the-middle attack on DNS traffic) to deliver the malformed response to a vulnerable resolver (Red Hat Bugzilla, ISC KB).

Successful exploitation causes the BIND named process to exit unexpectedly, rendering the DNS resolver unavailable and resulting in a complete loss of DNS resolution for all clients depending on the affected server. There is no confidentiality or integrity impact — the vulnerability is purely a Denial of Service. Organizations relying on BIND as a recursive resolver could experience widespread service disruption, as DNS unavailability cascades to all network services that depend on name resolution (Red Hat Advisory, GitHub Advisory).

As of the disclosure date (September 16, 2026), there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Red Hat Advisory). The EPSS score is 0.0, reflecting the current absence of observed exploitation activity. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. However, the low attack complexity and lack of authentication requirements make it a credible target for future exploitation against internet-facing BIND resolvers.

1. Identify target resolvers: Scan for internet-facing BIND resolvers using tools like Shodan or Masscan, filtering for DNS services running affected BIND 9 versions (9.11.0–9.18.50, 9.20.0–9.20.27, 9.21.0–9.21.25, or corresponding S1 branches).
2. Control or spoof an authoritative DNS server: Set up a malicious authoritative DNS server for a DNSSEC-signed zone, or position to intercept/modify DNS responses between an authoritative server and the target resolver.
3. Craft the malicious DNSSEC response: Construct a DNS response that includes (a) a valid wildcard answer, (b) a signed NSEC3 record providing proof of non-existence, and (c) an unsigned NSEC record at the same owner name as the NSEC3 record.
4. Trigger the resolver query: Cause the target BIND resolver to query for a name within the attacker-controlled DNSSEC-signed zone (e.g., by sending a DNS query to a recursive resolver that will forward it to the malicious authoritative server).
5. Achieve Denial of Service: The resolver processes the crafted response, hits the reachable assertion in the DNSSEC validation code, and the named process exits unexpectedly, taking DNS resolution offline (Red Hat Bugzilla, ISC KB).

• Logs: Sudden termination entries in /var/log/named/ or syslog showing named process exit without a graceful shutdown message; BIND assertion failure messages referencing DNSSEC validation code paths in named.log.
• Process: Unexpected absence of the named process; repeated automatic restarts of the named service (if configured with a watchdog or init system restart policy).
• Network: Unusual DNS query patterns targeting the resolver for names in obscure or newly registered DNSSEC-signed zones; DNS responses from external authoritative servers containing both NSEC3 and unsigned NSEC records at the same owner name in a single response.
• Availability: DNS resolution failures reported by clients; monitoring alerts for DNS service downtime correlating with the receipt of specific DNSSEC-signed zone responses.

ISC has released patched versions BIND 9.20.29 and 9.21.26 that address this vulnerability (GitHub Advisory, ISC Downloads). Administrators should upgrade to these fixed releases as the primary remediation. As interim mitigations, consider implementing network-level access controls (e.g., firewall rules or BIND's allow-query and allow-recursion directives) to restrict DNS queries to trusted sources, reducing exposure to malicious authoritative servers. Additionally, configure automatic restart mechanisms (e.g., systemd Restart=on-failure) to minimize downtime if the process is crashed, and apply rate limiting on DNS queries from untrusted sources (ISC KB).

The vulnerability was reported across multiple security tracking platforms including Vulners, VulDB, and oss-security mailing list shortly after disclosure on September 16, 2026 (oss-sec). Linux distribution communities noted that ISC patched 14 BIND 9 vulnerabilities simultaneously in the 9.20.29 and 9.21.26 releases (Linux Compatible). No significant independent researcher commentary or notable social media discussion has been identified beyond standard vulnerability tracking activity.