Internet Systems Consortium (ISC) has released BIND 9.20.29, an Extended Support Version update that addresses 14 security vulnerabilities affecting the named DNS server and recursive resolver. The update fixes DNSSEC validation bypasses, cache-poisoning risks, remotely triggerable crashes, and resource-exhaustion conditions that could disrupt DNS availability or weaken trust in validated answers. BIND 9.20.29 follows the withdrawn 9.20.28 release and is the recommended upgrade for affected 9.20 deployments.
BIND 9.20.29 Fixes 14 Security Flaws An attacker capable of injecting responses can compromise secure delegation, allowing for forged unsigned answers and cache poisoning. CVE-2026-81736 limits CPU-intensive processing of large, interlinked HTTPS and SVCB alias records, while CVE-2026-81563 corrects a cache-memory leak involving alias targets with more than 13 records.
These include CVE-2026-19666, which impacts recursive resolvers with dns64 configured and break-dnssec set to yes; CVE-2026-19667, involving malformed negative cache entries; and CVE-2026-19662, a race condition affecting cached DNSSEC NOQNAME proofs. ISC also addressed crashes related to repeated SOA, CNAME, and DNAME records; SIG(0)-authenticated HTTPS queries; TKEY queries without global options; and wildcard responses containing both NSEC and NSEC3 proofs. BIND now requires TSIG authentication on every message in incoming AXFR and IXFR transfers, closing a gap where unsigned transfer messages were previously processed before being authenticated.
