The Internet Systems Consortium has pushed out two new BIND 9 releases, 9.20.29 and 9.21.26, to resolve a total of fourteen security flaws. The updates were disclosed on 16 September and cover the open-source DNS server software used widely across the internet.
One of the flaws is particularly notable because it affects any BIND server that responds to DNS-over-HTTPS (DoH) queries. According to the source, a sender with no prior authentication can exploit this issue to crash the server, making it a straightforward denial-of-service risk for operators running DoH.
The source does not provide details about the remaining thirteen vulnerabilities, so their severity and impact remain unclear from this report alone. Administrators running affected versions of BIND 9 are advised to update to the patched releases to protect against the known DoH crash and any other unresolved issues included in this batch.