CERT-In BIND advisory covers 14 CVEs with cache poisoning and zone injection risk

What the advisory covers

On 21 September 2026, India's CERT-In published vulnerability note CIVN-2026-0467 with a HIGH severity rating, covering fourteen CVEs in ISC's BIND name server. According to a dev.to analysis of the advisory, the identifiers are CVE-2026-19033, CVE-2026-19662, CVE-2026-19666, CVE-2026-19667, CVE-2026-19668, CVE-2026-19941, CVE-2026-75029, CVE-2026-76163, CVE-2026-77119, CVE-2026-77692, CVE-2026-78301, CVE-2026-80274, CVE-2026-81563 and CVE-2026-81736.

Most BIND security notices describe crash conditions. This one stands out because CERT-In explicitly names spoofing, cache poisoning and the unauthorized insertion of data into a DNS zone among the possible outcomes. Those are attacks on the correctness of DNS answers, not merely on server uptime.

The mechanics

CERT-In traces the fourteen flaws to a mix of low-level defects and validation weaknesses: use-after-free, a numeric truncation error, memory that is never released after its useful life, a reachable assertion, null pointer dereference, inefficient algorithmic complexity, excessive resource consumption inside loops, and asymmetric resource consumption in the form of amplification, among others.

Three of those classes bear directly on integrity. An origin validation error means the server can accept data without properly establishing where it originated. Insufficient verification of data authenticity means a response may be treated as genuine without adequate proof. Acceptance of extraneous untrusted data alongside trusted data allows attacker-supplied content to travel with records the server already considers trustworthy.

Exploitation, according to the dev.to write-up, involves crafted DNS queries, DNS responses, DNSSEC-related records, zone-transfer data, TKEY requests, SVCB/HTTPS records or DNS-over-HTTPS requests. For the integrity classes, the meaningful precondition is that an attacker manages to place a forged response or record where a server will process it — the same setup cache poisoning requires.

The consequence of a successful integrity attack is a wrong answer rather than an outage. A poisoned entry stays in the cache until the record's TTL expires, quietly sending traffic to the wrong destination the entire time. Spoofed responses weaken the guarantee that a reply originates from the real authority for a name. Injected zone data changes what an authoritative server publishes, with the ability to point a domain's mail, web traffic or service discovery at new destinations. Each of these outcomes fails to trigger any built-in alarm, which makes them harder to catch than a crash.

CERT-In does not claim active exploitation of any of the fourteen CVEs and does not publish per-CVE attack prerequisites, according to the write-up.

Affected versions and exposure

The advisory covers BIND 9.11.0 through 9.18.50, BIND 9.20.0 through 9.20.27, BIND 9.21.0 through 9.21.25, plus the Supported Preview Edition ranges 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.27-S1. Because the note does not map individual CVEs to individual releases, operators should confirm the fixed build for each CVE against ISC's own advisories.

For a sense of scale, a ZoomEye search for BIND-fingerprinted hosts returned 19,364,144 internet-reachable assets. That count says nothing about how many are recursive resolvers — the group whose caches face real poisoning risk.

What operators should do

The dev.to analysis recommends applying the vendor updates referenced by CERT-In, then tightening the trust boundary around the server:

• Turn on DNSSEC validation and confirm it is actually enforcing, wherever the deployment supports it.
• Limit recursion to known clients, making it harder for an off-path attacker to reach the resolver at all.
• Enforce TSIG with explicit peer authorization on zone transfers.
• Turn off dynamic update unless there is a concrete need for it.
• Watch for cached answers that shift unexpectedly and for authoritative records modified outside approved change windows, since integrity failures tend to stay quiet.

Why it matters

A crashed resolver triggers alarms; a poisoned one keeps answering, just incorrectly. Traffic flows toward attacker-influenced destinations for as long as a TTL allows, and injected zone data can redirect an entire domain's mail and web presence without affecting availability at all. With roughly 19 million BIND-fingerprinted hosts reachable on the public internet and remediation spread across fourteen CVEs, both recursive and authoritative operators face a patching and hardening job that monitoring alone will not substitute for. The practical message of the advisory is that updating BIND is necessary but not sufficient: the surrounding trust boundary — DNSSEC, recursion limits, TSIG on transfers, dynamic update policy — decides whether these flaws become redirected traffic.