BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPS

The Internet Systems Consortium has released updates for its BIND 9 open-source DNS server software, addressing 14 security flaws. The updates, versions 9.20.29 and 9.21.26, were released in response to vulnerabilities disclosed on September 16. One of the flaws allows an unauthenticated sender to crash the server process with a single request containing an invalid SIG, affecting servers that handle DNS-over-HTTPS queries. This specific vulnerability can be exploited without the need for credentials. The updates aim to fix these security issues in the BIND 9 software.