AI analysis
Claude Opus · 5 Nov 2026, 10:21 CET
ISC BIND TKEY query flaw lets remote attackers crash DNS servers, now in CISA KEV
ISC BIND named before 9.9.7-P2 and 9.10.x before 9.10.2-P3 can be crashed remotely by any unauthenticated sender of crafted TKEY queries. CISA lists it as exploited. Update BIND and vendor-bundled copies immediately.
In plain terms
BIND is one of the most widely used DNS server programs. DNS is the internet's address book, translating names into network addresses. The BIND server process is called named. Older versions contain a flaw in how named handles a particular type of DNS request called a TKEY query, which is normally used to set up shared security keys between DNS systems. A specially crafted TKEY query makes named hit an internal safety check, called an assertion, and shut itself down.
Anyone who can send DNS traffic to the server can trigger this. No password or user action is needed. When the DNS server stops, users and systems that depend on it can no longer resolve names, so websites, email and internal applications may appear to go offline. Organisations running BIND directly, or running products that bundle it, should act. The bundling products in the record include Juniper Junos, several Linux distributions, Oracle Solaris, HP-UX and others.