The Internet Systems Consortium (ISC) has released BIND 9.20.29 and 9.21.26 to address fourteen security flaws. One critical vulnerability affects any BIND server answering DNS-over-HTTPS (DoH), allowing an unauthenticated sender to crash the ‘named’ process with a single invalid request. All BIND 9 users are advised to update to the latest versions to mitigate these risks.