CVE-2026-19662: BIND 9 Use-After-Free Vulnerability

CVE-2026-19662 Overview

CVE-2026-19662 is a use-after-free vulnerability [CWE-416] in the Internet Systems Consortium (ISC) BIND 9 named resolver. An attacker who controls an authoritative DNS server can force a victim recursive resolver to abort by triggering a specific sequence of crafted responses to DNSSEC-signed zone queries. The abort produces a denial-of-service condition against the resolver process.

The issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, and the corresponding Supported Preview (-S1) branches. ISC published the advisory and fixed release on September 16, 2026.

Critical Impact
A remote attacker operating an authoritative server can crash any recursive named resolver that queries their DNSSEC-signed zone, disrupting DNS resolution for downstream clients.

Affected Products

ISC BIND 9 versions 9.11.0 through 9.18.50
ISC BIND 9 versions 9.20.0 through 9.20.27
ISC BIND 9 Supported Preview Editions 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.27-S1

Discovery Timeline

2026-09-16 - CVE-2026-19662 published to NVD
2026-09-16 - ISC releases BIND 9.20.29 with fix
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-19662

Vulnerability Analysis

The flaw resides in the recursive resolution path of the BIND 9 named daemon when processing DNSSEC-signed responses. An attacker-controlled authoritative server returns a specific sequence of crafted answers to multiple queries from the victim resolver. When those answers arrive in a particular order and with particular timing, named dereferences memory that has already been freed. The process then aborts, terminating DNS service for all clients depending on the resolver.

Exploitation requires the victim resolver to actively query a zone hosted by the attacker. This is commonly achieved by inducing lookups for attacker-controlled domains from clients that use the target resolver.

Root Cause

The root cause is a use-after-free bug [CWE-416] in the DNSSEC response handling logic. Object lifetime management for cached response state is not correctly synchronized with the arrival order of asynchronous authoritative answers. When a specific interleaving occurs, named accesses a freed structure and triggers an assertion or memory fault.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. The attacker must control an authoritative DNS server for a DNSSEC-signed zone and must be able to induce the victim resolver to issue multiple queries against that zone. Attack complexity is high because success depends on precise response ordering and timing that the attacker cannot fully control from a remote position. Successful exploitation produces a resolver crash, not code execution or data disclosure.

See the ISC CVE-2026-19662 Overview for the vendor's technical description.

Detection Methods for CVE-2026-19662

Indicators of Compromise

Unexpected named process termination or assertion failures in system logs and named.run.
Repeated recursive queries from the resolver to a single attacker-controlled DNSSEC-signed zone shortly before a crash.
Systemd or service manager restart events for the named service without corresponding administrator action.

Detection Strategies

Monitor BIND logs for abort messages, INSIST or REQUIRE assertion failures, and use-after-free indicators from AddressSanitizer builds where available.
Correlate resolver crash timestamps with outbound DNS traffic to identify the triggering authoritative zone.
Alert on abnormal volumes of DNSSEC validation activity for newly seen zones.

Monitoring Recommendations

Ingest named service telemetry, query logs, and process exit codes into a centralized logging platform for correlation.
Track DNS resolver availability metrics and alert on service restarts exceeding baseline frequency.
Baseline queries per zone and flag sudden bursts of DNSSEC-signed zone lookups from a small set of clients.

How to Mitigate CVE-2026-19662

Immediate Actions Required

Upgrade BIND 9 to version 9.20.29 or the corresponding patched release for your branch.
Inventory all recursive resolvers and Supported Preview Edition deployments to confirm patch coverage.
Enable automatic restart of the named service to shorten outage windows if a crash occurs before patching completes.

Patch Information

ISC released BIND 9.20.29 on September 16, 2026, addressing CVE-2026-19662. Download the fixed release from the ISC BIND 9.20.29 Release directory. Supported Preview Edition subscribers should apply the equivalent -S1 build provided by ISC support.

Workarounds

No configuration-based workaround eliminates the vulnerability; upgrading is the only complete fix.
Restrict recursion to trusted client networks using allow-recursion to reduce the attack surface from arbitrary internet clients.
Deploy redundant resolvers behind a load balancer so a single-process crash does not interrupt client resolution.

bash

# Example: restrict recursion to internal networks in named.conf
options {
    recursion yes;
    allow-recursion { 10.0.0.0/8; 192.168.0.0/16; };
    allow-query-cache { 10.0.0.0/8; 192.168.0.0/16; };
};