CVE-2026-19666: BIND 9 DNS64 Resolver DoS Vulnerability

CVE-2026-19666 Overview

CVE-2026-19666 is a denial-of-service vulnerability in ISC BIND 9 resolvers configured with the dns64 feature. When the resolver receives a specifically malformed answer from an authoritative server, the named process exits unexpectedly. The flaw is classified as a Use-After-Free condition [CWE-416] and is exploitable over the network without authentication or user interaction. Any recursive resolver running an affected BIND 9 version with dns64 enabled is at risk of repeated crashes triggered by a remote attacker who can influence authoritative responses.

Critical Impact
A remote, unauthenticated attacker can crash the named resolver process on any BIND 9 server that has dns64 configured, disrupting DNS resolution for downstream clients.

Affected Products

ISC BIND 9 versions 9.11.0 through 9.18.50
ISC BIND 9 versions 9.20.0 through 9.20.27, and 9.21.0 through 9.21.25
ISC BIND 9 Supported Preview Edition: 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1

Discovery Timeline

2026-09-16 - CVE-2026-19666 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-19666

Vulnerability Analysis

BIND 9 implements DNS64 to synthesize IPv6 AAAA records from IPv4 A records, allowing IPv6-only clients to reach IPv4-only services. The vulnerability occurs during processing of authoritative responses that feed the DNS64 synthesis logic. When a response arrives in a specific malformed form, the resolver mishandles memory associated with the answer, resulting in a use-after-free condition. The named process then terminates rather than gracefully rejecting the response. This produces an availability outage for every client relying on the affected resolver until the process is restarted or the malicious response cycle ends.

Root Cause

The defect is a memory-safety error [CWE-416] in the DNS64 answer-processing path. Freed memory is subsequently referenced during response handling, leading to an abort of the resolver process. The condition is only reachable when dns64 is configured, which narrows the exposed population but does not require any authentication to trigger. Refer to the ISC CVE-2026-19666 Document for the vendor's technical description.

Attack Vector

Exploitation requires the attacker to cause the target resolver to receive a crafted, malformed authoritative response for a name the resolver queries. An attacker who controls or can influence an authoritative name server for a domain the resolver looks up can trigger the crash on demand. Repeated queries for attacker-controlled names can hold the resolver in a persistent crash loop, sustaining the denial of service against downstream users.

No public exploit code or proof-of-concept has been published at the time of writing. See the vendor references for remediation details.

Detection Methods for CVE-2026-19666

Indicators of Compromise

Unexpected termination or repeated restarts of the named process on resolvers with dns64 enabled.
Crash or assertion messages in BIND logs correlating with DNS64 answer processing.
Spikes in queries for unusual attacker-controlled domains immediately preceding resolver failure.

Detection Strategies

Audit named.conf for the presence of a dns64 clause to identify exposed resolvers.
Monitor process supervision systems (systemd, rc scripts) for abnormal named exit codes and restart frequency.
Correlate authoritative response anomalies with resolver process termination events in centralized logs.

Monitoring Recommendations

Ingest BIND named logs and system journal entries into a central SIEM for alerting on repeated process exits.
Track DNS resolution error rates and NXDOMAIN or SERVFAIL spikes that may indicate crashing resolvers.
Alert on new or rarely queried authoritative servers that return malformed responses to your recursive resolvers.

How to Mitigate CVE-2026-19666

Immediate Actions Required

Inventory all BIND 9 resolvers and identify any with the dns64 feature enabled.
Upgrade affected instances to a patched release as soon as feasible.
Where upgrade is not immediate, temporarily disable dns64 on exposed resolvers to eliminate the crash path.

Patch Information

ISC has released fixed versions. Upgrade to BIND 9.20.29 or later, or 9.21.26 or later, per the ISC BIND 9.20.29 Release and ISC BIND 9.21.26 Release notes. Supported Preview Edition (-S1) customers should apply the corresponding vendor-supplied fix. The BIND 9.11 and 9.18 branches are out of standard support; operators still running those versions should migrate to a supported release.

Workarounds

Disable the dns64 configuration stanza in named.conf if IPv4-to-IPv6 synthesis is not required.
Restrict recursive resolver access to trusted client networks using allow-query and allow-recursion access control lists.
Deploy resolver redundancy so that a crashed named instance does not cause total DNS outage for clients.

bash

# Example: comment out the dns64 block in named.conf to remove the vulnerable code path
# options {
#     dns64 64:ff9b::/96 {
#         clients { any; };
#     };
# };

# Verify running BIND version after patching
named -v