CVE-2026-19667: BIND 9 DNS Server DoS Vulnerability

CVE-2026-19667 Overview

CVE-2026-19667 is a denial-of-service vulnerability in ISC BIND 9's named resolver. An attacker-controlled authoritative DNS server can return a negative answer that is exactly 65536 bytes in size. This triggers a flaw that causes named to create a negative cache entry of 0 bytes. When the resolver later reads that entry, the process aborts. The issue is classified under [CWE-197] Numeric Truncation Error and affects both open-source and Supported Preview Edition (S1) branches of BIND 9.

Critical Impact
Remote attackers can crash recursive BIND 9 resolvers without authentication, disrupting DNS resolution for all downstream clients.

Affected Products

ISC BIND 9 versions 9.11.0 through 9.18.50
ISC BIND 9 versions 9.20.0 through 9.20.27 and 9.21.0 through 9.21.25
ISC BIND 9 Supported Preview Edition 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.27-S1

Discovery Timeline

2026-09-16 - CVE-2026-19667 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-19667

Vulnerability Analysis

The flaw lives in the negative caching path of named. BIND 9 caches negative responses (such as NXDOMAIN or NODATA) so it can serve subsequent identical queries without re-querying authoritative servers. When the resolver processes a negative answer whose serialized size is exactly 65536 bytes, an internal size field is truncated, producing a cache entry recorded as 0 bytes. The subsequent read of that malformed entry hits an assertion inside named and terminates the process. Because a recursive resolver is often a single point of DNS resolution for many clients, an abort cascades into a service outage across the network segment it serves.

Root Cause

The root cause is a numeric truncation error [CWE-197] in the code path that computes the on-cache size of a negative answer. A 16-bit width cannot represent 65536, so the value wraps to 0. The cache-insertion routine accepts the zero-sized entry rather than rejecting the malformed record, and the eventual reader relies on an invariant that the size is non-zero.

Attack Vector

Exploitation requires an attacker to control an authoritative name server for a zone that a target BIND 9 resolver will query, or to induce the resolver to send a query that the attacker can answer. The attacker crafts a negative response padded to exactly 65536 bytes and returns it to the resolver. No authentication or user interaction is needed, and the attack is delivered over the network. The impact is limited to availability; confidentiality and integrity are not affected. No public proof-of-concept or in-the-wild exploitation has been reported. See the ISC advisory for CVE-2026-19667 for technical specifics.

Detection Methods for CVE-2026-19667

Indicators of Compromise

Unexpected named process termination with assertion-failure messages in syslog or named.log.
Repeated restarts of the BIND 9 service correlated with queries to attacker-controlled or unusual external domains.
Inbound DNS responses from authoritative servers with payload sizes approaching the 65536-byte boundary.

Detection Strategies

Monitor named for abnormal exit codes and correlate crash timestamps with the last outbound recursive query in query logs.
Alert on DNS responses whose serialized size is at or near 65536 bytes, which is anomalous for legitimate authoritative traffic.
Track resolver availability metrics such as query success rate and process uptime to catch crash-restart loops early.

Monitoring Recommendations

Enable BIND 9 query logging and forward named logs to a centralized log platform for correlation with process events.
Baseline typical DNS response sizes per upstream authoritative server and alert on statistical outliers.
Review egress DNS resolution paths so that recursive resolvers only forward to trusted upstreams where feasible.

How to Mitigate CVE-2026-19667

Immediate Actions Required

Upgrade to a fixed BIND 9 release: 9.20.29 or 9.21.26, or the corresponding Supported Preview Edition build from ISC.
Inventory all internal recursive resolvers and confirm the running BIND version against the affected ranges.
Restrict recursion so that only trusted internal clients can query the resolver, reducing the pool of attackers able to trigger outbound lookups to malicious zones.

Patch Information

ISC has released BIND 9.20.29 and 9.21.26 to remediate CVE-2026-19667. Administrators running Supported Preview Edition branches should obtain the equivalent S1 patched release directly from ISC. Refer to the ISC CVE-2026-19667 knowledge base article for the complete list of fixed versions and upgrade guidance.

Workarounds

No configuration-only workaround is published by ISC; upgrading is the supported remediation path.
Where immediate patching is not possible, front the resolver with a secondary resolver or DNS filtering layer that normalizes or drops oversized responses.
Configure process supervision to restart named automatically to reduce outage duration while patches are staged.

bash

# Verify installed BIND 9 version before and after patching
named -v

# Example: restrict recursion to trusted internal networks in named.conf
# options {
#     allow-recursion { 10.0.0.0/8; 192.168.0.0/16; };
# };