CVE-2026-19941: BIND 9 Information Disclosure Vulnerability

CVE-2026-19941 Overview

CVE-2026-19941 is a DNS validation flaw in ISC BIND 9 named resolvers. The resolver may accept an inapplicable NSEC record as proof that no wildcard exists for a queried name. An attacker positioned at the same level or an upstream level of the victim's zone name can exploit this behavior to mask the existence of a legitimate wildcard record. The flaw is classified under CWE-345: Insufficient Verification of Data Authenticity and undermines a core DNSSEC trust assumption. Affected releases span BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and the corresponding -S1 subscription branches.

Critical Impact
A network-adjacent attacker can suppress a victim's wildcard DNS records, causing resolvers to return NXDOMAIN or alternate answers instead of the legitimate wildcard-derived response.

Affected Products

ISC BIND 9.11.0 through 9.18.50
ISC BIND 9.20.0 through 9.20.27 and 9.21.0 through 9.21.25
ISC BIND Supported Preview Edition 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.27-S1

Discovery Timeline

2026-09-16 - CVE-2026-19941 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-19941

Vulnerability Analysis

DNSSEC uses NSEC records to authenticate the non-existence of names or record types within a zone. When a resolver processes a query that would normally match a wildcard (*.example.com), it must validate two proofs: that the exact queried name does not exist and that no applicable wildcard exists that would have synthesized the response. BIND 9's named resolver fails to verify that a supplied NSEC record actually covers the relevant wildcard scope before accepting it as proof of wildcard non-existence. As a result, an attacker can supply an NSEC record from a different portion of the zone hierarchy and the resolver treats it as authoritative denial of the wildcard.

Root Cause

The root cause is insufficient verification of the applicability of an NSEC record to the specific wildcard being denied. The validator accepts NSEC records that are cryptographically signed and structurally valid but semantically inapplicable to the wildcard question at hand.

Attack Vector

An attacker who controls a zone at the same level or an upstream level of the victim's zone name can craft responses that include an inapplicable but validly signed NSEC record. When the resolver processes this response for a name that should have matched the victim's wildcard, the resolver concludes that no wildcard exists and returns an NXDOMAIN or alternate answer instead of the wildcard-synthesized record. The attack requires network positioning and precise timing, reflected in the high attack complexity rating. Refer to the ISC CVE-2026-19941 Documentation for the detailed protocol analysis.

Detection Methods for CVE-2026-19941

Indicators of Compromise

Unexpected NXDOMAIN responses for names that should resolve via a known wildcard record in a signed zone
DNS responses containing NSEC records whose owner name or type bitmap does not cover the queried wildcard scope
Discrepancies between authoritative server logs (wildcard match) and downstream resolver responses (NXDOMAIN)

Detection Strategies

Compare resolver responses against direct queries to authoritative name servers for wildcard-backed names
Enable BIND query logging and DNSSEC validation logging to capture NSEC proof chains for later analysis
Deploy passive DNS collection to identify anomalous NSEC record patterns targeting high-value zones

Monitoring Recommendations

Monitor named version strings across the resolver fleet and flag any instance in the vulnerable version ranges
Alert on sudden shifts in NXDOMAIN response rates for zones that publish wildcard records
Correlate DNS resolution failures with upstream zone changes or delegation events

How to Mitigate CVE-2026-19941

Immediate Actions Required

Inventory all recursive named instances and identify versions within the affected ranges
Upgrade to BIND 9.20.29 or 9.21.26, or to the corresponding fixed -S1 release for subscription users
Verify DNSSEC validation remains enabled after upgrade and test resolution of known wildcard-backed names

Patch Information

ISC has released fixed versions BIND 9.20.29 and 9.21.26 that correct the NSEC applicability check. Subscription Preview Edition users should obtain the corresponding -S1 patched builds from ISC. Consult the ISC CVE-2026-19941 Documentation for the complete list of fixed versions and upgrade guidance.

Workarounds

No configuration-based workaround eliminates the flaw; upgrading is the supported remediation
Where immediate patching is not possible, restrict recursion to trusted clients and prefer authoritative sources under administrative control
Consider forwarding resolution for critical wildcard-backed zones to a patched resolver until the fleet is upgraded

bash

# Verify installed BIND version and confirm it is at or above a fixed release
named -v

# Example: restrict recursion to internal networks in named.conf
options {
    recursion yes;
    allow-recursion { 10.0.0.0/8; 192.168.0.0/16; };
    dnssec-validation auto;
};