CVE-2026-19666

Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path

Published: Sep 16, 2026Updated: Sep 17, 2026 Sources: CVE List NVDCWE-416

7.5HIGH

Description

On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

In plain language

AI Act now

BIND 9 DNS servers using DNS64 are vulnerable to being knocked offline remotely; update affected versions promptly.

Executive summary

Unauthenticated network denial of service in BIND 9's DNS64 filter64 path: a malformed authoritative DNS response triggers a use-after-free during name-proof processing and terminates named.

If affected, business impact

DNS service outageWebsite lookup failuresEmail delivery disruptionBusiness application downtime

What to do now

Check whether your BIND 9 resolver has DNS64 enabled and whether it runs an affected release.
Upgrade to the matching patched BIND 9 release: 9.20.29, 9.21.26, or 9.20.29-S1.
Restart the DNS service after upgrading and confirm it continues answering DNS requests.

Patch / advisory Some work to apply

What is it

This is a flaw that can make a DNS server stop running when it receives a specially malformed reply. Think of DNS as the business's phone book for internet services: if the phone book clerk shuts down, staff and customers may be unable to find websites, email servers, or business applications.

Who is affected

This matters to you if you run BIND 9 as a DNS resolver. It is only a risk when the DNS64 feature is enabled.

How urgent is it

A public exploit is available, meaning attackers have a practical starting point for triggering the outage. Treat this as urgent because an attacker can stop the affected DNS service remotely, without needing an account or staff interaction.

What to do — in detail

Confirm exposure by checking the installed BIND 9 version and reviewing the resolver configuration for DNS64. Affected branches include 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

Upgrade the closest supported branch to 9.20.29, 9.21.26, or 9.20.29-S1, using ISC's normal BIND upgrade process. No workaround is known if patching must be delayed. After deployment, watch the named service for unexpected exits and investigate DNS resolution failures or restart events. CISA has not added this CVE to its Known Exploited Vulnerabilities catalog, so no CISA due date applies.

Technical context

CVSS 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The issue is CWE-416 use-after-free, reachable over the network when DNS64 is configured; a malformed applicable authoritative answer causes named to exit during query_addnoqnameproof() processing in the filter64 path. No active exploitation has been reported, and ISC states it is not aware of in-the-wild exploitation, but a public exploit is available. EPSS is 0.5% (40th percentile) and flat. This CVE is not listed in CISA KEV.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

CVSS Vector Breakdown

Exploitability

AV:NAttack Vector

Network

AC:LAttack Complexity

Low

PR:NPrivileges Required

None

UI:NUser Interaction

None

Scope

S:UScope

Unchanged

Impact

C:NConfidentiality

None

I:NIntegrity

None

A:HAvailability

High

Open in CVSS calculator →

Weaknesses

CWE-416

Affected Products

ISC

commercial·USaka internet systems consortium

BIND 9

Networking Infrastructure

Exploitability

0 exploit sources identified

Exploit details including PoC links, Metasploit modules, and scanner templates are available after registration.

View exploit details

Official Patch Available

Workaround Available

Is your org exposed to CVE-2026-19666?Request an assessment to establish which checks are appropriate for your systems. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

2 techniques

Initial Access

Privilege Escalation

View detailed technique mapping

References

https://kb.isc.org/docs/cve-2026-19666

kb.isc.org

https://downloads.isc.org/isc/bind9/9.20.29

downloads.isc.org

https://downloads.isc.org/isc/bind9/9.21.26

downloads.isc.org

News mentions

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-19666 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows