CVE-2026-19667

Remote assertion failure via 16-bit length truncation in `dns_ncache_add()`

Published: Sep 16, 2026Updated: Sep 17, 2026 Sources: CVE List NVDCWE-197

7.5HIGH

Description

If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

In plain language

AI Act now

If you run bind 9 versions 9.11.0–9.18.50, 9.20.0–9.20.27, 9.21.0–9.21.25, 9.11.3-S1–9.18.50-S1, or 9.20.9-S1–9.20.27-S1, an outsider can take your DNS service offline, so a typical small business should have IT act promptly.

Executive summary

Unauthenticated remote denial of service in bind 9: a malicious authoritative DNS server can trigger 16-bit length truncation in dns_ncache_add(), creating a zero-byte negative-cache entry that aborts named when read.

If affected, business impact

DNS service outageWebsite access disruptionEmail delivery disruptionInternal network disruption

What to do now

Ask IT to check every bind 9 resolver version and whether it can query external authoritative DNS servers.
Upgrade to the matching patched release: 9.20.29, 9.21.26, or 9.20.29-S1.
Restart the DNS service after upgrading and confirm normal DNS lookups work.

Patch / advisory Some work to apply

What is it

This is a flaw that can make the software answering DNS requests suddenly stop working. Think of it like a bad delivery label that causes the mailroom’s filing cabinet to jam shut: the DNS service can no longer direct people and systems where they need to go.

Who is affected

This matters to you if your business runs bind 9 as a DNS resolver, including through a hosting, network, or managed-service setup. An attacker does not need a login; it is a risk when your resolver can be induced to query an attacker-controlled authoritative DNS server.

How urgent is it

A public exploit is available, and an attacker can crash the DNS service remotely without credentials. No active exploitation has been reported, but this is RED because an outage can be triggered over the network and can disrupt essential business services.

What to do — in detail

Confirm the installed version with your operating system’s package inventory or named -v, then identify all resolvers that make recursive queries, including redundant and standby servers. Upgrade the relevant release branch to 9.20.29, 9.21.26, or 9.20.29-S1; choose the patched release closest to the branch currently deployed and review normal release notes before moving between branches. No temporary workaround is known if patching is delayed, so prioritize the upgrade and limit unnecessary resolver access to untrusted DNS infrastructure where operationally feasible. CISA has not assigned a KEV remediation due date. After deployment, watch for unexpected named exits, service restarts, DNS lookup failures, and resolver availability alerts.

Technical context

CVE-2026-19667 is CVSS 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), classified as CWE-197. A malicious authoritative server can return a specifically sized negative DNS response; 16-bit length truncation leads to a zero-byte negative-cache entry, and a later read causes named to abort. The attack is network-reachable in the default configuration, requires no authentication or user interaction, and requires the resolver to query the attacker-controlled authoritative server. A public exploit is available. CISA KEV does not list this CVE, and reporting states ISC was not aware of in-the-wild exploitation. EPSS is 0.5% with a flat trend.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

CVSS Vector Breakdown

Exploitability

AV:NAttack Vector

Network

AC:LAttack Complexity

Low

PR:NPrivileges Required

None

UI:NUser Interaction

None

Scope

S:UScope

Unchanged

Impact

C:NConfidentiality

None

I:NIntegrity

None

A:HAvailability

High

Open in CVSS calculator →

Weaknesses

CWE-197

Affected Products

ISC

commercial·USaka internet systems consortium

BIND 9

Networking Infrastructure

Exploitability

0 exploit sources identified

Exploit details including PoC links, Metasploit modules, and scanner templates are available after registration.

View exploit details

Official Patch Available

Workaround Available

Is your org exposed to CVE-2026-19667?Request an assessment to establish which checks are appropriate for your systems. Check my exposure

References

https://kb.isc.org/docs/cve-2026-19667

kb.isc.org

https://downloads.isc.org/isc/bind9/9.20.29

downloads.isc.org

https://downloads.isc.org/isc/bind9/9.21.26

downloads.isc.org

News mentions

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-19667 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows