CVE-2026-19662

CVE-2026-19662 is a use-after-free flaw (CWE-416) in ISC BIND 9's named resolver that can cause the daemon to abort, resulting in a denial of service. An attacker must operate an authoritative server hosting a DNSSEC-signed zone and induce the victim resolver to send multiple queries to it; the crash only occurs if the attacker's crafted answers arrive in a particular sequence, order, and timing, making the attack reliable but non-trivial (CVSS attack complexity is High). A successful attack yields no data theft or tampering — only a crash of the resolver process (availability impact rated High). Any organization running an affected BIND 9 version as a recursive resolver is potentially exposed, since the resolver can be steered to the attacker's authoritative server via queries from its clients. There is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and no in-the-wild exploitation is reported; it was disclosed by ISC as part of a batch of fourteen BIND 9 vulnerabilities.

What to do: Upgrade all recursive BIND 9 resolvers past the affected ranges — i.e., to the first maintenance releases of the 9.18, 9.20, and Supported Preview (S1) branches issued after 9.18.50/9.20.27 and the matching -S1 builds, per ISC's advisory covering these fourteen CVEs. Until patched, restrict recursion to trusted client networks only, and monitor named logs for unexplained resolver aborts/restarts, which would indicate attempted triggering. Authoritative-only servers that do not perform recursion are not meaningfully exposed to this attack path.