AI analysis
CVE-2026-19666 is a use-after-free flaw (CWE-416) in the DNS64 processing path of ISC's BIND 9 DNS server. On a recursive resolver ('named') configured with dns64, receiving an applicable answer from an authoritative server that is malformed in a specific way causes the named process to exit unexpectedly. An unauthenticated remote attacker can therefore crash the resolver, achieving a denial of service with high availability impact but no confidentiality or integrity impact (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N). Only operators running the listed BIND 9 versions with dns64 enabled are affected; resolvers without dns64 configured are not impacted by this flaw. There is no known public proof-of-concept and the vulnerability is not on the CISA KEV list, though it was disclosed as one of fourteen BIND 9 issues by ISC.
What to do: Upgrade affected BIND 9 resolvers to a patched release beyond the listed version ranges as soon as ISC's updated builds are available, prioritizing recursively-serving resolvers with dns64 configured. As an interim mitigation, remove or comment out the dns64 block in named.conf if IPv6 translation is not required, and restrict recursion to trusted client networks. Verify exposure by checking named.conf (or included files) for dns64 directives.
Affected
| ISC BIND 9 (stable and development branches) | 9.11.0 through 9.18.50; 9.20.0 through 9.20.27; 9.21.0 through 9.21.25 |
| ISC BIND 9 Stable Preview Edition (-S1) | 9.11.3-S1 through 9.18.50-S1; 9.20.9-S1 through 9.20.27-S1 |
Estimated exposure
largeplausibly tens of thousands of dns64-enabled resolvers (a subset of the millions of BIND deployments seen in public DNS scans) — BIND is one of the most widely deployed DNS server packages, with hundreds of thousands to millions of servers visible in internet-wide scans, but only the subset configured with dns64 (used mainly in IPv6/NAT64 transition environments) is…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.