CVE-2026-19667

CVE-2026-19667 is a numeric type conversion error (CWE-197) in ISC BIND's `named` resolver: when an authoritative server returns a negative answer (e.g., NXDOMAIN/NODATA) that is exactly 65536 bytes long, `named` mis-handles the size and stores a 0-byte negative cache entry. When that cache entry is subsequently read to answer a client query, the `named` process aborts, taking down the resolver's DNS service. An attacker who controls an authoritative server for any domain the resolver will look up (e.g., a domain they own, with lookups induced via links or other references) can crash an unpatched recursive resolver remotely without credentials. Organizations and providers running affected BIND 9 versions as caching/recursive resolvers are affected; purely authoritative servers are not the relevant exposure. As of publication there is no known public proof-of-concept, the flaw is not listed in CISA KEV, and no exploitation has been reported.

What to do: Upgrade caching/recursive BIND resolvers to a patched release beyond the affected ranges listed in ISC's advisory (i.e., newer than 9.18.50, 9.20.27, 9.21.25 and the corresponding -S1 preview builds), and verify running versions with `named -v`. Restrict recursion to trusted client networks to reduce who can be leveraged to trigger lookups, and monitor resolvers for unexpected `named` aborts/restarts. Authoritative-only servers that do not perform recursion and negative caching are not meaningfully exposed.