CVE-2026-19941

This is a DNSSEC validation flaw (CWE-345) in BIND 9's `named` resolver, which may accept an inapplicable NSEC record as valid proof that no wildcard record exists for a zone name. An attacker positioned at the same or an upstream level of the victim's zone name — for example, an operator of a sibling or parent zone able to present the malformed NSEC proof — can trigger the flaw in a validating resolver. The result is that the victim's wildcard record is treated as nonexistent, so the attacker can spoof or suppress answers in a way that still passes DNSSEC validation, yielding a high integrity impact (no confidentiality or availability impact per the CVSS vector). Only operators running affected BIND 9 versions as validating resolvers, particularly zones that rely on wildcard records, are affected. The issue was disclosed by ISC as one of fourteen BIND 9 vulnerabilities; it is not in CISA's KEV catalog and no public proof-of-concept or known exploitation exists.

What to do: Upgrade all validating `named` resolvers to the patched BIND 9 releases published by ISC for each affected branch (i.e., releases newer than 9.18.50, 9.20.27, 9.21.25 and the corresponding -S builds), per ISC's advisory for CVE-2026-19941. Administrators of DNSSEC-signed zones that depend on wildcard records should investigate client reports of unexpected NXDOMAIN/nodata answers. Restricting recursion to trusted clients is a useful defense-in-depth measure, but patching is the only complete fix.