CVE-2026-19667

Remote assertion failure via 16-bit length truncation in `dns_ncache_add()`

Public exploit available. Not confirmed exploited in the wild yet. A vendor fix is available.

CVSS 3.17.5High EPSS percentile44th0.6% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 0 sources FixVendor fixNo build named by the sources

Published 2026-09-16Updated 2026-09-17Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Ask IT to check every bind 9 resolver version and whether it can query external authoritative DNS servers.
Upgrade to the matching patched release: 9.20.29, 9.21.26, or 9.20.29-S1.
Restart the DNS service after upgrading and confirm normal DNS lookups work.

Vendor advisory Some work to apply

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

In plain language

Written by AI from the record

If you run bind 9 versions 9.11.0–9.18.50, 9.20.0–9.20.27, 9.21.0–9.21.25, 9.11.3-S1–9.18.50-S1, or 9.20.9-S1–9.20.27-S1, an outsider can take your DNS service offline, so a typical small business should have IT act promptly.

Unauthenticated remote denial of service in bind 9: a malicious authoritative DNS server can trigger 16-bit length truncation in dns_ncache_add(), creating a zero-byte negative-cache entry that aborts named when read.

If you're affected

DNS service outage
Website access disruption
Email delivery disruption
Internal network disruption

What is it

This is a flaw that can make the software answering DNS requests suddenly stop working. Think of it like a bad delivery label that causes the mailroom’s filing cabinet to jam shut: the DNS service can no longer direct people and systems where they need to go.

Who is affected

This matters to you if your business runs bind 9 as a DNS resolver, including through a hosting, network, or managed-service setup. An attacker does not need a login; it is a risk when your resolver can be induced to query an attacker-controlled authoritative DNS server.

How urgent is it

A public exploit is available, and an attacker can crash the DNS service remotely without credentials. No active exploitation has been reported, but this is RED because an outage can be triggered over the network and can disrupt essential business services.

What to do — in detail

Confirm the installed version with your operating system’s package inventory or named -v, then identify all resolvers that make recursive queries, including redundant and standby servers. Upgrade the relevant release branch to 9.20.29, 9.21.26, or 9.20.29-S1; choose the patched release closest to the branch currently deployed and review normal release notes before moving between branches. No temporary workaround is known if patching is delayed, so prioritize the upgrade and limit unnecessary resolver access to untrusted DNS infrastructure where operationally feasible. CISA has not assigned a KEV remediation due date. After deployment, watch for unexpected named exits, service restarts, DNS lookup failures, and resolver availability alerts.

Technical context

CVE-2026-19667 is CVSS 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), classified as CWE-197. A malicious authoritative server can return a specifically sized negative DNS response; 16-bit length truncation leads to a zero-byte negative-cache entry, and a later read causes named to abort. The attack is network-reachable in the default configuration, requires no authentication or user interaction, and requires the resolver to query the attacker-controlled authoritative server. A public exploit is available. CISA KEV does not list this CVE, and reporting states ISC was not aware of in-the-wild exploitation. EPSS is 0.5% with a flat trend.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS44th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

0 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

0.6% chance of exploitation activity in the next 30 days, which ranks it in the 44th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

11 events over 1 day, from the signal feeds we watch.

2026-09-17Patch availableworkaround available, record updated
2026-09-16Patch availablepatch available, workaround available, workaround available, published, weakness classified, record updated, record updated

Affected products

ISCcommercial · USaka internet systems consortium
- BIND 9Networking Infrastructure

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Scored 7.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality NoneNo confidentiality impact
Integrity NoneNo integrity impact
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

CWE-197No name in the record

Sources

References in the record

In the news

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for BIND 9, not every advisory. This one: public exploit.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account