CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver
An attacker may be able to cause a named resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, and those answers arrive in a particular order with particular timing, the named resolver will encounter a use-after-free bug, and abort. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BIND 9 (named)to a version that resolves this vulnerability.Fixed in 9.20.29 - Upgrade
Upgrade
BIND 9 (named)to a version that resolves this vulnerability.Fixed in 9.20.29-S1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Recursive BIND 9 resolvers are exposed if they run versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, or 9.20.9-S1 through 9.20.27-S1. The affected component is named acting as a resolver.
What must an attacker do to trigger the crash?
The attacker must control an authoritative server for a DNSSEC-signed zone and induce the victim resolver to issue multiple queries for that zone. Exploitation also depends on sending a particular sequence of crafted answers in a specific order and with specific timing.
What is the practical impact of successful exploitation?
Successful exploitation causes the named resolver process to abort, resulting in a denial of service. The provided information does not indicate confidentiality or integrity impact.