CVE-2026-19667: Remote assertion failure via 16-bit length truncation in `dns_ncache_add()`
If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in named results in a negative cache entry of 0 bytes. When this entry is subsequently read, named aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BIND 9 (named)to a version that resolves this vulnerability.Fixed in 9.20.29 - Upgrade
Upgrade
BIND 9 (named)to a version that resolves this vulnerability.Fixed in 9.21.26 - Upgrade
Upgrade
BIND 9 (named)to a version that resolves this vulnerability.Fixed in 9.20.29-S1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments running named in the affected ISC BIND 9 version ranges are exposed if they can query an attacker-controlled authoritative server that returns the required negative response. The issue is remotely reachable and requires no privileges or user interaction.
What must an attacker do to trigger the crash?
An attacker needs to operate or control an authoritative DNS server and return a negative answer whose size is exactly 65,536 bytes. This causes named to store a zero-byte negative cache entry; named aborts when that cached entry is later read.
Is the impact limited to a single failed DNS query?
No. The malformed negative response is placed in the negative cache, and the abort occurs when the resulting cache entry is subsequently read. The stated impact is denial of service, with no confidentiality or integrity impact indicated.
How can I determine whether an instance is affected?
Check the installed BIND 9 version against the affected ranges: 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, or 9.20.9-S1 through 9.20.27-S1. The available reference releases include 9.20.29 and 9.21.26.