UBUNTU-CVE-2026-19662: Use After Free

Q: Which deployments are realistically exposed to this denial-of-service issue?

Deployments running a vulnerable BIND 9 `named` resolver are exposed when they can be induced to query a DNSSEC-signed zone served by an attacker-controlled authoritative server. The listed affected BIND branches are 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

Q: What does an attacker need to do to trigger the resolver abort?

The attacker must control the authoritative server for a DNSSEC-signed zone and induce the resolver to send multiple queries to it. Exploitation also depends on returning a specific sequence of crafted responses in a particular order and with particular timing.

Q: What is the impact if exploitation succeeds?

The vulnerable `named` resolver encounters a use-after-free condition and aborts. The provided severity vector indicates an availability impact only, with no stated confidentiality or integrity impact.

Published Sep 16, 2026

Updated

An attacker may be able to cause a named resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, and those answers arrive in a particular order with particular timing, the named resolver will encounter a use-after-free bug, and abort. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

Affected Software

10 affected componentsFixes available

ubuntu/isc-dhcp*

ubuntu/bind9<1:9.18.30-0ubuntu0.20.04.2+esm3

1:9.18.30-0ubuntu0.20.04.2+esm3

ubuntu/bind9-libs*

ubuntu/bind9<1:9.18.39-0ubuntu0.22.04.7

1:9.18.39-0ubuntu0.22.04.7

ubuntu/bind9-libs*

ubuntu/bind9<1:9.18.39-0ubuntu0.24.04.8

1:9.18.39-0ubuntu0.24.04.8

ubuntu/isc-dhcp*

ubuntu/bind9<1:9.20.24-1ubuntu3.1

1:9.20.24-1ubuntu3.1

ubuntu/bind9<1:9.20.24-1ubuntu0.4

1:9.20.24-1ubuntu0.4

ubuntu/isc-dhcp*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.18.30-0ubuntu0.20.04.2+esm3
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.18.39-0ubuntu0.22.04.7
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.18.39-0ubuntu0.24.04.8
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.20.24-1ubuntu3.1
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.20.24-1ubuntu0.4

Event History

Sep 16, 2026

CVE Published

via OSV·02:17 PM

Data Sourced

via OSV·02:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are realistically exposed to this denial-of-service issue?

Deployments running a vulnerable BIND 9 `named` resolver are exposed when they can be induced to query a DNSSEC-signed zone served by an attacker-controlled authoritative server. The listed affected BIND branches are 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

What does an attacker need to do to trigger the resolver abort?

The attacker must control the authoritative server for a DNSSEC-signed zone and induce the resolver to send multiple queries to it. Exploitation also depends on returning a specific sequence of crafted responses in a particular order and with particular timing.

What is the impact if exploitation succeeds?

The vulnerable `named` resolver encounters a use-after-free condition and aborts. The provided severity vector indicates an availability impact only, with no stated confidentiality or integrity impact.

UBUNTU-CVE-2026-19662: Use After Free

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are realistically exposed to this denial-of-service issue?

What does an attacker need to do to trigger the resolver abort?

What is the impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are realistically exposed to this denial-of-service issue?

What does an attacker need to do to trigger the resolver abort?

What is the impact if exploitation succeeds?