UBUNTU-CVE-2026-19667: High severity ubuntu/isc-dhcp vulnerability

Q: What must an attacker control to trigger the failure?

The attacker must control an authoritative DNS server and make it return a negative answer that is exactly 65,536 bytes. Exploitation is network-reachable and does not require privileges or user interaction.

Q: What is the practical impact on a vulnerable server?

The crafted response creates a zero-byte negative cache entry. When named subsequently reads that cache entry, it aborts, causing a denial of service.

Q: Which BIND versions are affected?

Affected versions are 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

Published Sep 16, 2026

Updated

If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in named results in a negative cache entry of 0 bytes. When this entry is subsequently read, named aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

Affected Software

10 affected componentsFixes available

ubuntu/isc-dhcp*

ubuntu/bind9<1:9.18.30-0ubuntu0.20.04.2+esm3

1:9.18.30-0ubuntu0.20.04.2+esm3

ubuntu/bind9-libs*

ubuntu/bind9<1:9.18.39-0ubuntu0.22.04.7

1:9.18.39-0ubuntu0.22.04.7

ubuntu/bind9-libs*

ubuntu/bind9<1:9.18.39-0ubuntu0.24.04.8

1:9.18.39-0ubuntu0.24.04.8

ubuntu/isc-dhcp*

ubuntu/bind9<1:9.20.24-1ubuntu3.1

1:9.20.24-1ubuntu3.1

ubuntu/bind9<1:9.20.24-1ubuntu0.4

1:9.20.24-1ubuntu0.4

ubuntu/isc-dhcp*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.18.30-0ubuntu0.20.04.2+esm3
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.18.39-0ubuntu0.22.04.7
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.18.39-0ubuntu0.24.04.8
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.20.24-1ubuntu3.1
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.20.24-1ubuntu0.4

Event History

Sep 16, 2026

CVE Published

via OSV·02:17 PM

Data Sourced

via OSV·02:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What must an attacker control to trigger the failure?

The attacker must control an authoritative DNS server and make it return a negative answer that is exactly 65,536 bytes. Exploitation is network-reachable and does not require privileges or user interaction.

What is the practical impact on a vulnerable server?

The crafted response creates a zero-byte negative cache entry. When named subsequently reads that cache entry, it aborts, causing a denial of service.

Which BIND versions are affected?

Affected versions are 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

UBUNTU-CVE-2026-19667: High severity ubuntu/isc-dhcp vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker control to trigger the failure?

What is the practical impact on a vulnerable server?

Which BIND versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker control to trigger the failure?

What is the practical impact on a vulnerable server?

Which BIND versions are affected?