UBUNTU-CVE-2026-19941: Medium severity ubuntu/bind9 vulnerability

Q: Which systems are realistically exposed?

Systems running a BIND named resolver in the affected BIND release ranges are exposed. The issue concerns resolver handling of NSEC records and wildcard existence proofs.

Q: What must an attacker be able to do to exploit this?

The attacker must be positioned at the same level as, or an upstream level of, the relevant zone name. They can use an inapplicable NSEC record to cause the resolver to accept proof that a victim wildcard record does not exist.

Published Sep 16, 2026

Updated

An inapplicable NSEC record may be accepted by a named resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

Affected Software

13 affected componentsFixes available

ubuntu/bind9<1:9.9.5.dfsg-3ubuntu0.19+esm15

1:9.9.5.dfsg-3ubuntu0.19+esm15

ubuntu/bind9<1:9.10.3.dfsg.P4-8ubuntu1.19+esm11

1:9.10.3.dfsg.P4-8ubuntu1.19+esm11

ubuntu/bind9<1:9.11.3+dfsg-1ubuntu1.19+esm6

1:9.11.3+dfsg-1ubuntu1.19+esm6

ubuntu/isc-dhcp*

ubuntu/bind9<1:9.18.30-0ubuntu0.20.04.2+esm3

1:9.18.30-0ubuntu0.20.04.2+esm3

ubuntu/bind9-libs*

ubuntu/bind9<1:9.18.39-0ubuntu0.22.04.7

1:9.18.39-0ubuntu0.22.04.7

ubuntu/bind9-libs*

ubuntu/bind9<1:9.18.39-0ubuntu0.24.04.8

1:9.18.39-0ubuntu0.24.04.8

ubuntu/isc-dhcp*

ubuntu/bind9<1:9.20.24-1ubuntu3.1

1:9.20.24-1ubuntu3.1

ubuntu/bind9<1:9.20.24-1ubuntu0.4

1:9.20.24-1ubuntu0.4

ubuntu/isc-dhcp*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.9.5.dfsg-3ubuntu0.19+esm15
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.10.3.dfsg.P4-8ubuntu1.19+esm11
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.11.3+dfsg-1ubuntu1.19+esm6
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.18.30-0ubuntu0.20.04.2+esm3
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.18.39-0ubuntu0.22.04.7
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.18.39-0ubuntu0.24.04.8
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.20.24-1ubuntu3.1
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.20.24-1ubuntu0.4

Event History

Sep 16, 2026

CVE Published

via OSV·02:17 PM

Data Sourced

via OSV·02:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are realistically exposed?

Systems running a BIND named resolver in the affected BIND release ranges are exposed. The issue concerns resolver handling of NSEC records and wildcard existence proofs.

What must an attacker be able to do to exploit this?

The attacker must be positioned at the same level as, or an upstream level of, the relevant zone name. They can use an inapplicable NSEC record to cause the resolver to accept proof that a victim wildcard record does not exist.

UBUNTU-CVE-2026-19941: Medium severity ubuntu/bind9 vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are realistically exposed?

What must an attacker be able to do to exploit this?

Company

Resources

Contact

Frequently Asked Questions

Which systems are realistically exposed?

What must an attacker be able to do to exploit this?