CVE-2026-19662 in BIND
Summary
by MITRE • 09/16/2026
An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, and those answers arrive in a particular order with particular timing, the `named` resolver will encounter a use-after-free bug, and abort. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability described involves a critical memory management flaw within the BIND DNS server software, specifically affecting its resolver component known as named. This issue manifests as a use-after-free condition that can lead to an application abort or crash, effectively resulting in a denial of service against the affected system. The root cause lies in how the resolver handles responses from authoritative servers when processing DNSSEC-signed zones. Under normal operation, BIND validates cryptographic signatures and manages memory for these validation processes. However, under specific adversarial conditions involving crafted packet sequences and precise timing, the internal state management fails to properly track object lifecycles, leading to references being made to freed memory locations.
To exploit this vulnerability, an attacker must control or influence an authoritative DNS server hosting a zone that is signed with DNSSEC. The attack requires inducing the victim resolver to send multiple queries for this specific zone. The exploitation relies on a complex sequence of crafted responses from the authoritative server. These responses must arrive in a particular order and within specific timing windows relative to each other. This precise orchestration triggers the race condition or logic error that results in the use-after-free bug. When triggered, the resolver encounters an invalid memory access and subsequently aborts execution to prevent further corruption, thereby causing a service disruption for any clients relying on that resolver for DNS resolution services.
The operational impact of this vulnerability is primarily a denial of service against the affected BIND resolvers. Since the attack requires network-level interaction with a controlled authoritative server, it can be executed remotely by an attacker who can manipulate or control such a server. This affects not only the immediate availability of the resolver but also potentially impacts downstream clients if the resolver becomes unresponsive during the crash and restart cycle. The scope of affected software is extensive, covering BIND 9 versions from 9.11.0 through 9.18.50, as well as specific security releases in the 9.20 series up to version 9.20.27. This includes both standard and Security (S) editions of the software, indicating a widespread exposure across many enterprise and service provider deployments that rely on BIND for DNS resolution and validation services.
From a classification perspective, this vulnerability aligns with CWE-416, Use After Free, which describes situations where a program continues to use memory after it has been freed. This often leads to unpredictable behavior, including crashes or potential code execution if the attacker can control the data written into the reused memory space before it is reallocated for other purposes. In this specific case, while the immediate result is an abort due to safety checks in BIND's error handling, the underlying flaw represents a significant security risk that could potentially be leveraged for more severe impacts depending on compiler optimizations and runtime environments. The attack vector involves remote network interaction, which corresponds to ATT&CK technique T1498.002, Network Denial of Service: Reflection Amplification, although in this context it is more accurately described as a direct exploitation leading to service disruption rather than simple amplification.
Mitigation strategies for this vulnerability involve updating the BIND software to patched versions that address the memory management logic errors during DNSSEC validation response processing. Administrators should ensure their systems are running version 9.18.51 or later, or 9.20.28 and above, where these issues have been resolved. In environments where immediate patching is not feasible, network-level mitigations can be employed to reduce risk. These include restricting DNSSEC validation queries to trusted authoritative servers only, implementing rate limiting on incoming query rates from external sources, and deploying firewall rules that block suspicious traffic patterns associated with the crafted response sequences required for exploitation. Additionally, enabling logging and monitoring for unusual resolver behavior or frequent restarts of the named service can help in detecting potential attempts to exploit this vulnerability before a successful denial of service occurs.