CVE-2026-19667

If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://downloads.isc.org/isc/bind9/9.20.29
https://downloads.isc.org/isc/bind9/9.21.26
https://kb.isc.org/docs/cve-2026-19667

Configurations

No configuration.

History

26 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Si un servidor autoritativo controlado por el atacante puede producir una respuesta negativa que tiene exactamente 65536?bytes, entonces un fallo en “named” genera una entrada de caché negativa de 0?bytes. Cuando se lee posteriormente esta entrada, “named” aborta. Este problema afecta a BIND?9 versiones desde la versión?9.11.0 hasta la versión?9.18.50 incluida, desde la versión?9.20.0 hasta la versión?9.20.27 incluida, desde la versión?9.21.0 hasta la versión?9.21.25 incluida, desde la versión?9.11.3?S1 hasta la versión?9.18.50?S1 incluida, y desde la versión?9.20.9?S1 hasta la versión?9.20.27?S1 incluida.

16 Sep 2026, 14:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-16 14:17

Updated : 2026-10-26 20:10

NVD link : CVE-2026-19667

Mitre link : CVE-2026-19667

CVE.ORG link : CVE-2026-19667

JSON object : View

Products Affected

No product.

CWE

CWE-197

Numeric Truncation Error

{"id": "CVE-2026-19667", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19667", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-17T18:45:26.324502Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-officer@isc.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-officer@isc.org", "affectedData": [{"vendor": "ISC", "product": "BIND 9", "versions": [{"status": "affected", "version": "9.11.0", "versionType": "custom", "lessThanOrEqual": "9.18.50"}, {"status": "affected", "version": "9.20.0", "versionType": "custom", "lessThanOrEqual": "9.20.27"}, {"status": "affected", "version": "9.21.0", "versionType": "custom", "lessThanOrEqual": "9.21.25"}, {"status": "affected", "version": "9.11.3-S1", "versionType": "custom", "lessThanOrEqual": "9.18.50-S1"}, {"status": "affected", "version": "9.20.9-S1", "versionType": "custom", "lessThanOrEqual": "9.20.27-S1"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-16T14:17:05.037", "references": [{"url": "https://downloads.isc.org/isc/bind9/9.20.29", "source": "security-officer@isc.org"}, {"url": "https://downloads.isc.org/isc/bind9/9.21.26", "source": "security-officer@isc.org"}, {"url": "https://kb.isc.org/docs/cve-2026-19667", "source": "security-officer@isc.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-officer@isc.org", "description": [{"lang": "en", "value": "CWE-197"}]}], "descriptions": [{"lang": "en", "value": "If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."}, {"lang": "es", "value": "Si un servidor autoritativo controlado por el atacante puede producir una respuesta negativa que tiene exactamente 65536?bytes, entonces un fallo en \u201cnamed\u201d genera una entrada de cach\u00e9 negativa de 0?bytes. Cuando se lee posteriormente esta entrada, \u201cnamed\u201d aborta. Este problema afecta a BIND?9 versiones desde la versi\u00f3n?9.11.0 hasta la versi\u00f3n?9.18.50 incluida, desde la versi\u00f3n?9.20.0 hasta la versi\u00f3n?9.20.27 incluida, desde la versi\u00f3n?9.21.0 hasta la versi\u00f3n?9.21.25 incluida, desde la versi\u00f3n?9.11.3?S1 hasta la versi\u00f3n?9.18.50?S1 incluida, y desde la versi\u00f3n?9.20.9?S1 hasta la versi\u00f3n?9.20.27?S1 incluida."}], "lastModified": "2026-10-26T20:10:00.160", "sourceIdentifier": "security-officer@isc.org"}