CVE-2026-19662

A flaw was found in BIND 9. A remote attacker can cause a named resolver to stop functioning (Denial of Service) by inducing the victim resolver to send multiple queries for a DNSSEC-signed zone. If the attacker's authoritative server responds with a specific sequence of crafted answers that arrive with particular timing, a use-after-free vulnerability is triggered, leading to the resolver's abortion.

This Moderate impact denial of service vulnerability in BIND 9's named resolver can lead to service unavailability. Exploitation requires an attacker to operate an authoritative DNS server and specifically induce a vulnerable resolver to query it for a DNSSEC-signed zone. The attack relies on a precise sequence and timing of crafted DNSSEC responses, limiting its broader applicability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, consider disabling DNSSEC validation on named resolvers if it is not a strict requirement for your environment. This can be achieved by setting dnssec-validation no; in the named.conf file. Disabling DNSSEC validation will prevent the resolver from processing DNSSEC-signed zones, thereby avoiding this specific vulnerability, but it will also remove the security benefits provided by DNSSEC. After modifying the configuration, the named service must be reloaded or restarted for the changes to take effect.

sudo systemctl reload named sudo systemctl restart named