CVE-2026-19666

A flaw was found in BIND. When a resolver is configured to use DNS64, a specially crafted, malformed answer from an authoritative server can cause the named process to exit unexpectedly. This can lead to a Denial of Service (DoS) for clients relying on the affected resolver.

Important: This denial of service vulnerability affects BIND resolvers configured to use the dns64 feature. A specially crafted malformed DNS64 response from an authoritative server can cause the named process to unexpectedly terminate, leading to service unavailability. Exploitation requires the dns64 feature to be explicitly enabled in the resolver's configuration.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, disable the dns64 feature in the BIND resolver configuration if it is not required. This can be done by removing or commenting out the dns64 configuration block in named.conf or related configuration files. After modifying the configuration, the BIND service (named) must be reloaded or restarted for the changes to take effect. This action may temporarily interrupt DNS resolution services.