CVE-2026-19667

A flaw was found in bind9's named component. A remote attacker, by sending a specially crafted DNS negative answer of exactly 65536 bytes from an authoritative server, can cause a 16-bit length truncation. This results in a zero-byte negative cache entry. When named attempts to read this invalid entry, it will unexpectedly terminate, leading to a Denial of Service (DoS).

This is an Important denial of service flaw in BIND 9's named service. An attacker-controlled authoritative server can trigger a named abort by sending a precisely sized negative DNS answer. This vulnerability primarily affects BIND instances configured as recursive resolvers that query untrusted authoritative servers, leading to service disruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To reduce the exposure to this vulnerability, configure BIND 9 to forward all DNS queries to trusted, non-vulnerable upstream DNS servers. This prevents the local named instance from directly interacting with potentially malicious authoritative servers.

Example configuration in named.conf:

options {
    forwarders { 192.0.2.1; 192.0.2.2; };
    forward only;
};

Replace 192.0.2.1 and 192.0.2.2 with the IP addresses of your trusted upstream DNS servers. After modifying the configuration, restart the named service for the changes to take effect. This configuration may impact DNS resolution if the configured forwarders are unavailable or do not provide comprehensive resolution.