ISC BIND 9 CVE-2026-19667

Requires an attacker-controlled (or spoofing-capable) authoritative DNS server able to return a negative answer of exactly 65536 bytes to the victim's recursive BIND resolver, which triggers the 16-bit length truncation to a 0-byte negative cache entry and a crash on subsequent read. No authentication or user interaction is needed (PR:N/UI:N) and default configurations are affected, but the target must be a resolver performing recursion against untrusted/attacker-influenced domains and must actually read the poisoned cache entry. Limiting factors: resolvers restricted to trusted authoritative servers, or not exposed to attacker-controlled zones, reduce reachability; the flaw is fixed in BIND 9.20.29 and 9.21.26.

This is a well-calibrated, genuine denial-of-service priority for exposed BIND resolvers. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) is availability-only and matches the described impact: a remote, unauthenticated attacker triggers an abort of the named process with no confidentiality or integrity effect. CWE-197 (numeric truncation) is consistent with the mechanism - a negative answer of exactly 65536 bytes wraps a 16-bit length field to 0, producing a 0-byte negative cache entry that crashes named when read. No EPSS score, no CISA KEV listing, and no public POC are provided, so there is no evidence of active or automated exploitation at this time; the risk is a reliably-crashable service rather than a mass-exploited one. The one signal tension: the input Tags label this 'Information Disclosure,' which directly contradicts the CVSS vector (C:N) - this is a crash/DoS, not a data-disclosure issue, and that tag should be disregarded. Exploitation does require the attacker to control (or successfully spoof responses from) an authoritative server that the target resolver queries, a real but modest prerequisite for a recursive resolver reachable to untrusted domains.

An attacker operates or controls an authoritative DNS server for a domain and lures/triggers a victim's recursive BIND resolver into querying a crafted name. The malicious authoritative server returns a negative answer sized to exactly 65536 bytes, which the resolver stores as a corrupt 0-byte negative cache entry; the next read of that entry aborts named, taking down DNS resolution. No authentication or user interaction is required and no public exploit code is currently identified.