EUVD-2026-80742
GHSA-m9xv-gf7q-4vjg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated attacker via crafted DNS response reliably aborts named with no auth or interaction; impact is availability-only (C:N/I:N/A:H), matching vendor scoring.
Primary rating from Vendor (isc).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in named results in a negative cache entry of 0 bytes. When this entry is subsequently read, named aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
AnalysisAI
Remote denial of service in ISC BIND 9 lets an attacker-controlled (or spoofing-capable) authoritative DNS server crash a recursive resolver by returning a negative answer of exactly 65536 bytes, which named caches as a zero-length entry and later aborts on when the entry is read. The flaw affects 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and the corresponding -S1 subscription releases, requires no authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), and is present in default configurations, though reachability is limited to resolvers that actually recurse against attacker-influenced or spoofable zones and then read the poisoned cache entry. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an attacker-controlled (or spoofing-capable) authoritative DNS server able to return a negative answer of exactly 65536 bytes to the victim's recursive BIND resolver, which triggers the 16-bit length truncation to a 0-byte negative cache entry and a crash on subsequent read. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a well-calibrated, genuine denial-of-service priority for exposed BIND resolvers. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released fixes: upgrade to BIND 9.20.29 (https://downloads.isc.org/isc/bind9/9.20.29) or BIND 9.21.26 (https://downloads.isc.org/isc/bind9/9.21.26) as appropriate for your deployment branch, and consult the ISC advisory at https://kb.isc.org/docs/cve-2026-19667 for branch-specific maintenance releases covering the 9.18.x and -S1 lines. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every BIND 9 instance running as a recursive resolver (including internal forwarders, VPN concentrators, and container/hosted resolvers) and confirm the running version against the affected ranges 9.11.0-9.18.50, 9.20.0-9.20.27, 9.21.0-9.21.25 and their -S1 subscription equivalents; where production change windows allow, upgrade immediately to vendor patch releases 9.20.29 or 9.21.26 (or the corresponding fixed release for the 9.18 branch), and where an upgrade cannot be completed the same day, reduce exposure by restricting recursion to known client networks (allow-recursion / allow-query ACLs), disabling open recursion, and ensuring monitoring and auto-restart of named so crashes are detected and recovered in minutes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
BIND resolver servers performing DNSSEC validation can be forced into excessive CPU consumption when encountering a mali
Memory exhaustion in BIND 9 resolver allows unauthenticated remote attackers to cause denial of service by querying spec
Memory corruption in ISC BIND 9's DNS-over-HTTPS (DoH) implementation lets remote attackers trigger a use-after-free (CW
DNSSEC validation bypass in ISC BIND 9 resolvers (9.11.0 through 9.21.23 and S-editions) allows an attacker controlling
Denial of service in ISC BIND 9 lets a remote unauthenticated attacker exhaust resolver memory by flooding a DNSSEC-vali
Remote denial of service in ISC BIND 9 lets an attacker crash a validating resolver via a maliciously crafted DNSSEC pro
Denial of service in ISC BIND 9 resolvers (9.20.0-9.20.24, 9.21.0-9.21.23, and 9.20.9-S1-9.20.24-S1) lets remote unauthe
Cache poisoning in ISC BIND 9 recursive resolvers allows an attacker who controls an authoritative zone to inject forged
RPZ policy bypass and remote denial-of-service in ISC BIND 9 resolvers lets unauthenticated attackers defeat Response Po
Remote denial of service in ISC BIND 9 lets an off-path attacker crash a recursive resolver by controlling the timing an
Denial of service in ISC BIND 9 DNS servers configured with TKEY GSS-API authentication allows remote unauthenticated at
Remote denial of service in ISC BIND 9 named allows unauthenticated attackers to trigger assertion failures and crash th
Same weakness CWE-197 – Numeric Truncation Error
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today