EUVD-2026-80774
GHSA-2rph-fg4h-9hjq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated malformed answer crashes named (A:H, C:N/I:N); dns64 is a config precondition but the trigger itself is low-complexity, so AC:L and score matches vendor 7.5.
Primary rating from Vendor (isc).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
On a resolver configured to use `dns64, if an applicable answer from the authoritative server is malformed in a specific way, the resolver named` process will exit unexpectedly. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
AnalysisAI
Denial of service in ISC BIND 9 allows remote, unauthenticated attackers to terminate the named resolver process when it processes a specifically malformed answer that interacts with the DNS64 synthesis feature. Only resolvers explicitly configured with the dns64 option are affected - a non-default, opt-in capability - but for those systems any client of the resolver loses name resolution when named exits. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The resolver must be explicitly configured to use dns64 - this is a non-default, opt-in BIND feature, so resolvers without dns64 are not affected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 3.1 base score is 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - a remotely triggerable, unauthenticated, low-complexity availability-only impact (no confidentiality or integrity loss). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to BIND 9.20.29 or 9.21.26 (https://downloads.isc.org/isc/bind9/9.20.29 and https://downloads.isc.org/isc/bind9/9.21.26), which are the fixed versions identified in the ISC advisory at https://kb.isc.org/docs/cve-2026-19666; any deployment within the affected ranges - 9.11.0-9.18.50, 9.20.0-9.20.27, 9.21.0-9.21.25, and the -S1 subscription builds - should be updated, and operators on the 9.18 or earlier branches should consult the advisory for the applicable fixed build before assuming a given release is clean. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all BIND 9 instances and identify those running with the dns64 option enabled (affected versions: 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and the corresponding -S1 subscription builds) using named -V and by reviewing named.conf for the dns64 statement; for any business-critical or externally reachable DNS64 resolver that cannot be patched immediately, remove the dns64 option and restart named as a temporary risk reduction, and capture current running versions for tracking. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
BIND resolver servers performing DNSSEC validation can be forced into excessive CPU consumption when encountering a mali
Memory exhaustion in BIND 9 resolver allows unauthenticated remote attackers to cause denial of service by querying spec
Memory corruption in ISC BIND 9's DNS-over-HTTPS (DoH) implementation lets remote attackers trigger a use-after-free (CW
DNSSEC validation bypass in ISC BIND 9 resolvers (9.11.0 through 9.21.23 and S-editions) allows an attacker controlling
Denial of service in ISC BIND 9 lets a remote unauthenticated attacker exhaust resolver memory by flooding a DNSSEC-vali
Remote denial of service in ISC BIND 9 lets an attacker crash a validating resolver via a maliciously crafted DNSSEC pro
Denial of service in ISC BIND 9 resolvers (9.20.0-9.20.24, 9.21.0-9.21.23, and 9.20.9-S1-9.20.24-S1) lets remote unauthe
Cache poisoning in ISC BIND 9 recursive resolvers allows an attacker who controls an authoritative zone to inject forged
RPZ policy bypass and remote denial-of-service in ISC BIND 9 resolvers lets unauthenticated attackers defeat Response Po
Remote denial of service in ISC BIND 9 lets an off-path attacker crash a recursive resolver by controlling the timing an
Denial of service in ISC BIND 9 DNS servers configured with TKEY GSS-API authentication allows remote unauthenticated at
Remote denial of service in ISC BIND 9 named allows unauthenticated attackers to trigger assertion failures and crash th
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today