Is CVE-2026-19662 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19662 being exploited in the wild.

How severe is CVE-2026-19662?

Medium severity, with a CVSS score of 5.9, published 16 September 2026.

Which products and versions are affected?

Isc Bind 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.27-S1.

Is there a fix for CVE-2026-19662?

A patch was published on 2026-09-16: Fixed in BIND 9.20.29 and 9.20.29-S1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-19662 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-19662?

Check whether you run Isc Bind at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19662: ISC BIND named resolver use-after-free denial of service

CVE-2026-19662 · Severity: medium · CVSS 5.9 · Published 2026-09-16

BIND is a widely-used DNS resolver software that handles domain name lookups for organizations and ISPs. A flaw in how BIND processes DNSSEC-signed responses can cause the resolver process to crash when an attacker controls an authoritative nameserver and sends carefully timed, malformed responses. This creates a denial-of-service condition, disrupting DNS resolution for all users depending on that resolver.

Technologies: Isc Bind. Vendors: Isc.

Quick answers

Is CVE-2026-19662 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19662 being exploited in the wild.
How severe is CVE-2026-19662?: Medium severity, with a CVSS score of 5.9, published 16 September 2026.
Which products and versions are affected?: Isc Bind 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.27-S1.
Is there a fix for CVE-2026-19662?: A patch was published on 2026-09-16: Fixed in BIND 9.20.29 and 9.20.29-S1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-19662 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-19662?: Check whether you run Isc Bind at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a use-after-free bug in BIND's qpcache (query/proof cache) module when processing NOQNAME proofs for DNSSEC-signed zones. An attacker must control an authoritative nameserver and induce a victim resolver to send multiple queries for a DNSSEC-signed zone. By responding with a crafted sequence of answers that arrive in a specific order and timing, the resolver's cache logic dereferences memory that has already been freed, triggering a crash. The attack is remotely exploitable but requires high complexity conditions (AC:H) including precise timing and the attacker's control of an authoritative server. Patches are available in BIND 9.20.29 and 9.20.29-S1.

Affected products

ISC BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.27-S1

Timeline

2026-09-16: disclosed: Public disclosure
2026-09-16: patched: Fixed in BIND 9.20.29 and 9.20.29-S1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.