Is CVE-2026-19667 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19667 being exploited in the wild.

How severe is CVE-2026-19667?

High severity, with a CVSS score of 7.5, published 16 September 2026.

Which products and versions are affected?

Isc Bind 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.27-S1.

Is there a fix for CVE-2026-19667?

A patch was published on 2026-09-16: BIND 9.20.29 and 9.21.26 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-19667 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-19667?

Check whether you run Isc Bind at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19667: ISC BIND named negative cache denial of service

CVE-2026-19667 · Severity: high · CVSS 7.5 · Published 2026-09-16

BIND is a widely-deployed DNS server that resolves domain names for millions of users and organizations. An attacker running an authoritative DNS server can craft a specially-sized response (exactly 65536 bytes) that causes BIND to create a corrupted cache entry. When BIND later tries to read this entry, the server crashes, causing DNS resolution to fail for affected customers.

Technologies: Isc Bind. Vendors: Isc.

Quick answers

Is CVE-2026-19667 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19667 being exploited in the wild.
How severe is CVE-2026-19667?: High severity, with a CVSS score of 7.5, published 16 September 2026.
Which products and versions are affected?: Isc Bind 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.27-S1.
Is there a fix for CVE-2026-19667?: A patch was published on 2026-09-16: BIND 9.20.29 and 9.21.26 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-19667 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-19667?: Check whether you run Isc Bind at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a denial-of-service flaw in the negative cache handling logic of BIND's `named` resolver. When an attacker-controlled authoritative DNS server responds with a negative answer (NXDOMAIN or NODATA) that is exactly 65536 bytes in size, a bug in the cache entry creation causes the negative cache entry to be allocated with 0 bytes. Subsequently, when `named` attempts to read this malformed cache entry, it triggers an abort condition. The attack requires the victim to query a domain controlled by an attacker; no authentication is required. Patches are available in BIND 9.20.29, 9.21.26, and later versions.

Affected products

ISC BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.27-S1

Timeline

2026-09-16: disclosed: CVE-2026-19667 published
2026-09-16: patched: BIND 9.20.29 and 9.21.26 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.