CVE-2026-19667

HighCVSS 7.5/10Last modified Oct 26, 2026

Description

If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-197

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
ISC	BIND 9	>= 9.11.0, <= 9.18.50; >= 9.20.0, <= 9.20.27; >= 9.21.0, <= 9.21.25; >= 9.11.3-S1, <= 9.18.50-S1; >= 9.20.9-S1, <= 9.20.27-S1

References

Timeline

Published: Sep 16, 2026
Last modified: Oct 26, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-196685.3A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSE CVE-2026-196697.8The user-mode syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() in drivers/fuel_gauge/fuel_gauge_syscall_han CVE-2026-196705.4Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /hta CVE-2026-196716.5Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when CVE-2026-196726.3The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destina CVE-2026-196737.1ethernet_recv() in subsys/net/l2/ethernet/ethernet.c validates only that the first net_buf of a received frame holds a plain 14-byte struct CVE-2026-196767.8The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handlers.c, checked only the device CVE-2026-196779.3An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote atta CVE-2026-196788.7A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthe CVE-2026-196798.8An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames co CVE-2026-196807.1A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's data CVE-2026-196819.9An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this