CVE-2026-19667

CVE-2026-19667 describes a vulnerability found in the `named` component of BIND 9, a widely used open-source DNS server software. This flaw can be triggered when an attacker controls an authoritative server that produces a negative DNS answer of precisely 65536 bytes. Upon receiving such a specially crafted negative answer, the `named` process creates a negative cache entry with a size of zero bytes. When this malformed entry is subsequently accessed or read, it causes the `named` program to abort. This issue impacts various versions of BIND 9, specifically 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, as well as specific versions of BIND 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.