OCTOBER 13, 2026
Live Feed
Back to database
Case File

CVE-2026-19666

HIGH · CVSS 7.5 EPSS 0.57%

Source: NVD + CISA KEV + EPSS · Published 2026-09-16 · Last synced 2026-10-13

CyberRota Analysis

AI-Generated

A vulnerability exists in the BIND DNS resolver when configured with `dns64`, where a malformed response from an authoritative server can cause the `named` process to crash unexpectedly. This issue affects multiple versions of BIND 9, specifically from 9.11.0 to 9.21.25 across various release branches. Organizations using affected BIND versions should prioritize patching to mitigate potential service disruptions and maintain DNS reliability.

CVE
CVE-2026-19666
Severity
HIGH
CVSS
7.5
EPSS
0.57%

Original NVD Description

On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.