Medium severity5.9NVD Advisory· Published Sep 16, 2026· Updated Sep 17, 2026
CVE-2026-19662
CVE-2026-19662
Description
An attacker may be able to cause a named resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, and those answers arrive in a particular order with particular timing, the named resolver will encounter a use-after-free bug, and abort. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
19- osv-coords18 versionspkg:rpm/almalinux/bindpkg:rpm/almalinux/bind-chrootpkg:rpm/almalinux/bind-develpkg:rpm/almalinux/bind-dnssec-docpkg:rpm/almalinux/bind-dnssec-utilspkg:rpm/almalinux/bind-docpkg:rpm/almalinux/bind-libspkg:rpm/almalinux/bind-licensepkg:rpm/almalinux/bind-utilspkg:rpm/almalinux/bind9.18pkg:rpm/almalinux/bind9.18-chrootpkg:rpm/almalinux/bind9.18-develpkg:rpm/almalinux/bind9.18-dnssec-utilspkg:rpm/almalinux/bind9.18-docpkg:rpm/almalinux/bind9.18-libspkg:rpm/almalinux/bind9.18-utilspkg:rpm/almalinux/python3-bindpkg:rpm/opensuse/bind&distro=openSUSE%20Tumbleweed
< 32:9.16.23-40.el9_8.12+ 17 more
- (no CPE)range: < 32:9.16.23-40.el9_8.12
- (no CPE)range: < 32:9.16.23-40.el9_8.12
- (no CPE)range: < 32:9.16.23-40.el9_8.12
- (no CPE)range: < 32:9.16.23-40.el9_8.12
- (no CPE)range: < 32:9.16.23-40.el9_8.12
- (no CPE)range: < 32:9.16.23-40.el9_8.12
- (no CPE)range: < 32:9.16.23-40.el9_8.12
- (no CPE)range: < 32:9.16.23-40.el9_8.12
- (no CPE)range: < 32:9.16.23-40.el9_8.12
- (no CPE)range: < 32:9.18.29-14.el9_8.11
- (no CPE)range: < 32:9.18.29-14.el9_8.11
- (no CPE)range: < 32:9.18.29-14.el9_8.11
- (no CPE)range: < 32:9.18.29-14.el9_8.11
- (no CPE)range: < 32:9.18.29-14.el9_8.11
- (no CPE)range: < 32:9.18.29-14.el9_8.11
- (no CPE)range: < 32:9.18.29-14.el9_8.11
- (no CPE)range: < 32:9.16.23-40.el9_8.12
- (no CPE)range: < 9.20.29-1.1
Patches
Vulnerability mechanics
References
2News mentions
2- BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPSThe Hacker News · Sep 17, 2026
- ISC Patches 14 BIND 9 Vulnerabilities, Primarily Causing Denial-of-ServiceVypr Intelligence · Sep 16, 2026