Search: CVE-2026-19667

CVE-2026-19667 is a numeric truncation error vulnerability in ISC BIND 9's named DNS service. An attacker-controlled authoritative DNS server can send a crafted negative response of exactly 65536 bytes, causing named to create a zero-byte negative cache entry. Subsequent accesses to this cache entry cause the named service to abort, resulting in a denial of service. This affects multiple BIND 9 versions including 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and their S1 variants.