CVE-2026-19662

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.11.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.27 BIND 9 versions 9.11.3-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.27-S1

Description A use-after-free bug in the named resolver can be triggered by an attacker who controls an authoritative server hosting a DNSSEC-signed zone. By inducing the resolver to send multiple queries and responding with a specific sequence, order, and timing of crafted answers, the attacker can cause the resolver to abort. A use-after-free is a memory corruption issue where a program continues to use a pointer after the memory it points to has been freed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.