CVE-2026-19941

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.11.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.27 BIND 9 versions 9.21.0 through 9.21.25 BIND 9 versions 9.11.3-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.27-S1

Description A named resolver may accept an inapplicable NSEC (Next Secure) record—a record used in DNS Security Extensions to prove the non-existence of a record—as proof that no wildcard exists. This could allow an attacker positioned at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.