CVE-2026-19662 qpcache NOQNAME proof use-after-free crashes recursive resolver
An attacker can cause a denial of service in the BIND recursive resolver by triggering a use-after-free bug via crafted DNSSEC responses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-19662?
CVE-2026-19662 is a medium-severity use after free vulnerability in ISC BIND 9, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, and those answers arrive in a particular order with particular timing, the `named` resolver will encounter a use-after-free bug, and abort. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
Weakness: CWE-416
Which versions are affected by CVE-2026-19662?
Linux distribution packages (28)
bind AlmaLinux:10 | All versions | 32:9.18.33-15.el10_2.13 |
bind-chroot AlmaLinux:10 | All versions | 32:9.18.33-15.el10_2.13 |
bind-devel AlmaLinux:10 | All versions | 32:9.18.33-15.el10_2.13 |
bind-dnssec-utils AlmaLinux:10 | All versions | 32:9.18.33-15.el10_2.13 |
bind-doc AlmaLinux:10 | All versions | 32:9.18.33-15.el10_2.13 |
bind-libs AlmaLinux:10 | All versions | 32:9.18.33-15.el10_2.13 |
bind-license AlmaLinux:10 | All versions | 32:9.18.33-15.el10_2.13 |
bind-utils AlmaLinux:10 | All versions | 32:9.18.33-15.el10_2.13 |
bind AlmaLinux:9 | All versions | 32:9.16.23-40.el9_8.12 |
bind-chroot AlmaLinux:9 | All versions | 32:9.16.23-40.el9_8.12 |
bind-devel AlmaLinux:9 | All versions | 32:9.16.23-40.el9_8.12 |
bind-dnssec-doc AlmaLinux:9 | All versions | 32:9.16.23-40.el9_8.12 |
bind-dnssec-utils AlmaLinux:9 | All versions | 32:9.16.23-40.el9_8.12 |
bind-doc AlmaLinux:9 | All versions | 32:9.16.23-40.el9_8.12 |
bind-libs AlmaLinux:9 | All versions | 32:9.16.23-40.el9_8.12 |
bind-license AlmaLinux:9 | All versions | 32:9.16.23-40.el9_8.12 |
bind-utils AlmaLinux:9 | All versions | 32:9.16.23-40.el9_8.12 |
bind9.18 AlmaLinux:9 | All versions | 32:9.18.29-14.el9_8.11 |
bind9.18-chroot AlmaLinux:9 | All versions | 32:9.18.29-14.el9_8.11 |
bind9.18-devel AlmaLinux:9 | All versions | 32:9.18.29-14.el9_8.11 |
bind9.18-dnssec-utils AlmaLinux:9 | All versions | 32:9.18.29-14.el9_8.11 |
bind9.18-doc AlmaLinux:9 | All versions | 32:9.18.29-14.el9_8.11 |
bind9.18-libs AlmaLinux:9 | All versions | 32:9.18.29-14.el9_8.11 |
bind9.18-utils AlmaLinux:9 | All versions | 32:9.18.29-14.el9_8.11 |
python3-bind AlmaLinux:9 | All versions | 32:9.16.23-40.el9_8.12 |
bind Rocky Linux:10 | All versions | 2:9.18.33-15.el10_2.13 |
bind Rocky Linux:9 | All versions | 2:9.16.23-40.el9_8.12 |
bind9.18 Rocky Linux:9 | All versions | 2:9.18.29-14.el9_8.11 |
How do I fix CVE-2026-19662?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-19662 being exploited?
There is no known exploitation of CVE-2026-19662 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-19662, ALSA-2026:89745, ALSA-2026:89746, ALSA-2026:90328, AZL-103356, BELL-CVE-2026-19662 and 9 more.