BIND 9 Denial of Service via Malformed DNS64 Response

The Internet Systems Consortium (ISC) BIND 9 software contains a vulnerability (CVE-2026-19666) that affects resolvers specifically configured to utilize the DNS64 function. When the resolver receives a maliciously crafted or malformed response from an authoritative DNS server, the named process encounters an unhandled state, causing the service to exit unexpectedly. This leads to a denial of service (DoS) for all clients relying on the affected resolver. The vulnerability impacts a wide range of BIND 9 versions, including the 9.11, 9.20, and 9.21 branches, as well as their subscription versions. Because this requires an authoritative server to provide specific malformed data, the scope of risk is primarily limited to environments where the resolver configuration allows for such upstream responses, or where an attacker can influence the traffic returned to the recursive resolver.

Impact

Successful exploitation results in the immediate termination of the named process. In production environments, this causes a complete outage of DNS resolution services for the affected infrastructure, preventing internal and external network communication dependent on name resolution.

Recommendation

Prioritize patching affected BIND 9 instances to the latest secure version provided by ISC. Because this is a crash-inducing vulnerability, monitor DNS server logs for unexpected service restarts or frequent named process terminations. Review configuration files to identify if dns64 is enabled, as this is a prerequisite for the vulnerability.