BIND (9.18.11-S1 - 9.18.50-S1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/bind-9.18.11-s1---9.18.50-s1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 16 Sep 2026 15:50:09 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDenial of Service Vulnerability in BIND Named Servicehttps://feed.craftedsignal.io/briefs/2026-09-bind-dos/Wed, 16 Sep 2026 15:50:09 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-bind-dos/A memory management flaw in BIND 9 allows an attacker-controlled authoritative DNS server to trigger a service abort by providing a maliciously crafted 65536-byte negative DNS response.Internet Systems Consortium (ISC) BIND 9 is susceptible to a denial-of-service (DoS) vulnerability, tracked as CVE-2026-19667. The vulnerability occurs when the named process receives a negative DNS response from an authoritative server that is precisely 65536 bytes in size. Under these specific conditions, the software creates a cache entry with a size of zero bytes. Subsequent attempts by the named service to read this invalid entry result in an assertion failure, forcing the process to abort.

This issue affects a wide range of BIND versions, including the 9.11, 9.18, 9.20, and 9.21 branches, as well as their corresponding versions in the BIND Subscription Edition (S1). Given that named is a critical component of DNS infrastructure, a successful trigger of this abort will result in a complete loss of DNS resolution services for systems relying on the affected resolver, necessitating a manual restart of the service and leaving the organization vulnerable until the service is patched.

Impact

The vulnerability results in a high-severity denial-of-service condition affecting the availability of DNS infrastructure. If successfully exploited, the named process crashes, leading to a complete outage of name resolution services for all clients served by the affected BIND instance. Organizations heavily dependent on internal BIND resolvers for network operations may experience widespread service disruption across their environment.

Recommendation

  1. Patch all vulnerable instances of BIND 9 immediately. Organizations should prioritize updating to the latest vendor-provided release that addresses CVE-2026-19667.
  2. Implement monitoring to track named service crashes or restarts, which may indicate attempted exploitation or active service degradation.
  3. Review DNS configurations to ensure that the resolver is not configured to trust unverified or suspicious authoritative servers that could be leveraged to deliver the malicious 65536-byte response.
  4. Ensure all logging for the BIND service is centralized to capture error messages or assertions that occur immediately preceding a service crash.
]]>mediumadvisorydenial-of-servicednsinfrastructure