ALPINE-CVE-2026-19667

If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in named results in a negative cache entry of 0 bytes. When this entry is subsequently read, named aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 throug...

AZL-103329 CVE-2026-19667 affecting package bind 9.20.26-1

If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in named results in a negative cache entry of 0 bytes. When this entry is subsequently read, named aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 throug...

CVE-2026-77692

An attacker can cause named to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG0 record, and then closing the transport connection prematurely. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1...

UBUNTU-CVE-2026-77692

An attacker can cause named to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG0 record, and then closing the transport connection prematurely. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1...

UBUNTU-CVE-2026-19662

An attacker may be able to cause a named resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, a...

CVE-2026-19662

An attacker may be able to cause a named resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, a...

CVE-2026-77692

An attacker can cause named to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG0 record, and then closing the transport connection prematurely. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1...

CVE-2026-19662

An attacker may be able to cause a named resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, a...

CVE-2026-19662

An attacker may be able to cause a "named" resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers,...

CVE-2026-19667

If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in "named" results in a negative cache entry of 0 bytes. When this entry is subsequently read, "named" aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0...

EUVD-2026-80742

If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in named results in a negative cache entry of 0 bytes. When this entry is subsequently read, named aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 throug...

PT-2026-93742

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.11.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.27 BIND 9 versions 9.11.3-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.27-S1 Description A use-after-free bug in the named resolver can be triggered by ...

CVE-2026-77692: NULL Pointer Dereference

An attacker can cause named to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG0 record, and then closing the transport connection prematurely. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1...

CVE-2026-19662: Use After Free

An attacker may be able to cause a named resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, a...

PT-2026-93507

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the wave5 media driver where the system fails to resume the device before setting the End of Stream EOS flag. The process of setting the EOS flag involves communicatin...

CVE-2026-19667: Numeric Truncation Error

If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in named results in a negative cache entry of 0 bytes. When this entry is subsequently read, named aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 throug...

Linux Distros Unpatched Vulnerability : CVE-2026-19662

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker may be able to cause a named resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone...

CVE-2026-91959

FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rtsreadresult function within the RPC gateway transport parser. Attackers can send a malicious BINDACK PDU with a truncated result entry to trigger an out-of-bounds read causing process abort...

DEBIAN-CVE-2026-91959

FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rtsreadresult function within the RPC gateway transport parser. Attackers can send a malicious BINDACK PDU with a truncated result entry to trigger an out-of-bounds read causing process abort...

CVE-2026-91961

FreeRDP before 3.31.0 contains a denial-of-service vulnerability in the URBDRC control-transfer request path that fails to validate OutputBufferSize before forwarding to the libusb backend. A malicious RDP server can send a control-transfer request with OutputBufferSize set to 65536, triggering a...