Skip to main content

ISC BIND 9 CVE-2026-3039

| EUVDEUVD-2026-31103 HIGH
Missing Reference to Active Allocated Resource (CWE-771)
2026-05-20 isc GHSA-p65f-mhrm-vhrc
Information Disclosure Bind 9 Isc
7.5
CVSS 3.1 · Vendor: isc
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify AD-integrated BIND resolver
  2. Delivery
    Reach DNS port 53 over network
  3. Exploit
    Send crafted TKEY/GSS-API packets
  4. Execution
    Trigger unbounded memory allocations in named
  5. Persist
    Repeat to exhaust host memory
  6. Impact
    Daemon killed, DNS/AD outage

Vulnerability Assessment

Weakness
CWE
CWE-771
ASVS 5.0
V15 - Secure Coding and Architecture Resource allocation tracking
Exploitation Conditions

The target BIND 9 server must be explicitly configured to accept TKEY-based authentication using GSS-API tokens (GSS-TSIG), which in practice means an Active Directory-integrated or Kerberos-secured DNS deployment; default BIND configurations without GSS-TSIG enabled are NOT exploitable. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, and the attacker only needs network reachability to the server's DNS port (typically UDP/TCP 53). Exploitation is limited by the requirement that GSS-API/TKEY processing is reachable from the attacker's network position - internet-exposed authoritative or recursive resolvers without GSS-TSIG configured fall outside the vulnerable surface, while internal AD DNS servers reachable by any domain-joined or LAN-resident host are squarely in scope.
Impact

CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H accurately reflects a remote, unauthenticated, low-complexity availability-only attack with no confidentiality or integrity impact, giving a base score of 7.5. The vendor-provided 'Information Disclosure' tag conflicts with the CVSS vector (C:N) and the description, which describes memory exhaustion - defenders should treat this as a denial-of-service issue rather than an information leak; the tag is likely mislabelled in the upstream feed. EPSS is not provided, the CVE is not on the CISA KEV list, and no PoC is referenced, so this is presently a theoretical-but-credible DoS rather than an in-the-wild threat. Real-world exposure is meaningfully narrower than the CVSS suggests because the vulnerable code path only activates on servers that have explicitly enabled TKEY/GSS-API - predominantly AD-integrated DNS - so internet-exposed recursive resolvers without GSS-TSIG are not in scope. Where the feature is enabled (typical of enterprise AD environments), the issue should be treated as a high-priority infrastructure availability risk because BIND outages cascade into Kerberos, AD logon, and dependent services.
Exploit ScenarioDerived

An attacker on the network sends a stream of maliciously crafted TKEY/GSS-API negotiation packets to an Active Directory-integrated BIND 9 resolver reachable on UDP/TCP 53. Each malformed exchange causes named to allocate memory that is never released, and within minutes to hours the daemon exhausts host memory and is OOM-killed, taking down internal name resolution and dependent Kerberos/AD logon flows. No PoC has been published at time of analysis, but the low CVSS attack complexity and no-authentication requirement make weaponization straightforward once the malformed-packet structure is reverse-engineered from the patch.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 20, 2026

Denial of service in ISC BIND 9 DNS servers configured with TKEY GSS-API authentication allows remote unauthenticated attackers to trigger excessive memory consumption by sending maliciously crafted packets. The flaw primarily impacts Active Directory-integrated DNS and Kerberos-secured DNS deployments, where service exhaustion can disrupt authentication, name resolution, and dependent enterprise services. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 7.5 score and network-reachable, unauthenticated nature warrant timely patching.

RemediationAI

Vendor-released patches are available: upgrade to BIND 9.18.49, 9.20.23, or 9.21.22 (or the equivalent -S1 Supported Preview build for subscribers), obtainable from https://downloads.isc.org/isc/bind9/9.18.49, https://downloads.isc.org/isc/bind9/9.20.23, and https://downloads.isc.org/isc/bind9/9.21.22, with full advisory context at https://kb.isc.org/docs/cve-2026-3039. The 9.16.x mainline reached end-of-life before this patch cycle, so operators still on 9.16.x must migrate to a supported branch (9.18.49 is the closest LTS-style target). As a compensating control where immediate patching is not possible, disable TKEY/GSS-API negotiation on the affected servers - note this will break secure dynamic updates from Active Directory clients and is generally not viable in AD-integrated environments; alternatively, restrict UDP/TCP port 53 access to only trusted domain controllers and member hosts via network ACLs or host firewalls to limit which sources can submit TKEY exchanges, accepting that this does not protect against compromised internal clients. Monitor named process RSS and configure systemd or process supervisors with memory limits and automatic restarts to contain the impact of a successful attempt, understanding this only reduces blast radius rather than preventing the bug.

Affected VersionsENISA

BIND 9 9.20.9-S1 ≤9.20.22-S1
BIND 9 9.18.11-S1 ≤9.18.48-S1
BIND 9 9.9.3-S1 ≤9.16.50-S1
BIND 9 9.21.0 ≤9.21.21
BIND 9 9.20.0 ≤9.20.22
BIND 9 9.18.0 ≤9.18.48
BIND 9 9.0.0 ≤9.16.50

Affected Packages

euvd bind_9 no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

BIND 9 is the most widely deployed open-source DNS server software, maintained by ISC. TKEY (Transaction Key, RFC 2930) is a meta-RR mechanism used to negotiate shared secrets between DNS clients and servers, and the GSS-API variant (GSS-TSIG, RFC 3645) is commonly used in Microsoft Active Directory environments to allow secure dynamic DNS updates from domain-joined hosts. The root cause maps to CWE-771 (Missing Reference to Active Allocated Resource), meaning BIND fails to release memory allocated during the parsing or negotiation of malformed TKEY/GSS-API token exchanges. As the named resolver/auth daemon processes successive crafted packets, allocations accumulate until the process exhausts available memory and is killed or becomes unresponsive. The affected component (cpe:2.3:a:isc:bind_9:*) covers both mainline branches and the Supported Preview (-S1) releases distributed to ISC subscribers.

Know when Bind 9 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (isc) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (isc).

CVSS VectorVendor: isc

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

DescriptionCVE.org

BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets. Typically these servers will be found in Active Directory integrated DNS deployments and/or Kerberos-secured DNS environments. This issue affects BIND 9 versions 9.0.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.9.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

Executive ViewAI

Why It Matters

ISC BIND 9 DNS servers are vulnerable to unauthenticated denial-of-service attacks that can disrupt DNS service availability and downstream authentication systems. Organizations operating Active Directory-integrated DNS or Kerberos-secured DNS infrastructure face the greatest risk of service interruption. The vulnerability is network-accessible and exploitable without authentication, necessitating urgent patching to maintain operational resilience.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.1%
Top 84% exploitable
Social Media
4
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Bind 9

View all
CVE-2026-1519 HIGH POC
7.5 Mar 25

BIND resolver servers performing DNSSEC validation can be forced into excessive CPU consumption when encountering a mali
CVE-2026-3104 HIGH POC
7.5 Mar 25

Memory exhaustion in BIND 9 resolver allows unauthenticated remote attackers to cause denial of service by querying spec
CVE-2026-3593 CRITICAL
9.8 May 20

Memory corruption in ISC BIND 9's DNS-over-HTTPS (DoH) implementation lets remote attackers trigger a use-after-free (CW
CVE-2026-13321 HIGH
8.6 Jul 22

DNSSEC validation bypass in ISC BIND 9 resolvers (9.11.0 through 9.21.23 and S-editions) allows an attacker controlling

CVE-2026-94300 HIGH
8.1 Oct 21

Memory corruption in ISC BIND 9's GSS-TSIG handling allows an on-path attacker who captures a previously signed UDP mess
CVE-2026-11622 HIGH
7.5 Jul 22

Denial of service in ISC BIND 9 lets a remote unauthenticated attacker exhaust resolver memory by flooding a DNSSEC-vali
CVE-2026-13204 HIGH
7.5 Jul 22

Remote denial of service in ISC BIND 9 lets an attacker crash a validating resolver via a maliciously crafted DNSSEC pro
CVE-2026-11605 HIGH
7.5 Jul 22

Denial of service in ISC BIND 9 resolvers (9.20.0-9.20.24, 9.21.0-9.21.23, and 9.20.9-S1-9.20.24-S1) lets remote unauthe
CVE-2026-11721 HIGH
7.5 Jul 22

Cache poisoning in ISC BIND 9 recursive resolvers allows an attacker who controls an authoritative zone to inject forged
CVE-2026-11331 HIGH
7.5 Jul 22

RPZ policy bypass and remote denial-of-service in ISC BIND 9 resolvers lets unauthenticated attackers defeat Response Po
CVE-2026-12617 HIGH
7.5 Jul 22

Remote denial of service in ISC BIND 9 lets an off-path attacker crash a recursive resolver by controlling the timing an
CVE-2026-80274 HIGH
7.5 Sep 16

Denial of service in ISC BIND 9 recursive resolvers affects versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.2

Same weakness CWE-771 – Missing Reference to Active Allocated Resource

View all
CVE-2023-20244 HIGH
8.6
CVE-2021-34720 HIGH
8.6
CVE-2026-96325 HIGH
7.5
CVE-2026-20004 HIGH
7.4
CVE-2024-56343 MEDIUM
4.3
CVE-2025-21090 MEDIUM
4.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.5 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed

References

Advisories & patches
PATCH https://downloads.isc.org/isc/bind9/9.18.49 PATCH https://downloads.isc.org/isc/bind9/9.20.23 PATCH https://downloads.isc.org/isc/bind9/9.21.22 ADVISORY https://access.redhat.com/errata/RHSA-2026:20334 ADVISORY https://kb.isc.org/docs/cve-2026-3039 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-3039 ADVISORY https://ubuntu.com/security/notices/USN-8293-1 ADVISORY https://vuldb.com/vuln/364872 REF https://access.redhat.com/errata/RHSA-2026:23360 REF https://access.redhat.com/errata/RHSA-2026:24338 REF https://access.redhat.com/errata/RHSA-2026:24339 REF https://access.redhat.com/errata/RHSA-2026:24367 REF https://access.redhat.com/errata/RHSA-2026:24368 REF https://access.redhat.com/errata/RHSA-2026:55441 REF https://access.redhat.com/errata/RHSA-2026:57189 REF https://access.redhat.com/errata/RHSA-2026:60383 REF https://access.redhat.com/errata/RHSA-2026:62549 REF https://access.redhat.com/errata/RHSA-2026:65851 REF https://access.redhat.com/security/cve/CVE-2026-3039 REF https://bugzilla.redhat.com/show_bug.cgi?id=2479767 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3039.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy