Skip to main content

Bind 9 CVE-2026-3104

| EUVDEUVD-2026-15410 HIGH
Missing Release of Resource after Effective Lifetime (CWE-772)
2026-03-25 isc GHSA-vwv5-298p-pw28
Information Disclosure Bind 9
7.5
CVSS 3.1 · Vendor: isc
Share

Severity by source

Vendor (isc) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu
MEDIUM
qualitative
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (isc).

CVSS VectorVendor: isc

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
PoC Detected
Mar 25, 2026 - 15:41 vuln.today
Public exploit code
EUVD ID Assigned
Mar 25, 2026 - 14:00 euvd
EUVD-2026-15410
Analysis Generated
Mar 25, 2026 - 14:00 vuln.today
Patch released
Mar 25, 2026 - 14:00 nvd
Patch available
CVE Published
Mar 25, 2026 - 13:29 nvd
HIGH 7.5

DescriptionCVE.org

A specially crafted domain can be used to cause a memory leak in a BIND resolver simply by querying this domain. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.

AnalysisAI

Memory exhaustion in BIND 9 resolver allows unauthenticated remote attackers to cause denial of service by querying specially crafted domains, affecting versions 9.20.0-9.20.20, 9.21.0-9.21.19, and 9.20.9-S1-9.20.20-S1. The vulnerability stems from improper memory management (CWE-772) and can be triggered without authentication or user interaction. Patches are available for affected Ubuntu, SUSE, and Debian systems.

Technical ContextAI

BIND (Berkeley Internet Name Domain) is the most widely deployed DNS server software on the Internet, developed and maintained by the Internet Systems Consortium (ISC). This vulnerability affects the BIND 9 resolver component across specific version ranges as identified by CPE cpe:2.3:a:isc:bind_9:*:*:*:*:*:*:*:*. The root cause is classified as CWE-772 (Missing Release of Resource after Effective Lifetime), which occurs when allocated memory is not properly freed after use. In DNS resolvers, this type of flaw typically manifests during query processing where domain name handling or response parsing fails to deallocate temporary memory structures, leading to progressive memory consumption with each malicious query. Notably, the vulnerability appears to have been introduced in version 9.20.0, as the entire 9.18.x branch including versions through 9.18.46 is explicitly unaffected.

RemediationAI

Upgrade affected BIND 9 installations immediately to version 9.20.21 or later for the 9.20 branch (download available at https://downloads.isc.org/isc/bind9/9.20.21) or to version 9.21.20 or later for the 9.21 branch (download available at https://downloads.isc.org/isc/bind9/9.21.20). Organizations unable to patch immediately should consider temporarily switching to the unaffected 9.18 branch or implementing rate limiting and query filtering at the network perimeter to reduce exposure to malicious domain queries. Monitor memory utilization closely on affected resolvers to detect potential exploitation attempts and implement automated restart procedures if memory consumption patterns become abnormal. Consult the ISC security advisory at https://kb.isc.org/docs/cve-2026-3104 for complete remediation guidance and any additional vendor recommendations.

More in Bind 9

View all
CVE-2026-1519 HIGH POC
7.5 Mar 25

BIND resolver servers performing DNSSEC validation can be forced into excessive CPU consumption when encountering a mali
CVE-2026-3593 CRITICAL
9.8 May 20

Memory corruption in ISC BIND 9's DNS-over-HTTPS (DoH) implementation lets remote attackers trigger a use-after-free (CW
CVE-2026-3039 HIGH
7.5 May 20

Denial of service in ISC BIND 9 DNS servers configured with TKEY GSS-API authentication allows remote unauthenticated at
CVE-2026-5946 HIGH
7.5 May 20

Remote denial of service in ISC BIND 9 named allows unauthenticated attackers to trigger assertion failures and crash th
CVE-2026-3119 MEDIUM
6.5 Mar 25

BIND 9 DNS server crashes when processing specially crafted TSIG-authenticated queries containing TKEY records, affectin
CVE-2026-5947 MEDIUM
5.9 May 20

Denial of service in ISC BIND 9 resolvers can be triggered when a SIG(0)-signed DNS message is dropped under recursive-c
CVE-2026-3591 MEDIUM
5.4 Mar 25

A use-after-return vulnerability in ISC BIND 9's SIG(0) DNS query handler allows an attacker with low-level authenticati

Same weakness CWE-772 – Missing Release of Resource after Effective Lifetime

View all
CVE-2017-14495 HIGH POC
7.5
CVE-2017-14138 CRITICAL POC
9.8
CVE-2020-12134 CRITICAL POC
9.8
CVE-2018-19760 HIGH POC
8.8
CVE-2017-13748 HIGH POC
7.5
CVE-2017-15268 HIGH POC
7.5
CVE-2017-11655 HIGH POC
7.5
CVE-2019-18198 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

Ubuntu

Priority: Medium
bind9
Release Status Version
trusty not-affected -
xenial not-affected -
bionic not-affected -
focal not-affected -
jammy not-affected 1:9.18.39-0ubuntu0.22.04.2
noble not-affected 1:9.18.39-0ubuntu0.24.04.2
upstream released 9.20.21,9.21.20
questing released 1:9.20.11-1ubuntu2.2
isc-dhcp
Release Status Version
trusty not-affected code not present
xenial not-affected code not present
bionic needs-triage -
focal not-affected code not present
jammy not-affected code not present
noble needs-triage -
questing needs-triage -
upstream needs-triage -
bind9-libs
Release Status Version
focal needs-triage -
jammy needs-triage -
noble DNE -
questing DNE -
upstream needs-triage -
USN-8124-1

Debian

bind9
Release Status Fixed Version Urgency
bullseye vulnerable 1:9.16.50-1~deb11u2 -
bullseye (security) vulnerable 1:9.16.50-1~deb11u4 -
bookworm vulnerable 1:9.18.41-1~deb12u1 -
bookworm (security) vulnerable 1:9.18.44-1~deb12u1 -
trixie (security), trixie vulnerable 1:9.20.18-1~deb13u1 -
forky vulnerable 1:9.20.20-1 -
sid vulnerable 1:9.20.21-1 -
(unstable) fixed (unfixed) -

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.5 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed

Share

CVE-2026-3104 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy