Bind 9 EUVD-2026-15410

| CVE-2026-3104 HIGH

Missing Release of Resource after Effective Lifetime (CWE-772)

2026-03-25 isc

GHSA-vwv5-298p-pw28

Information Disclosure Bind 9 Isc

7.5

CVSS 3.1 · Vendor: isc

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Attacker crafts malicious domain
Exploit

Resolver queries specially crafted domain
Execution

Memory leak triggered in BIND resolver
Impact

Denial of service through memory exhaustion

Vulnerability Assessment

Weakness	CWE CWE-772 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V15 - Secure Coding and Architecture Resource cleanup on lifecycle end
Exploitation Conditions	Remote unauthenticated attacker queries a specially crafted domain against BIND 9 resolver (versions 9.20.0–9.20.20, 9.21.0–9.21.19, 9.20.9-S1–9.20.20-S1). No victim interaction required. Default resolver configurations affected.
Impact	The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates this is remotely exploitable with low attack complexity, requiring no privileges or user interaction, making it highly automatable and suitable for widespread attack campaigns. The vulnerability enables high-impact availability disruption through memory exhaustion denial of service. From an SSVC perspective, the attack is network-based and automatable, with technical impact limited to denial of service rather than system compromise. While the CVSS score of 7.5 is considered high severity, the real-world risk depends heavily on deployment context: public-facing recursive resolvers are at immediate risk, while authoritative-only servers or resolvers behind protective infrastructure face reduced exposure. The availability of vendor patches for both affected branches (9.20.21 and 9.21.20) suggests this is a known and addressable issue. No EPSS score or KEV status is indicated in the provided data, and the tags suggest this was responsibly disclosed to ISC who has provided fixes.
Exploit ScenarioDerived	An attacker identifies a public recursive DNS resolver running vulnerable BIND 9.20.x or 9.21.x versions through service fingerprinting. They configure or compromise authoritative DNS servers to serve specially crafted domain records, then programmatically generate queries to these domains targeting the victim resolver. Each query triggers a memory leak in the resolver process, and through sustained or distributed querying over hours or days, the attacker exhausts available memory causing the DNS service to crash or become unresponsive, disrupting name resolution for all users dependent on that resolver.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

AnalysisAIv1 – Mar 25, 2026

Memory exhaustion in BIND 9 resolver allows unauthenticated remote attackers to cause denial of service by querying specially crafted domains, affecting versions 9.20.0-9.20.20, 9.21.0-9.21.19, and 9.20.9-S1-9.20.20-S1. The vulnerability stems from improper memory management (CWE-772) and can be triggered without authentication or user interaction. Patches are available for affected Ubuntu, SUSE, and Debian systems.

Earlier versions of this analysis (1)

v1 Mar 25, 2026 - 14:00 CVSS 7.5

A memory leak vulnerability exists in BIND 9 resolver that can be triggered remotely by querying a specially crafted domain name. This affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1, while earlier 9.18.x versions are not affected. The vulnerability has a CVSS score of 7.5 (High) and can lead to denial of service through memory exhaustion, requiring no authentication or user interaction to exploit.

RemediationAI

Upgrade affected BIND 9 installations immediately to version 9.20.21 or later for the 9.20 branch (download available at https://downloads.isc.org/isc/bind9/9.20.21) or to version 9.21.20 or later for the 9.21 branch (download available at https://downloads.isc.org/isc/bind9/9.21.20). Organizations unable to patch immediately should consider temporarily switching to the unaffected 9.18 branch or implementing rate limiting and query filtering at the network perimeter to reduce exposure to malicious domain queries. Monitor memory utilization closely on affected resolvers to detect potential exploitation attempts and implement automated restart procedures if memory consumption patterns become abnormal. Consult the ISC security advisory at https://kb.isc.org/docs/cve-2026-3104 for complete remediation guidance and any additional vendor recommendations.

Affected VersionsENISA

BIND 9 9.20.9-S1 ≤9.20.20-S1

BIND 9 9.21.0 ≤9.21.19

BIND 9 9.20.0 ≤9.20.20

Affected Packages

euvd bind_9 no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Technical ContextAI · show details

BIND (Berkeley Internet Name Domain) is the most widely deployed DNS server software on the Internet, developed and maintained by the Internet Systems Consortium (ISC). This vulnerability affects the BIND 9 resolver component across specific version ranges as identified by CPE cpe:2.3:a:isc:bind_9:*:*:*:*:*:*:*:*. The root cause is classified as CWE-772 (Missing Release of Resource after Effective Lifetime), which occurs when allocated memory is not properly freed after use. In DNS resolvers, this type of flaw typically manifests during query processing where domain name handling or response parsing fails to deallocate temporary memory structures, leading to progressive memory consumption with each malicious query. Notably, the vulnerability appears to have been introduced in version 9.20.0, as the entire 9.18.x branch including versions through 9.18.46 is explicitly unaffected.

Know when Bind 9 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (isc) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Ubuntu MEDIUM

SUSE HIGH

Red Hat 7.5 HIGH

Primary rating from Vendor (isc).

CVSS VectorVendor: isc

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

3

PoC Detected

Mar 25, 2026 - 15:41 vuln.today

Public exploit code

Patch released

Mar 25, 2026 - 14:00 nvd

Patch available

CVE Published

Mar 25, 2026 - 13:29 nvd

HIGH 7.5

DescriptionCVE.org

A specially crafted domain can be used to cause a memory leak in a BIND resolver simply by querying this domain. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.

Executive ViewAI

Why It Matters

A remote denial-of-service vulnerability in BIND 9 DNS resolver could allow attackers to crash DNS services through memory exhaustion without authentication. Organizations running affected BIND versions face potential service disruption and operational downtime if exploited, directly impacting network availability and business continuity.

Business Impact: High

Compensating Controls

Apply vendor patch. If patching is delayed, implement network segmentation to restrict DNS query sources, deploy rate-limiting on recursive queries, enable query logging and monitoring for malformed domain requests, and maintain DNS service redundancy across geographically distributed servers.

Threat Intelligence Overview

EPSS Score

0.0%

Top 92% exploitable

Exploit

POC

Public exploit code exists

Data Quality

8 sources

Confidence: High

EUVD

CVE.org

EPSS

Vulnrichment Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

58

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Bind 9

View all

CVE-2026-1519 HIGH This Week POC

BIND resolver servers performing DNSSEC validation can be forced into excessive CPU consumption when encountering a mali

CVE-2026-3593 CRITICAL Act Now

Memory corruption in ISC BIND 9's DNS-over-HTTPS (DoH) implementation lets remote attackers trigger a use-after-free (CW

CVE-2026-13321 HIGH This Week

DNSSEC validation bypass in ISC BIND 9 resolvers (9.11.0 through 9.21.23 and S-editions) allows an attacker controlling

CVE-2026-94300 HIGH This Week

Memory corruption in ISC BIND 9's GSS-TSIG handling allows an on-path attacker who captures a previously signed UDP mess

CVE-2026-11622 HIGH This Week

Denial of service in ISC BIND 9 lets a remote unauthenticated attacker exhaust resolver memory by flooding a DNSSEC-vali

CVE-2026-13204 HIGH This Week

Remote denial of service in ISC BIND 9 lets an attacker crash a validating resolver via a maliciously crafted DNSSEC pro

CVE-2026-11605 HIGH This Week

Denial of service in ISC BIND 9 resolvers (9.20.0-9.20.24, 9.21.0-9.21.23, and 9.20.9-S1-9.20.24-S1) lets remote unauthe

CVE-2026-11721 HIGH This Week

Cache poisoning in ISC BIND 9 recursive resolvers allows an attacker who controls an authoritative zone to inject forged

CVE-2026-11331 HIGH This Week

RPZ policy bypass and remote denial-of-service in ISC BIND 9 resolvers lets unauthenticated attackers defeat Response Po

CVE-2026-12617 HIGH This Week

Remote denial of service in ISC BIND 9 lets an off-path attacker crash a recursive resolver by controlling the timing an

CVE-2026-80274 HIGH This Week

Denial of service in ISC BIND 9 recursive resolvers affects versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.2

CVE-2026-19667 HIGH This Week

Remote denial of service in ISC BIND 9 lets an attacker-controlled (or spoofing-capable) authoritative DNS server crash

Same weakness CWE-772 – Missing Release of Resource after Effective Lifetime

View all

CVE-2017-14495 HIGH POC

CVE-2024-20481 MEDIUM

CVE-2017-14138 CRITICAL POC

CVE-2020-12134 CRITICAL POC

CVE-2024-2398 HIGH POC

CVE-2018-19760 HIGH POC

CVE-2017-13748 HIGH POC

CVE-2017-15268 HIGH POC

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

CVE-2021-34523 CRITICAL POC

CVE-2013-2251 CRITICAL POC

CVE-2017-5638 CRITICAL POC

CVE-2025-24813 CRITICAL POC

CVE-2025-68613 HIGH POC

CVE-2015-1701 HIGH POC

CVE-2017-0147 HIGH POC

Vendor StatusVendor

Ubuntu

Priority: Medium

bind9

Release	Status	Version
trusty	not-affected	-
xenial	not-affected	-
bionic	not-affected	-
focal	not-affected	-
jammy	not-affected	1:9.18.39-0ubuntu0.22.04.2
noble	not-affected	1:9.18.39-0ubuntu0.24.04.2
upstream	released	9.20.21,9.21.20
questing	released	1:9.20.11-1ubuntu2.2

isc-dhcp

Release	Status	Version
trusty	not-affected	code not present
xenial	not-affected	code not present
bionic	needs-triage	-
focal	not-affected	code not present
jammy	not-affected	code not present
noble	needs-triage	-
questing	needs-triage	-
upstream	needs-triage	-

bind9-libs

Release	Status	Version
focal	needs-triage	-
jammy	needs-triage	-
noble	DNE	-
questing	DNE	-
upstream	needs-triage	-

USN-8124-1

Debian

bind9

Release	Status	Fixed Version	Urgency
bullseye	vulnerable	1:9.16.50-1~deb11u2	-
bullseye (security)	vulnerable	1:9.16.50-1~deb11u4	-
bookworm	vulnerable	1:9.18.41-1~deb12u1	-
bookworm (security)	vulnerable	1:9.18.44-1~deb12u1	-
trixie (security), trixie	vulnerable	1:9.20.18-1~deb13u1	-
forky	vulnerable	1:9.20.20-1	-
sid	vulnerable	1:9.20.21-1	-
(unstable)	fixed	(unfixed)	-

SUSE

Severity: High

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed
SUSE Linux Enterprise Micro 5.5	Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7	Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7	Fixed

References

Advisories & patches

PATCH https://downloads.isc.org/isc/bind9/9.20.21 PATCH https://downloads.isc.org/isc/bind9/9.21.20 ADVISORY https://kb.isc.org/docs/cve-2026-3104 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-3104 ADVISORY https://ubuntu.com/security/notices/USN-8124-1 ADVISORY https://vuldb.com/?id.353134 REF https://access.redhat.com/errata/RHSA-2026:6935 REF https://access.redhat.com/security/cve/CVE-2026-3104 REF https://bugzilla.redhat.com/show_bug.cgi?id=2451310 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3104.json

Search Externally

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy