CVE-2026-3039 | BDVDB-2026-334075 Detail
ISCBIND 9
Description#
BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets. Typically these servers will be found in Active Directory integrated DNS deployments and/or Kerberos-secured DNS environments. This issue affects BIND 9 versions 9.0.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.9.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.
Impact#
An attacker can construct and send packets to a BIND server that will cause it to allocate memory that is not subsequently released. Depending on the volume and frequency of the packets received, named will eventually fail due to memory exhaustion.
Weaknesses#
References#
- https://kb.isc.org/docs/cve-2026-3039
- https://downloads.isc.org/isc/bind9/9.18.49
- https://downloads.isc.org/isc/bind9/9.20.23
- https://downloads.isc.org/isc/bind9/9.21.22
- https://access.redhat.com/security/cve/CVE-2026-3039
- https://bugzilla.redhat.com/show_bug.cgi?id=2479767
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3039.json
- https://access.redhat.com/errata/RHSA-2026:60383
- https://access.redhat.com/errata/RHSA-2026:62549
- https://access.redhat.com/errata/RHSA-2026:65851
- https://access.redhat.com/errata/RHSA-2026:24338
- https://access.redhat.com/errata/RHSA-2026:24339
- https://access.redhat.com/errata/RHSA-2026:23360
- https://access.redhat.com/errata/RHSA-2026:57189
- https://access.redhat.com/errata/RHSA-2026:55441
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.