{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-3039", "assignerOrgId": "404fd4d2-a609-4245-b543-2c944a302a22", "state": "PUBLISHED", "assignerShortName": "isc", "dateReserved": "2026-02-23T16:28:45.411Z", "datePublished": "2026-05-20T13:09:04.126Z", "dateUpdated": "2026-09-01T12:04:50.106Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "404fd4d2-a609-4245-b543-2c944a302a22", "shortName": "isc", "dateUpdated": "2026-05-20T13:09:04.126Z" }, "title": "BIND 9 server memory exhaustion during GSS-API TKEY negotiation", "datePublic": "2026-05-20T00:00:00.000Z", "affected": [ { "vendor": "ISC", "product": "BIND 9", "versions": [ { "version": "9.0.0", "lessThanOrEqual": "9.16.50", "status": "affected", "versionType": "custom" }, { "version": "9.18.0", "lessThanOrEqual": "9.18.48", "status": "affected", "versionType": "custom" }, { "version": "9.20.0", "lessThanOrEqual": "9.20.22", "status": "affected", "versionType": "custom" }, { "version": "9.21.0", "lessThanOrEqual": "9.21.21", "status": "affected", "versionType": "custom" }, { "version": "9.9.3-S1", "lessThanOrEqual": "9.16.50-S1", "status": "affected", "versionType": "custom" }, { "version": "9.18.11-S1", "lessThanOrEqual": "9.18.48-S1", "status": "affected", "versionType": "custom" }, { "version": "9.20.9-S1", "lessThanOrEqual": "9.20.22-S1", "status": "affected", "versionType": "custom" } ], "defaultStatus": "unaffected" } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.0.0", "versionEndIncluding": "9.16.50" }, { "vulnerable": true, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.18.0", "versionEndIncluding": "9.18.48" }, { "vulnerable": true, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.20.0", "versionEndIncluding": "9.20.22" }, { "vulnerable": true, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.21.0", "versionEndIncluding": "9.21.21" }, { "vulnerable": true, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.9.3-S1", "versionEndIncluding": "9.16.50-S1" }, { "vulnerable": true, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.18.11-S1", "versionEndIncluding": "9.18.48-S1" }, { "vulnerable": true, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.20.9-S1", "versionEndIncluding": "9.20.22-S1" } ] } ] } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-771", "description": "CWE-771 Missing Reference to Active Allocated Resource" } ] } ], "descriptions": [ { "lang": "en", "value": "BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets. Typically these servers will be found in Active Directory integrated DNS deployments and/or Kerberos-secured DNS environments.\nThis issue affects BIND 9 versions 9.0.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.9.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1." } ], "impacts": [ { "descriptions": [ { "lang": "en", "value": "An attacker can construct and send packets to a BIND server that will cause it to allocate memory that is not subsequently released. Depending on the volume and frequency of the packets received, named will eventually fail due to memory exhaustion." } ] } ], "workarounds": [ { "lang": "en", "value": "No workarounds known." } ], "exploits": [ { "lang": "en", "value": "We are not aware of any active exploits." } ], "solutions": [ { "lang": "en", "value": "Upgrade to the patched release most closely related to your current version of BIND 9: 9.18.49, 9.20.23, 9.21.22, 9.18.49-S1, or 9.20.23-S1." } ], "credits": [ { "lang": "en", "value": "ISC would like to thank Vitaly Simonovich for bringing this vulnerability to our attention." } ], "references": [ { "url": "https://kb.isc.org/docs/cve-2026-3039", "name": "CVE-2026-3039", "tags": [ "vendor-advisory" ] }, { "url": "https://downloads.isc.org/isc/bind9/9.18.49", "tags": [ "patch" ] }, { "url": "https://downloads.isc.org/isc/bind9/9.20.23", "tags": [ "patch" ] }, { "url": "https://downloads.isc.org/isc/bind9/9.21.22", "tags": [ "patch" ] } ], "source": { "discovery": "EXTERNAL" }, "x_generator": { "engine": "cvelib 1.8.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2026-05-20T13:42:49.621351Z", "id": "CVE-2026-3039", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-20T13:43:00.275Z" } }, { "affected": [ { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:10.2" ], "defaultStatus": "affected", "packageName": "bind", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "32:9.18.33-15.el10_2.2", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:rhel_els:7" ], "defaultStatus": "affected", "packageName": "bind", "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "32:9.11.4-26.P2.el7_9.21", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:enterprise_linux:8" ], "defaultStatus": "affected", "packageName": "bind9.16", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "32:9.16.23-0.22.el8_10.6", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:enterprise_linux:8", "cpe:/o:redhat:enterprise_linux:8" ], "defaultStatus": "affected", "packageName": "bind", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "32:9.11.36-16.el8_10.8", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:enterprise_linux:9" ], "defaultStatus": "affected", "packageName": "bind", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "32:9.16.23-40.el9_8.2", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:enterprise_linux:9" ], "defaultStatus": "affected", "packageName": "bind9.18", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "32:9.18.29-14.el9_8.2", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:rhel_e4s:9.4" ], "defaultStatus": "affected", "packageName": "bind", "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "32:9.16.23-18.el9_4.12", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:rhel_eus:9.6" ], "defaultStatus": "affected", "packageName": "bind", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "32:9.16.23-31.el9_6.4", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:hummingbird:1" ], "defaultStatus": "affected", "packageName": "bind-main", "product": "Red Hat Hardened Images", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "9.18.49-1.hum1", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:6" ], "defaultStatus": "affected", "packageName": "bind", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:9" ], "defaultStatus": "unaffected", "packageName": "dhcp", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift:4" ], "defaultStatus": "affected", "packageName": "openshift/ose-rhel-coreos-9", "product": "Red Hat OpenShift Container Platform 4", "vendor": "Red Hat" } ], "datePublic": "2026-05-21T12:24:11.051Z", "descriptions": [ { "lang": "en", "value": "A flaw was found in BIND. A remote attacker can exploit this vulnerability by sending maliciously-constructed packets to BIND servers configured for TKEY-based authentication via GSS-API (Generic Security Service Application Program Interface) tokens. This can lead to excessive memory consumption, resulting in a Denial of Service (DoS) for the affected server." } ], "metrics": [ { "other": { "content": { "namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important" }, "type": "Red Hat severity rating" } }, { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "format": "CVSS" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-770", "description": "Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE" } ] } ], "references": [ { "tags": [ "vdb-entry", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/security/cve/CVE-2026-3039" }, { "name": "RHBZ#2479767", "tags": [ "issue-tracking", "x_refsource_REDHAT" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479767" }, { "tags": [ "x_sadp-csaf-vex" ], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3039.json" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:60383" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:24338" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:24339" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:23360" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:57189" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:55441" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:24367" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:24368" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:20334" } ], "solutions": [ { "lang": "en", "value": "RHSA-2026:60383: Red Hat Enterprise Linux Server (v. 7 ELS)" }, { "lang": "en", "value": "RHSA-2026:24338: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)" }, { "lang": "en", "value": "RHSA-2026:24339: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux BaseOS (v. 8)" }, { "lang": "en", "value": "RHSA-2026:23360: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8)" }, { "lang": "en", "value": "RHSA-2026:57189: Red Hat Enterprise Linux AppStream E4S (v.9.4)" }, { "lang": "en", "value": "RHSA-2026:55441: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)" }, { "lang": "en", "value": "RHSA-2026:24367: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)" }, { "lang": "en", "value": "RHSA-2026:24368: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)" }, { "lang": "en", "value": "RHSA-2026:20334: Red Hat Hardened Images" } ], "timeline": [ { "lang": "en", "time": "2026-05-19T09:48:19.212Z", "value": "Reported to Red Hat." }, { "lang": "en", "time": "2026-05-21T12:24:11.051Z", "value": "Made public." } ], "title": "bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation", "workarounds": [ { "lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\nExample:\n```bash\n# Edit /etc/named.conf and remove or comment out lines related to tkey-gssapi-keytab or tkey-gssapi-credential.\n# For example, remove or comment out:\n# key \"gssapi-key\" {\n# algorithm GSSAPI;\n# secret \"BASE64_ENCODED_KEY\";\n# };\n#\n# Then reload the named service:\nsystemctl reload named\n```\nReloading the `named` service may cause a brief interruption in DNS resolution." } ], "x_adpType": "supplier", "x_generator": { "engine": "sadp-cli 1.0.0" }, "providerMetadata": { "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-09-01T12:04:50.106Z" } } ] } }