CVE-2026-3039
published 2026-05-20CVE-2026-3039: BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and…
PriorityP347high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.05%
62.2th percentile
BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets. Typically these servers will be found in Active Directory integrated DNS deployments and/or Kerberos-secured DNS environments.
This issue affects BIND 9 versions 9.0.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.9.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| isc | bind | — | — |
| isc | bind | 9.0.0 – 9.16.50 | — |
| isc | bind | >= 9.18.0 < 9.18.49 | 9.18.49 |
| isc | bind | >= 9.20.0 < 9.20.23 | 9.20.23 |
| isc | bind | >= 9.21.0 < 9.21.22 | 9.21.22 |
| isc | bind_9 | 9.0.0 – 9.16.50 | — |
| isc | bind_9 | 9.18.0 – 9.18.48 | — |
| isc | bind_9 | 9.18.11-S1 – 9.18.48-S1 | — |
| isc | bind_9 | 9.20.0 – 9.20.22 | — |
| isc | bind_9 | 9.20.9-S1 – 9.20.22-S1 | — |
| isc | bind_9 | 9.21.0 – 9.21.21 | — |
| isc | bind_9 | 9.9.3-S1 – 9.16.50-S1 | — |
| isc | dhcp | — | — |
| ubuntu | bind9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Bind vulnerabilities
vendor_ubuntu·2026-08-26·CVSS 7.5
CVE-2026-3039 [HIGH] Bind vulnerabilities
Title: Bind vulnerabilities
Summary: Several security issues were fixed in Bind.
Vitaly Simonovich discovered that Bind could exhaust memory during
GSS-API TKEY negotiation. A remote attacker could possibly use this
issue to cause Bind to use excessive resources, leading to a denial of
service. (CVE-2026-3039)
Shuhan Zhang discovered that Bind incorrectly handled self-pointed glue
records. A remote attacker could possibly use this issue to use Bind in
denial of service amplification attacks against other systems.
This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2026-3592)
It was discovered that Bind incorrectly handled DNS messages whose
class was not IN. A remote attacker could possibly use this issue to
cause Bind to crash, resulting in a denial of service. This i
Ubuntu
Bind vulnerabilities
vendor_ubuntu·2026-05-21·CVSS 7.5
CVE-2026-5950 [HIGH] Bind vulnerabilities
Title: Bind vulnerabilities
Summary: Several security issues were fixed in Bind.
Vitaly Simonovich discovered that Bind could exhaust memory during GSS-API
TKEY negotiation. A remote attacker could possibly use this issue to cause
Bind to use excessive resources, leading to a denial of service.
(CVE-2026-3039)
Shuhan Zhang discovered that Bind incorrectly handled self-pointed glue
records. A remote attacker could possibly use this issue to use Bind in
denial of service amplification attacks against other systems.
(CVE-2026-3592)
Naresh Kandula Parmar discovered that Bind incorrectly handled memory in
the DNS-over-HTTPS implementation. A remote attacker could possibly use
this issue to cause Bind to crash, resulting in a denial of service, or
execute arbitrary code. This issue only affe
Red Hat
bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation
vendor_redhat·2026-05-21·CVSS 7.5
CVE-2026-3039 [HIGH] CWE-770 bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation
bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation
A flaw was found in BIND. A remote attacker can exploit this vulnerability by sending maliciously-constructed packets to BIND servers configured for TKEY-based authentication via GSS-API (Generic Security Service Application Program Interface) tokens. This can lead to excessive memory consumption, resulting in a Denial of Service (DoS) for the affected server.
Statement: Important: BIND servers configured for TKEY-based GSS-API authentication are vulnerable to memory exhaustion when processing maliciously-constructed packets. This can lead to a denial of service, specifically impacting Red Hat deployments integrated with Active Directory or Kerberos for DNS where this authentication method is enabled.
Mitigation: Miti
GHSA
GHSA-p65f-mhrm-vhrc: BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and
ghsa_unreviewed·2026-05-20
CVE-2026-3039 [HIGH] CWE-771 GHSA-p65f-mhrm-vhrc: BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and
BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets. Typically these servers will be found in Active Directory integrated DNS deployments and/or Kerberos-secured DNS environments.
This issue affects BIND 9 versions 9.0.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.9.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-3039 dhcp: BIND 9 server memory exhaustion during GSS-API TKEY negotiation [fedora-all]
bugzilla·2026-05-26·CVSS 7.5
CVE-2026-3039 [HIGH] CVE-2026-3039 dhcp: BIND 9 server memory exhaustion during GSS-API TKEY negotiation [fedora-all]
CVE-2026-3039 dhcp: BIND 9 server memory exhaustion during GSS-API TKEY negotiation [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-3039 bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation [fedora-all]
bugzilla·2026-05-26·CVSS 7.5
CVE-2026-3039 [HIGH] CVE-2026-3039 bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation [fedora-all]
CVE-2026-3039 bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-3039 bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation
bugzilla·2026-05-19·CVSS 7.5
CVE-2026-3039 [HIGH] CVE-2026-3039 bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation
CVE-2026-3039 bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation
BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets. Typically these servers will be found in Active Directory integrated DNS deployments and/or Kerberos-secured DNS environments.
https://downloads.isc.org/isc/bind9/9.18.49https://downloads.isc.org/isc/bind9/9.20.23https://downloads.isc.org/isc/bind9/9.21.22https://kb.isc.org/docs/cve-2026-3039https://access.redhat.com/errata/RHSA-2026:20334https://access.redhat.com/errata/RHSA-2026:23360https://access.redhat.com/errata/RHSA-2026:24338https://access.redhat.com/errata/RHSA-2026:24339https://access.redhat.com/errata/RHSA-2026:24367https://access.redhat.com/errata/RHSA-2026:24368https://access.redhat.com/errata/RHSA-2026:55441https://access.redhat.com/errata/RHSA-2026:57189https://access.redhat.com/errata/RHSA-2026:60383https://access.redhat.com/security/cve/CVE-2026-3039https://bugzilla.redhat.com/show_bug.cgi?id=2479767https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3039.json
2026-05-20
Published