Loading story…
ISC disclosed CVE-2026-3039, a remote, unauthenticated denial-of-service flaw in BIND 9 that affects deployments using GSS-API TKEY authentication, such as Active Directory-integrated DNS and Kerberos-secured environments. The bug lets an attacker send repeated incomplete GSS-API tokens to DNS servers on port 53 during TKEY negotiation, causing gss_accept_sec_context() to allocate a security context that BIND neither preserves nor frees when the exchange remains incomplete. Because the leaked memory is allocated by the GSS library rather than BIND's own memory manager, the process can exhaust system memory and disrupt DNS resolution.
ISC rated the issue CVSS 7.5 and mapped it to CWE-771, noting that builds without GSSAPI support are not affected and that no workaround is available. Vulnerable releases span multiple supported branches, including 9.18.x, 9.20.x, and 9.21.x, while patched versions include 9.18.49, 9.20.23, and 9.21.22. The fix removes multi-round GSS-API negotiation support and adds RFC 3645-compliant checks for mutual authentication and integrity flags to prevent the context leak.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
On May 20, 2026, ISC publicly disclosed CVE-2026-3039, a CVSS 7.5 denial-of-service flaw affecting GSS-API-enabled BIND 9 deployments. ISC said no workaround was available and released fixes in BIND 9.18.49, 9.20.23, 9.21.22, and corresponding supported preview editions.
ISC documented CVE-2026-3039 as a pre-authentication memory exhaustion vulnerability in BIND 9's GSS-API TKEY negotiation after a working reproducer was provided and the bug was confirmed. The issue allows unauthenticated attackers to trigger an unbounded memory leak that can lead to denial of service.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
zeropath.com
Open sourcegitlab.isc.org
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Internet Systems Consortium (ISC) disclosed six vulnerabilities in **BIND 9** and released patched versions `9.18.49`, `9.20.23`, and `9.21.22`. The issues include **CVE-2026-3039**, a high-severity memory-exhaustion flaw during GSS-API TKEY negotiation that can crash `named`; **CVE-2026-3593**, a high-severity heap use-after-free in the DNS-over-HTTPS implementation triggered by crafted HTTP/2 traffic; **CVE-2026-3592**, an amplification issue involving self-pointed glue records that can drive disproportionate bandwidth and resource consumption; **CVE-2026-5947**, a race condition in SIG(0) validation under query-flood conditions that can lead to undefined behavior and process crashes; plus additional flaws involving invalid handling of `CLASS != IN` and an unbounded resend loop in the resolver. ISC said the vulnerabilities are remotely exploitable in affected configurations, with the most serious impacts centered on denial of service, memory corruption, and resolver abuse rather than confirmed code execution. Exposure depends on feature use: the GSS-API issue is especially relevant to Active Directory-integrated or Kerberos-secured DNS deployments, while the DoH flaw affects only servers with DNS-over-HTTPS enabled and can be mitigated by disabling that feature until upgrades are applied. ISC reported no known active exploitation at disclosure time, said no workaround is known for several of the bugs, and credited external researchers including Vitaly Simonovich, Naoki Wakamatsu, Naresh Kandula Parmar, and Shuhan Zhang for reporting the flaws.
Jun 29, 2026
Internet Systems Consortium (ISC) disclosed four vulnerabilities in **BIND 9** affecting supported releases and Supported Preview Edition builds, including `CVE-2026-1519`, `CVE-2026-3104`, `CVE-2026-3119`, and `CVE-2026-3591`. The flaws impact DNSSEC validation and proof generation, authenticated queries containing `TKEY` records, and `SIG(0)` handling. Reported consequences include excessive CPU consumption during insecure delegation validation, a memory leak while preparing DNSSEC proofs, unexpected termination of the `named` daemon, and a stack use-after-return condition that could allow an ACL bypass. Affected branches include **BIND 9.11, 9.18, 9.20, and 9.21** across specified version ranges, and ISC said the public disclosure ended the embargo period so prepared packages could be released. Patched versions were issued as **9.18.47**, **9.20.21**, and **9.21.20**, and the Canadian Centre for Cyber Security urged administrators to review ISC’s advisories and apply the required updates.
Jun 29, 2026
Internet Systems Consortium disclosed **nine vulnerabilities** in **BIND 9** and released patched versions **9.20.26** and **9.21.24**. The most severe issue, **`CVE-2026-13321`** (CVSS **8.6**), allows a remotely exploitable **DNSSEC validation bypass** by accepting signed **NSEC** records whose `Next Domain Name` points outside the signer’s zone, enabling cross-zone cache poisoning with authenticated denial responses. ISC also disclosed **`CVE-2026-11721`**, a high-severity **cache poisoning** flaw tied to label-count discrepancies in **RRSIG** and wildcard synthesis, and **`CVE-2026-10723`**, which can let attackers forge authenticated **NXDOMAIN** responses for sibling zones through incorrect acceptance of child-zone **NSEC3** records. ISC said no active exploitation was known at disclosure time and reported no workaround for the affected releases. The remaining flaws include several remotely exploitable **denial-of-service** and **resource exhaustion** bugs affecting DNSSEC-validating resolvers and other BIND components. **`CVE-2026-11622`** can drive memory consumption far beyond configured limits during random-subdomain attacks against DNSSEC-signed zones, while **`CVE-2026-11605`** can force excessive CPU use by making BIND validate unnecessary but valid **RRSIG** records. **`CVE-2026-13204`**, **`CVE-2026-12617`**, and **`CVE-2026-10822`** can cause **`named`** to exit unexpectedly under specific malformed or specially ordered DNS responses, and **`CVE-2026-11331`** can bypass wildcard **RPZ CNAME** policies and also trigger a crash with overly long query names. ISC advised users of affected **9.11**, **9.18**, **9.20**, **9.21**, and Supported Preview Edition branches to upgrade to the nearest patched supported release.
Jul 23, 2026