Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-3039 Details

Description

BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets. Typically these servers will be found in Active Directory integrated DNS deployments and/or Kerberos-secured DNS environments. This issue affects BIND 9 versions 9.0.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.9.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: redhat-SADPCVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://access.redhat.com/errata/RHSA-2026:20334	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:23360	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:24338	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:24339	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:24367	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:24368	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:55441	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:57189	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:60383	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:62549	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:65851	redhat-SADP
https://access.redhat.com/security/cve/CVE-2026-3039	redhat-SADP
https://bugzilla.redhat.com/show_bug.cgi?id=2479767	redhat-SADP
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3039.json	redhat-SADP
https://downloads.isc.org/isc/bind9/9.18.49	[email protected]	Patch
https://downloads.isc.org/isc/bind9/9.20.23	[email protected]	Patch
https://downloads.isc.org/isc/bind9/9.21.22	[email protected]	Patch
https://kb.isc.org/docs/cve-2026-3039	[email protected]	Vendor Advisory

see all 18 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-770	Allocation of Resources Without Limits or Throttling	redhat-SADP
CWE-771	Missing Reference to Active Allocated Resource	[email protected]

Affected Products

Product	Versions
isc bind	>= 9.0.0, <= 9.16.50 >= 9.18.0, < 9.18.49 >= 9.20.0, < 9.20.23 >= 9.21.0, < 9.21.22
CPE cpe:2.3:a:isc:bind:::::-:::* Remediation No remediation found in references.

Change History

15 change records found show changes

Date	Action	Recorded By
Sep 17, 2026	CVE Modified	redhat-SADP
Sep 10, 2026	CVE Modified	redhat-SADP
Sep 1, 2026	CVE Modified	redhat-SADP
Aug 27, 2026	CVE Modified	redhat-SADP
Aug 27, 2026	CVE Modified	[email protected]
Aug 25, 2026	CVE Modified	redhat-SADP
Aug 20, 2026	CVE Modified	redhat-SADP
Aug 17, 2026	CVE Modified	redhat-SADP
Jul 24, 2026	CVE Translated	[email protected]
Jul 15, 2026	CVE Modified	redhat-SADP
Jun 30, 2026	CVE Modified	redhat-SADP
Jun 17, 2026	CVE Modified	CISA-ADP
Jun 17, 2026	CVE Modified	[email protected]
May 21, 2026	Initial Analysis	[email protected]
May 20, 2026	New CVE Received	[email protected]