CVE-2026-3039: isc bind
Vulnerability summary
CVE-2026-3039 is a high (CVSS 7.5) vulnerability in isc bind. EPSS estimates a 1.05% chance of exploitation in the next 30 days, higher than 63.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 22 · Related 11Timeline
- 20-05-2026PublishedVulnerability first disclosed.
- 17-09-2026Last modifiedVulnerability information updated.
Description
BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets. Typically these servers will be found in Active Directory integrated DNS deployments and/or Kerberos-secured DNS environments. This issue affects BIND 9 versions 9.0.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.9.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.05%
Chance of exploitation in the next 30 days
Percentile
64%
Versus all other CVEs
30-day change
0.00 pp
From 1.05% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-771Missing Reference to Active Allocated ResourceThe product does not properly maintain a reference to a resource that has been allocated, which prevents the resource from being reclaimed.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Isc2 products
Ubuntu2 products
- bind9< 1:9.9.5.dfsg-3ubuntu0.19+esm14 | < 1:9.10.3.dfsg.P4-8ubuntu1.19+esm10 | < 1:9.11.3+dfsg-1ubuntu1.19+esm5 | < 1:9.18.30-0ubuntu0.20.04.2+esm2 | < 1:9.18.39-0ubuntu0.22.04.4 | < 1:9.18.39-0ubuntu0.24.04.5 | < 1:9.20.11-1ubuntu2.4 | < 1:9.20.18-1ubuntu2.1
- bind9-libsAll versions (No fix recorded)
Alpine1 product
- bind≥ 9.0.0, < 9.18.49-r0 | ≥ 9.0.0, < 9.20.23-r0
Debian1 product
- bind9< 1:9.18.49-1~deb12u2 | < 1:9.20.23-1~deb13u1 | < 1:9.20.23-1
4 vendors · 6 products
