Critical Security Update for BIND Package: Memory Exhaustion and Denial of Service Vulnerabilities
Summary
ALSA-2026:24338: Important: bind security update. Affects bind versions < 32:9.18.33-15.el10_2.2. Fixed in 32:9.18.33-15.el10_2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Berkeley Internet Name Domain (BIND) is a widely used implementation of the Domain Name System (DNS) protocols. It includes a DNS server (named), a resolver library for applications interfacing with DNS, and various tools for DNS server verification. BIND is essential for translating human-readable domain names into IP addresses, making it a critical component of internet infrastructure. However, vulnerabilities in BIND can lead to severe security risks, including service disruptions and unauthorized access.
Vulnerability Detail
This vulnerability arises from two critical issues in BIND 9: memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039) and a Denial of Service (DoS) attack via specially crafted DNS messages (CVE-2026-5946). These vulnerabilities can allow attackers to exploit the DNS server, potentially leading to service outages and unauthorized access to sensitive information. The technical implications include excessive memory consumption and the server's inability to process legitimate requests, resulting in a complete service disruption.
How To Fix
Minimum fixed version
32:9.18.33-15.el10_2.2
This is the first release that contains the fix.
sudo dnf update bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing rate limiting on DNS requests or using firewall rules to block suspicious traffic patterns until the package can be updated.
Conclusion
In summary, the vulnerabilities in the BIND package pose significant risks to DNS services, including memory exhaustion and Denial of Service attacks. It is crucial to update to the patched version to mitigate these risks. Temporary workarounds can be implemented while awaiting updates. Regular monitoring for vulnerabilities using tools like Vulert can help maintain security.
See every vulnerability recorded for bind →
FAQ
BIND is an implementation of the Domain Name System (DNS) protocols, providing essential services for translating domain names into IP addresses.
The vulnerabilities can lead to memory exhaustion and Denial of Service attacks, causing service disruptions and potential unauthorized access to sensitive data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, consider implementing rate limiting on DNS requests or using firewall rules to mitigate potential attacks.
For more details, refer to the CVE pages: CVE-2026-3039 and CVE-2026-5946.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
