Critical Memory Exhaustion and Denial of Service Vulnerability in BIND Package
Summary
ALSA-2026:24339: Important: bind security update. Affects bind versions < 32:9.11.36-16.el8_10.8. Fixed in 32:9.11.36-16.el8_10.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Berkeley Internet Name Domain (BIND) is a widely used implementation of the Domain Name System (DNS) protocols. It includes a DNS server (named), a resolver library for applications, and various tools for DNS server verification. BIND is critical for the functioning of internet services, making its security paramount.
Vulnerability Detail
This vulnerability arises from memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039) and a Denial of Service (DoS) condition caused by specially crafted DNS messages (CVE-2026-5946). Attackers can exploit these vulnerabilities to disrupt DNS services, leading to potential downtime and service unavailability for users relying on DNS for internet access.
How To Fix
Minimum fixed version
32:9.11.36-16.el8_10.8
This is the first release that contains the fix.
sudo dnf update bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider implementing rate limiting on DNS queries to mitigate the impact of potential attacks until the package can be updated.
Conclusion
The BIND package has critical vulnerabilities that can lead to memory exhaustion and denial of service. It is essential to update to the latest patched version to secure your systems. Utilize tools like Vulert to monitor for vulnerabilities in real-time and ensure your applications remain secure.
See every vulnerability recorded for bind →
FAQ
BIND is an open-source software that implements the DNS protocols, allowing for domain name resolution and management.
The risks include service disruption, potential downtime, and the possibility of unauthorized access to DNS services.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, implementing rate limiting on DNS queries can help mitigate the risk until the patch is applied.
If immediate updates are not possible, ensure to monitor your DNS traffic closely and apply any available security measures to minimize exposure.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
