Critical Security Flaw in BIND Package: Memory Exhaustion and Denial of Service Vulnerabilities
Summary
ALSA-2026:24367: Important: bind security update. Affects bind versions < 32:9.16.23-40.el9_8.2. Fixed in 32:9.16.23-40.el9_8.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Berkeley Internet Name Domain (BIND) is a widely used implementation of the Domain Name System (DNS) protocols. It includes a DNS server (named), a resolver library for application interfacing, and various tools for DNS server verification. BIND is critical for the functioning of the internet, as it translates domain names into IP addresses, enabling users to access websites and services. However, vulnerabilities in BIND can lead to severe security risks, including service interruptions and unauthorized access.
Vulnerability Detail
This vulnerability arises from two significant issues in BIND 9: memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039) and a Denial of Service (DoS) condition triggered by specially crafted DNS messages (CVE-2026-5946). The memory exhaustion flaw can lead to server crashes, while the DoS vulnerability can be exploited to disrupt DNS services, affecting all users relying on the affected server. These vulnerabilities can be exploited remotely, making them particularly dangerous.
How To Fix
Minimum fixed version
32:9.16.23-40.el9_8.2
This is the first release that contains the fix.
sudo dnf update bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit access to the DNS server by implementing firewall rules that restrict incoming traffic to trusted IP addresses. Additionally, monitoring server logs for unusual activity can help mitigate potential exploitation until the package is updated.
Conclusion
The vulnerabilities in the BIND package pose significant risks to DNS services, potentially leading to service disruptions and unauthorized access. It is crucial for users to update their packages to the latest patched versions to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for bind →
FAQ
BIND is an implementation of the DNS protocols, providing essential services for translating domain names into IP addresses.
The vulnerabilities include memory exhaustion during GSS-API TKEY negotiation and Denial of Service via specially crafted DNS messages.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of these vulnerabilities can lead to server crashes, service interruptions, and potential unauthorized access to sensitive data.
It is recommended to regularly check for updates and apply them promptly to ensure your system is protected against known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
