Critical Memory Exhaustion and Denial of Service Vulnerabilities in BIND Package
Summary
RLSA-2026:24338: Important: bind security update. Affects bind versions < 2:9.18.33-15.el10_2.2. Fixed in 2:9.18.33-15.el10_2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Berkeley Internet Name Domain (BIND) is a widely used implementation of the Domain Name System (DNS) protocols. It includes a DNS server (named), a resolver library for application interfacing, and tools for verifying DNS server functionality. BIND is essential for translating domain names into IP addresses, making it a critical component of internet infrastructure. However, recent vulnerabilities have been identified that could compromise its stability and security.
Vulnerability Detail
Two significant vulnerabilities have been discovered in the BIND package. The first, identified as CVE-2026-3039, involves a memory exhaustion issue during GSS-API TKEY negotiation, which could lead to service disruption. The second vulnerability, CVE-2026-5946, allows for a Denial of Service (DoS) attack through specially crafted DNS messages. Both vulnerabilities could severely impact the availability of DNS services, leading to potential downtime and loss of service for users.
How To Fix
Minimum fixed version
2:9.18.33-15.el10_2.2
This is the first release that contains the fix.
sudo dnf update bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the BIND server by configuring firewall rules to limit incoming DNS requests. This can help reduce the risk of exploitation until the package is updated. Example command to block external access:
sudo iptables -A INPUT -p udp --dport 53 -s <trusted_ip> -j ACCEPT' followed by 'sudo iptables -A INPUT -p udp --dport 53 -j DROP'.
Conclusion
In summary, the BIND package has critical vulnerabilities that could lead to significant service disruptions. It is essential to update to the latest patched version to mitigate these risks. Additionally, implementing temporary workarounds can help protect against potential exploitation until updates are applied.
See every vulnerability recorded for bind →
FAQ
BIND stands for Berkeley Internet Name Domain and is a software that implements the DNS protocols for the internet.
The vulnerabilities can lead to memory exhaustion and Denial of Service attacks, potentially causing downtime for DNS services.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for these vulnerabilities is 7.5, indicating a high severity level.
It is recommended to regularly check for updates and apply them promptly to ensure security and stability.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
