Critical Memory Exhaustion and Denial of Service Vulnerabilities in BIND Package
Summary
RLSA-2026:24339: Important: bind security update. Affects bind versions < 2:9.11.36-16.el8_10.8. Fixed in 2:9.11.36-16.el8_10.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Berkeley Internet Name Domain (BIND) is a widely used implementation of the Domain Name System (DNS) protocols. It includes a DNS server (named), a resolver library for applications interfacing with DNS, and tools for verifying DNS server operations. BIND is crucial for translating human-readable domain names into IP addresses, making it a fundamental component of internet functionality. However, its complexity also makes it susceptible to various security vulnerabilities.
Vulnerability Detail
This vulnerability arises from two critical issues in the BIND 9 server. The first, identified as CVE-2026-3039, involves memory exhaustion during GSS-API TKEY negotiation, which can lead to service disruption. The second, CVE-2026-5946, allows for a Denial of Service (DoS) attack via specially crafted DNS messages. Both vulnerabilities can severely impact the availability of DNS services, leading to potential downtime and loss of access to critical resources.
How To Fix
Minimum fixed version
2:9.11.36-16.el8_10.8
This is the first release that contains the fix.
sudo dnf update bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the DNS server or implement rate limiting on incoming DNS requests to mitigate the risk of exploitation until the package is updated.
Conclusion
In summary, the BIND package is critical for DNS functionality but is currently affected by significant vulnerabilities that could lead to service disruptions. Updating to the latest patched version is crucial for maintaining security and service availability.
See every vulnerability recorded for bind →
FAQ
BIND stands for Berkeley Internet Name Domain and is a software suite that implements the Domain Name System (DNS) protocols.
Exploitation of these vulnerabilities can lead to memory exhaustion and Denial of Service, causing significant downtime for DNS services.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
It is recommended to regularly check for updates and apply them promptly to ensure your system is secure against known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
