Critical Memory Exhaustion and Denial of Service Vulnerabilities in bind9.18
Summary
RLSA-2026:24368: Important: bind9.18 security update. Affects bind9.18 versions < 2:9.18.29-14.el9_8.2. Fixed in 2:9.18.29-14.el9_8.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used implementation of the DNS (Domain Name System) protocols. It includes a DNS server (named), which resolves host names to IP addresses, a resolver library for applications interfacing with DNS, and various tools for server verification. The package bind9.18 is a specific version used in Rocky Linux 9, which is crucial for maintaining DNS services. However, it has been found to have vulnerabilities that could lead to significant service disruptions.
Vulnerability Detail
The vulnerabilities identified in bind9.18 include a memory exhaustion issue during GSS-API TKEY negotiation (CVE-2026-3039) and a Denial of Service (DoS) risk via specially crafted DNS messages (CVE-2026-5946). These vulnerabilities can be exploited by attackers to exhaust server resources or disrupt DNS services, potentially leading to downtime and loss of accessibility for users relying on DNS resolution.
How To Fix
Minimum fixed version
2:9.18.29-14.el9_8.2
This is the first release that contains the fix.
sudo dnf update bind9.18Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you may consider limiting access to the DNS server or implementing rate limiting to mitigate the impact of potential attacks until the package can be updated.
Conclusion
The vulnerabilities in bind9.18 pose significant risks to DNS services, including memory exhaustion and Denial of Service. It is crucial to update to the latest patched version to mitigate these risks. Users should also consider monitoring their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for bind9.18 →
FAQ
The CVSS score for the vulnerabilities in bind9.18 is 7.5, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerabilities can lead to memory exhaustion and Denial of Service, causing service disruptions and making DNS resolution unavailable for users.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If immediate updates are not possible, consider implementing access controls or rate limiting to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for bind9.18.
