Critical Memory Exhaustion and Denial of Service Vulnerabilities in bind9.18
Summary
ALSA-2026:24368: Important: bind9.18 security update. Affects bind9.18 versions < 32:9.18.29-14.el9_8.2. Fixed in 32:9.18.29-14.el9_8.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used implementation of the DNS (Domain Name System) protocols. It includes a DNS server (named), a resolver library for applications interfacing with DNS, and various tools for DNS server verification. BIND is crucial for translating hostnames into IP addresses, making it a fundamental component of internet infrastructure. The recent vulnerabilities in bind9.18 highlight significant security risks that could affect the stability and reliability of DNS services.
Vulnerability Detail
The vulnerabilities identified in bind9.18 include a memory exhaustion issue during GSS-API TKEY negotiation (CVE-2026-3039) and a Denial of Service (DoS) vulnerability caused by specially crafted DNS messages (CVE-2026-5946). These vulnerabilities can lead to service interruptions, allowing attackers to exploit the DNS server's resources, potentially causing it to crash or become unresponsive. The impact of these vulnerabilities can be severe, affecting not only the targeted server but also the broader network services relying on DNS resolution.
How To Fix
Minimum fixed version
32:9.18.29-14.el9_8.2
This is the first release that contains the fix.
sudo dnf update bind9.18Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, administrators can limit the exposure of the DNS server to untrusted networks or implement rate limiting on incoming DNS requests to mitigate the risk of exploitation until the patch is applied.
Conclusion
The vulnerabilities in bind9.18 pose significant risks to DNS services, with potential for memory exhaustion and Denial of Service attacks. It is crucial to update to the patched version to mitigate these risks and ensure the stability of your network services.
See every vulnerability recorded for bind9.18 →
FAQ
The vulnerabilities involve memory exhaustion during GSS-API TKEY negotiation and Denial of Service via specially crafted DNS messages.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By checking your manifest file like package-lock.json, you can identify if your application is affected.
Exploitation of these vulnerabilities can lead to service interruptions, crashes, and unresponsiveness of the DNS server, impacting network services reliant on DNS.
Yes, the patched version of bind9.18 is 32:9.18.29-14.el9_8.2. Updating to this version will resolve the vulnerabilities.
As a workaround, limit the exposure of your DNS server to untrusted networks and consider implementing rate limiting on incoming DNS requests.
Related vulnerabilities
Recent vulnerabilities recorded for bind9.18.
