BIND 9 server memory exhaustion during GSS-API TKEY negotiation

Description

BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets. Typically these servers will be found in Active Directory integrated DNS deployments and/or Kerberos-secured DNS environments. This issue affects BIND 9 versions 9.0.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.9.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

Scores

EPSS (exploitation in 30 days)

1.1% · top 35% of all CVEs (7 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• CWE-771 Missing Reference to Active Allocated Resource (opens in a new tab)All about CWE-771 and its CVEs
• CWE-770: Allocation of Resources Without Limits or Throttling (opens in a new tab)All about CWE-770 and its CVEs

Affected products

• ISC · BIND 9

  • affected 9.0.0 – ≤ 9.16.50
  • affected 9.18.0 – ≤ 9.18.48
  • affected 9.20.0 – ≤ 9.20.22
  • affected 9.21.0 – ≤ 9.21.21
  • affected 9.9.3-S1 – ≤ 9.16.50-S1
  • affected 9.18.11-S1 – ≤ 9.18.48-S1
  • affected 9.20.9-S1 – ≤ 9.20.22-S1

What to do

Solution: Upgrade to the patched release most closely related to your current version of BIND 9: 9.18.49, 9.20.23, 9.21.22, 9.18.49-S1, or 9.20.23-S1.

Workaround: No workarounds known.

Exploitation: We are not aware of any active exploits.

References (18)

• CVE-2026-3039 (opens in a new tab)vendor-advisory
• https://downloads.isc.org/isc/bind9/9.18.49 (opens in a new tab)patch
• https://downloads.isc.org/isc/bind9/9.20.23 (opens in a new tab)patch
• https://downloads.isc.org/isc/bind9/9.21.22 (opens in a new tab)patch
• https://access.redhat.com/security/cve/CVE-2026-3039 (opens in a new tab)vdb-entryx_refsource_REDHAT
• RHBZ#2479767 (opens in a new tab)issue-trackingx_refsource_REDHAT
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3039.json (opens in a new tab)x_sadp-csaf-vex
• https://access.redhat.com/errata/RHSA-2026:60383 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:62549 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:65851 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:24338 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:24339 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:23360 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:57189 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:55441 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:24367 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:24368 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:20334 (opens in a new tab)vendor-advisoryx_refsource_REDHAT

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-3039](https://trackcve.app/badge/CVE-2026-3039.svg)](https://trackcve.app/cve/CVE-2026-3039)

Record last updated 17 Sept 2026, 12:04 UTC.