OESA-2026-2656 (CVE-2026-3039)

Vulnerability from osv_openeuler – Published: 2026-06-12 11:11 – Updated: 2026-08-06 11:11 – Source website
VLAI
Summary
bind security update
Details

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly.

Security Fix(es):

BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets. Typically these servers will be found in Active Directory integrated DNS deployments and/or Kerberos-secured DNS environments. This issue affects BIND 9 versions 9.0.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.9.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.(CVE-2026-3039)

BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.(CVE-2026-3592)

Multiple flaws have been identified in named related to the handling of DNS messages whose CLASS is not Internet (IN) — for example, CHAOS or HESIOD, or DNS messages that specify meta-classes (ANY or NONE) in the question section. Specially crafted requests reaching the affected code paths — recursion, dynamic updates (UPDATE), zone change notifications (NOTIFY), or processing of IN-specific record types in non-IN data — can cause assertion failures in named. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.(CVE-2026-5946)

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "bind-9.16.23-30.oe2203sp4.aarch64.rpm",
          "bind-chroot-9.16.23-30.oe2203sp4.aarch64.rpm",
          "bind-debuginfo-9.16.23-30.oe2203sp4.aarch64.rpm",
          "bind-debugsource-9.16.23-30.oe2203sp4.aarch64.rpm",
          "bind-devel-9.16.23-30.oe2203sp4.aarch64.rpm",
          "bind-dnssec-utils-9.16.23-30.oe2203sp4.aarch64.rpm",
          "bind-libs-9.16.23-30.oe2203sp4.aarch64.rpm",
          "bind-pkcs11-9.16.23-30.oe2203sp4.aarch64.rpm",
          "bind-pkcs11-devel-9.16.23-30.oe2203sp4.aarch64.rpm",
          "bind-pkcs11-libs-9.16.23-30.oe2203sp4.aarch64.rpm",
          "bind-pkcs11-utils-9.16.23-30.oe2203sp4.aarch64.rpm",
          "bind-utils-9.16.23-30.oe2203sp4.aarch64.rpm"
        ],
        "noarch": [
          "bind-dnssec-doc-9.16.23-30.oe2203sp4.noarch.rpm",
          "bind-license-9.16.23-30.oe2203sp4.noarch.rpm",
          "python3-bind-9.16.23-30.oe2203sp4.noarch.rpm"
        ],
        "src": [
          "bind-9.16.23-30.oe2203sp4.src.rpm"
        ],
        "x86_64": [
          "bind-9.16.23-30.oe2203sp4.x86_64.rpm",
          "bind-chroot-9.16.23-30.oe2203sp4.x86_64.rpm",
          "bind-debuginfo-9.16.23-30.oe2203sp4.x86_64.rpm",
          "bind-debugsource-9.16.23-30.oe2203sp4.x86_64.rpm",
          "bind-devel-9.16.23-30.oe2203sp4.x86_64.rpm",
          "bind-dnssec-utils-9.16.23-30.oe2203sp4.x86_64.rpm",
          "bind-libs-9.16.23-30.oe2203sp4.x86_64.rpm",
          "bind-pkcs11-9.16.23-30.oe2203sp4.x86_64.rpm",
          "bind-pkcs11-devel-9.16.23-30.oe2203sp4.x86_64.rpm",
          "bind-pkcs11-libs-9.16.23-30.oe2203sp4.x86_64.rpm",
          "bind-pkcs11-utils-9.16.23-30.oe2203sp4.x86_64.rpm",
          "bind-utils-9.16.23-30.oe2203sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP4",
        "name": "bind",
        "purl": "pkg:rpm/openEuler/bind\u0026distro=openEuler-22.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.16.23-30.oe2203sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly.\r\n\r\nSecurity Fix(es):\n\nBIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets.  Typically these servers will be found in Active Directory integrated DNS deployments and/or Kerberos-secured DNS environments.\nThis issue affects BIND 9 versions 9.0.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.9.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.(CVE-2026-3039)\n\nBIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack.  If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources.\nThis issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.(CVE-2026-3592)\n\nMultiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) \u2014 for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section. Specially crafted requests reaching the affected code paths \u2014 recursion, dynamic updates (`UPDATE`), zone change notifications (`NOTIFY`), or processing of `IN`-specific record types in non-`IN` data \u2014 can cause assertion failures in `named`.\nThis issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.(CVE-2026-5946)",
  "id": "OESA-2026-2656",
  "modified": "2026-08-06T11:11:35Z",
  "published": "2026-06-12T11:11:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2656"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3039"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3592"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5946"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "bind security update",
  "upstream": [
    "CVE-2026-3039",
    "CVE-2026-3592",
    "CVE-2026-5946"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.