Brief Summary: BIND 9 CVE-2026-3039 Memory Exhaustion via GSS-API TKEY Negotiation

Introduction

Enterprise DNS infrastructure built on BIND 9 with Active Directory or Kerberos integration is exposed to a remote, unauthenticated denial-of-service attack. The attack exhausts server memory without BIND noticing, until name resolution fails entirely. CVE-2026-3039, disclosed by the Internet Systems Consortium on May 20, 2026, carries a CVSS score of 7.5 and affects a wide range of BIND 9 versions. No workaround is available.

Technical Information

Root Cause: A Leaked Security Context Outside BIND's Memory Accounting

The vulnerability is classified under CWE-771 (Missing Reference to Active Allocated Resource). The problem is in how BIND 9 handles GSS-API TKEY negotiation. During negotiation, the server creates a security context inside the GSS library, and maliciously constructed packets cause that context to leak. The GSS library allocates this memory directly rather than through BIND's own allocator, so BIND's internal memory accounting never sees the leak. BIND cannot tell how much memory the GSS library has consumed, which means it cannot enforce limits or trigger cleanup.

Earlier versions of BIND tried to support multi-round GSS-API negotiation, and that design contributed to the improper state handling behind the leak. Kerberos and SPNEGO, the GSS-API mechanisms used in these environments, complete authentication in a single round. Multi-round support was unnecessary, and it turned out to be dangerous.

Attack Flow

The attack is simple to carry out:

1. The attacker identifies a BIND 9 server configured with GSS-API TKEY authentication. These servers are typically found in Active Directory-integrated DNS deployments or Kerberos-secured DNS environments.
2. The attacker sends repeated, maliciously crafted TKEY queries to the target server over the network. No authentication or special privileges are required.
3. Each malicious TKEY query allocates a GSS-API security context that is never properly freed.
4. The leaked memory resides in the GSS library's address space and bypasses BIND's memory accounting, so the server has no way to detect or limit the growing consumption.
5. Over time, available system memory runs out and the BIND process fails, leaving DNS resolution in a complete denial of service.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms that the attack is network accessible and low complexity, and that it requires no privileges or user interaction. It has a high impact on availability and no effect on confidentiality or integrity.

How the Fix Works

The patched releases make two changes:

1. The server now rejects multi-round GSS-API negotiation. Kerberos and SPNEGO complete in a single round, so refusing multi-round exchanges costs nothing and removes the improper state handling that allowed the context leak.
2. The server now enforces the requirements of RFC 3645. The fix adds a check that was previously missing: the client must verify that the GSS-API mechanism has granted the mutual authentication and integrity flags. This brings the implementation into compliance with the protocol specification and closes the attack surface.

Affected Systems and Versions

The vulnerability affects BIND 9 servers configured to use TKEY-based authentication via GSS-API tokens. The following version ranges are vulnerable:

Patched releases:

Servers that do not use GSS-API TKEY authentication are not affected. The vulnerable configuration is most common in Active Directory-integrated DNS and Kerberos-secured DNS environments.

Vendor Security History

ISC has a well-established record of transparent, professional vulnerability disclosure. For CVE-2026-3039, ISC notified stakeholders early, on May 13, 2026, a full week before the public disclosure and patch release on May 20, 2026. Its advisories consistently include CVSS scoring, detailed impact analysis, affected version matrices, and direct upgrade paths. BIND 9 is the most widely deployed open-source DNS implementation, used by financial institutions, carriers, ISPs, universities, and government agencies worldwide, so ISC's disciplined handling of security communications is essential to the wider internet.

References

• ISC Advisory: CVE-2026-3039
• BIND 9.18.49 Download
• BIND 9.20.23 Download
• BIND 9.21.22 Download
• CWE-771: Missing Reference to Active Allocated Resource
• BIND 9.20 Changelog
• ISC BIND 9 Product Page
• Internet Systems Consortium