BIND 9 servers configured for TKEY-based authentication using GSS-API tokens are vulnerable to excessive memory consumption when processing specially crafted packets. This flaw, tracked as CVE-2026-3039 and associated with CWE-771 and CWE-770, can be exploited remotely without authentication or user interaction to cause a denial of service by exhausting server memory resources. The vulnerability affects multiple BIND 9 version ranges including 9.0.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and several S1 variants. Red Hat has published advisories and released patched packages for Red Hat Enterprise Linux 10 and related products. Mitigation options are limited; disabling or removing TKEY-GSSAPI configuration lines is suggested as a workaround.

Exploitation of this vulnerability allows a remote attacker to cause excessive memory consumption on affected BIND 9 servers, resulting in denial of service. There is no impact on confidentiality or integrity, but availability is significantly affected. This can disrupt DNS resolution services in environments using TKEY-based GSS-API authentication, commonly found in Active Directory integrated DNS or Kerberos-secured DNS deployments.

A security update addressing this vulnerability is available from Red Hat for affected BIND 9 versions as part of Red Hat Enterprise Linux 10 updates. Users should apply these official patches promptly. If patching is not immediately possible, a mitigation is to disable or remove TKEY-GSSAPI-related configuration lines (e.g., 'tkey-gssapi-keytab' or 'tkey-gssapi-credential') in the named.conf file and reload the named service, noting this may cause brief DNS resolution interruptions. No other mitigations meeting Red Hat's criteria are currently available.