CVE-2026-3039 is a vulnerability in ISC BIND 9 where servers using TKEY-based authentication with GSS-API tokens can experience excessive memory consumption when handling specially crafted DNS packets. This vulnerability affects BIND 9 versions 9.0.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and corresponding S1 variants. The flaw is categorized under CWE-771 (Missing Reference to Active Allocated Resource) and CWE-770. It can cause denial of service by exhausting server memory. Red Hat has released security advisories and patches for affected Red Hat Enterprise Linux versions to mitigate this issue.

The vulnerability allows an unauthenticated attacker to cause a denial of service by triggering excessive memory consumption on BIND 9 servers configured with TKEY-based GSS-API authentication. This can disrupt DNS services, particularly in environments integrated with Active Directory or using Kerberos-secured DNS. The CVSS v3.1 base score is 7.5 (High), indicating a significant impact on availability without affecting confidentiality or integrity.

Red Hat has released security updates that fix this vulnerability in their supported BIND packages for Red Hat Enterprise Linux 10 and related variants. Users should apply these official patches as provided in the Red Hat advisories (e.g., RHSA-2026:24338) to remediate the issue. Patch status is confirmed as official-fix by Red Hat. No alternative mitigations are indicated in the vendor advisory.