CVE-2026-3104 is a resource management vulnerability in ISC BIND 9 DNS resolver software. A memory leak occurs due to failure to release resources after their effective lifetime when processing queries for specially crafted domains. This affects multiple BIND 9 version ranges: 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. The vulnerability has a CVSS 3.1 base score of 7.5 (high) with network attack vector, low attack complexity, no privileges or user interaction required, and impacts availability only. Red Hat has issued advisories referencing this CVE, but the provided advisory content does not explicitly confirm the availability of a patch or update for this specific issue.

The vulnerability leads to a memory leak in the BIND resolver, which can degrade system availability by exhausting memory resources. There is no impact on confidentiality or integrity. Exploitation requires sending DNS queries for specially crafted domains, which can be done remotely without authentication or user interaction. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Red Hat advisories reference this CVE but do not explicitly confirm a fix or update addressing it. Users should monitor official ISC and Red Hat advisories for patches or updates. Until a patch is available, consider limiting exposure of vulnerable BIND resolvers to untrusted networks to reduce risk.