Red Hat Security Advisory: bind security update
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039) * bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946) * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321) * bind: bind9: Potential memory usage beyond configured limits (CVE-2026-11622) * bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721) * bind: bind9: Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204) * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
AI Analysis
Technical Summary
CVE-2026-3039 is a denial of service vulnerability in BIND 9.18.49-1.hum1 RPMs used in Red Hat Hardened Images. The flaw allows remote attackers to exhaust server memory by sending malicious packets to BIND servers configured for TKEY-based authentication via GSS-API tokens. This impacts Red Hat deployments using Active Directory or Kerberos for DNS where this authentication is enabled. The vulnerability is tracked under CWE-770 (Allocation of Resources Without Limits or Throttling). Red Hat has not released a patch but recommends disabling the TKEY-based GSS-API authentication as a mitigation.
Potential Impact
The vulnerability can cause excessive memory consumption on affected BIND servers, resulting in denial of service. This disrupts DNS resolution services on impacted Red Hat Hardened Images integrated with Active Directory or Kerberos environments. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild.
Mitigation Recommendations
Red Hat currently does not provide a patch or official fix for this vulnerability. The recommended mitigation is to disable TKEY-based GSS-API authentication by removing or commenting out related configuration lines (e.g., tkey-gssapi-keytab or tkey-gssapi-credential) in /etc/named.conf and then reloading the named service. This mitigation may cause a brief DNS service interruption but prevents exploitation of the memory exhaustion issue.
Red Hat Security Advisory: bind security update
Description
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039) * bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946) * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321) * bind: bind9: Potential memory usage beyond configured limits (CVE-2026-11622) * bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721) * bind: bind9: Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204) * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-3039 is a denial of service vulnerability in BIND 9.18.49-1.hum1 RPMs used in Red Hat Hardened Images. The flaw allows remote attackers to exhaust server memory by sending malicious packets to BIND servers configured for TKEY-based authentication via GSS-API tokens. This impacts Red Hat deployments using Active Directory or Kerberos for DNS where this authentication is enabled. The vulnerability is tracked under CWE-770 (Allocation of Resources Without Limits or Throttling). Red Hat has not released a patch but recommends disabling the TKEY-based GSS-API authentication as a mitigation.
Potential Impact
The vulnerability can cause excessive memory consumption on affected BIND servers, resulting in denial of service. This disrupts DNS resolution services on impacted Red Hat Hardened Images integrated with Active Directory or Kerberos environments. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild.
Mitigation Recommendations
Red Hat currently does not provide a patch or official fix for this vulnerability. The recommended mitigation is to disable TKEY-based GSS-API authentication by removing or commenting out related configuration lines (e.g., tkey-gssapi-keytab or tkey-gssapi-credential) in /etc/named.conf and then reloading the named service. This mitigation may cause a brief DNS service interruption but prevents exploitation of the memory exhaustion issue.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:23360
- Cve Count
- 2
- Additional Cves
- ["CVE-2026-5946"]
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a21eb14e29bf47b50d2381f
Added to database: 06/04/2026, 21:16:04 UTC
Last enriched: 08/16/2026, 17:55:50 UTC
Last updated: 09/12/2026, 13:14:15 UTC
Views: 166
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.