BIND 9 Vulnerabilities Expose DNS Resolvers and Authoritative Servers to Remote Attacks

ISC has published a new set of BIND 9 security advisories that affect DNS resolvers and, in some cases, authoritative name servers. The flaws can allow remote attackers to crash named, exhaust server resources, or trigger memory corruption in specific configurations.

The issues appear in ISC’s updated BIND 9 Software Vulnerability Matrix, which helps DNS operators map CVEs to affected BIND branches. The May 20, 2026 update includes six newly listed vulnerabilities that administrators should review immediately.

The most urgent step is patching. ISC released fixed versions for supported BIND branches, including 9.18.49, 9.20.23, and 9.21.22, depending on the vulnerability and the branch in use. Operators should also avoid end-of-life BIND versions, since ISC does not test or patch obsolete releases in the same way it supports current branches.

What the New BIND 9 Vulnerabilities Affect

The new advisory set covers several parts of BIND 9, including DNS-over-HTTPS handling, resolver retry logic, SIG(0) validation, non-IN class query handling, glue record processing, and GSS-API TKEY negotiation.

That matters because BIND can sit in different roles. A recursive resolver handles lookups for users and applications, while an authoritative server answers for specific domains. Some vulnerabilities mainly affect resolvers, while others can affect both roles.

ISC says it is not aware of active exploits for the newly disclosed flaws. However, DNS servers are high-value infrastructure, so exposed systems should not wait for public exploitation before applying fixes.

CVE	Main issue	Primary impact	Severity
CVE-2026-3593	Use-after-free in DNS-over-HTTPS	Memory corruption through crafted HTTP/2 traffic	High
CVE-2026-5950	Unbounded resend loop in resolver logic	Resource exhaustion	Medium
CVE-2026-5947	SIG(0) validation race condition during a query flood	Undefined behavior and service instability	High
CVE-2026-5946	Invalid handling of DNS classes other than IN	named termination and denial of service	High
CVE-2026-3592	Self-pointed glue record amplification	Resolver resource consumption	Medium
CVE-2026-3039	GSS-API TKEY memory exhaustion	Memory leak leading to denial of service	High

DNS-over-HTTPS Deployments Face a Memory Corruption Risk

The DNS-over-HTTPS issue is one of the more serious flaws in this batch. The CVE-2026-3593 advisory says crafted HTTP/2 traffic sent to a BIND DNS-over-HTTPS endpoint can trigger memory corruption.

The flaw affects BIND 9.20.0 through 9.20.22, BIND 9.21.0 through 9.21.21, and the 9.20 Supported Preview Edition branch through 9.20.22-S1. ISC says BIND 9.18 releases are not affected by this specific issue.

Organizations that do not use BIND’s DNS-over-HTTPS feature should not be affected by this vulnerability. ISC also lists disabling DNS-over-HTTPS as an effective workaround, but the safer long-term answer is upgrading to a fixed version.

Resolvers Can Be Hit by Resource Exhaustion Bugs

Several of the new issues focus on recursive resolver behavior. In a DNS outage, the immediate business impact can be wide because applications, authentication systems, email, VPN access, and web services all depend on name resolution.

The CVE-2026-5950 advisory describes an unbounded resend loop in the BIND resolver state machine during bad-server handling. A remote unauthenticated attacker can send queries that trigger retry conditions and cause severe resource exhaustion.

Another resolver-focused flaw, CVE-2026-3592, involves self-pointed glue records. ISC says a resolver that queries a specially crafted zone can consume disproportionate bandwidth while trying to resolve the name, and TCP impairment may also appear.

Some Flaws Affect Both Resolvers and Authoritative Servers

Not every flaw is limited to recursive DNS. ISC says CVE-2026-5946 can affect both authoritative servers and resolvers. The bug involves DNS messages whose class is not Internet, such as CHAOS or HESIOD, and can cause assertion failures in named.

Administrators can reduce exposure by avoiding zones outside the IN class and by keeping DNS Dynamic Update away from the general internet. That workaround does not replace patching, but it can lower risk in environments that cannot upgrade immediately.

The CVE-2026-5947 advisory covers a SIG(0) validation race condition that may lead to undefined behavior when the recursive-clients limit is reached during a query flood. The issue is tied to a brief window where validation may read a DNS message after it has been discarded.

Kerberos and Active Directory DNS Environments Need Attention

One flaw deserves special attention in environments that use Kerberos-secured DNS or Active Directory integrated DNS patterns. CVE-2026-3039 affects BIND servers configured to use TKEY-based authentication through GSS-API tokens.

ISC says maliciously constructed packets can cause the server to allocate memory that is not released. With enough traffic, named can eventually fail due to memory exhaustion.

There is no workaround listed for this issue. Organizations that use GSS-API TKEY should treat patching as the main mitigation, especially if DNS services support authentication workflows or integrated directory environments.

Which BIND Versions Should Be Upgraded

The safest path is to move to the patched release closest to the current branch. For most of the May 2026 advisories, ISC points operators to BIND 9.18.49, 9.20.23, or 9.21.22. For DNS-over-HTTPS memory corruption, the fixed versions are 9.20.23 and 9.21.22.

The BIND vulnerability matrix also warns that end-of-life branches from 9.0 through 9.16 should be treated with caution. ISC says obsolete versions are known to be affected by some vulnerabilities discovered after their end-of-life dates.

Administrators should not rely only on package names or assumptions. They should confirm the running named version, check whether the server is acting as a resolver, authoritative server, or both, and verify whether features such as DNS-over-HTTPS, Dynamic Update, SIG(0), and GSS-API TKEY are enabled.

• Upgrade supported BIND branches to the patched versions recommended by ISC.
• Disable DNS-over-HTTPS if it is not required.
• Restrict recursion to trusted clients only.
• Do not expose Dynamic Update to the public internet.
• Review whether non-IN class zones are configured.
• Check whether GSS-API TKEY is enabled in Kerberos-secured DNS deployments.
• Monitor named crashes, memory growth, query floods, and unusual resolver bandwidth use.

Why DNS Operators Should Patch Quickly

DNS software often runs quietly in the background until it fails. That makes BIND vulnerabilities easy to underestimate, but a resolver outage can break login flows, cloud workloads, internal apps, endpoint management, and customer-facing services.

Attackers do not always need code execution to cause damage. A reliable denial-of-service condition against a resolver or authoritative server can still disrupt operations, hide other activity, or create pressure during a larger incident.

The practical response is clear: identify exposed BIND systems, map them to the affected branches, apply the patched releases, and reduce unnecessary DNS features. DNS infrastructure should be treated as critical infrastructure, not as a system that can wait for the next maintenance window.

FAQ