Loading story…
Internet Systems Consortium (ISC) disclosed four vulnerabilities in BIND 9 affecting supported releases and Supported Preview Edition builds, including CVE-2026-1519, CVE-2026-3104, CVE-2026-3119, and CVE-2026-3591. The flaws impact DNSSEC validation and proof generation, authenticated queries containing TKEY records, and SIG(0) handling. Reported consequences include excessive CPU consumption during insecure delegation validation, a memory leak while preparing DNSSEC proofs, unexpected termination of the named daemon, and a stack use-after-return condition that could allow an ACL bypass.
Affected branches include BIND 9.11, 9.18, 9.20, and 9.21 across specified version ranges, and ISC said the public disclosure ended the embargo period so prepared packages could be released. Patched versions were issued as 9.18.47, 9.20.21, and 9.21.20, and the Canadian Centre for Cyber Security urged administrators to review ISC’s advisories and apply the required updates.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On 2026-04-01, Belgium's Centre for Cybersecurity Belgium (CCB) published an advisory warning about the ISC BIND 9 DNS vulnerabilities and urging organizations to patch immediately. The notice represents another downstream national CERT/government response following ISC's March 25 disclosure and fixes.
On 2026-03-31, F5 published product advisory K000160559 regarding BIND vulnerability CVE-2026-3104. This represents a downstream vendor response identifying impact and/or remediation guidance for F5 customers.
On 2026-03-29, Microsoft published a Security Update Guide entry for CVE-2026-3104, the BIND vulnerability involving a memory leak in DNSSEC proof preparation. This represents a separate downstream vendor advisory acknowledging the flaw and providing Microsoft-specific tracking or remediation information.
On 2026-03-27, Debian published security advisory DSA 6181-1 announcing a bind9 security update to address the recently disclosed ISC BIND 9 vulnerabilities. The advisory reflects downstream package remediation for Debian users following ISC's upstream fixes.
On 2026-03-25, the Canadian Centre for Cyber Security published advisory AV26-280 summarizing the newly disclosed ISC BIND vulnerabilities and their impact on supported BIND 9 branches and Supported Preview Edition builds. The agency urged administrators to review ISC's advisories and apply the required updates.
On 2026-03-25, Internet Systems Consortium publicly disclosed four vulnerabilities in BIND 9—CVE-2026-1519, CVE-2026-3104, CVE-2026-3119, and CVE-2026-3591—affecting DNSSEC validation, proof generation, TKEY query handling, and SIG(0) handling. ISC released fixed versions 9.18.47, 9.20.21, and 9.21.20 and said the public announcement ended the embargo period for prepared packages.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
ccb.belgium.be
Open sourcemy.f5.com
Open sourcemsrc.microsoft.com
Open sourcelists.debian.org
Open sourcekb.isc.org
Open sourcekb.isc.org
Open sourcekb.isc.org
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Internet Systems Consortium (ISC) disclosed six vulnerabilities in **BIND 9** and released patched versions `9.18.49`, `9.20.23`, and `9.21.22`. The issues include **CVE-2026-3039**, a high-severity memory-exhaustion flaw during GSS-API TKEY negotiation that can crash `named`; **CVE-2026-3593**, a high-severity heap use-after-free in the DNS-over-HTTPS implementation triggered by crafted HTTP/2 traffic; **CVE-2026-3592**, an amplification issue involving self-pointed glue records that can drive disproportionate bandwidth and resource consumption; **CVE-2026-5947**, a race condition in SIG(0) validation under query-flood conditions that can lead to undefined behavior and process crashes; plus additional flaws involving invalid handling of `CLASS != IN` and an unbounded resend loop in the resolver. ISC said the vulnerabilities are remotely exploitable in affected configurations, with the most serious impacts centered on denial of service, memory corruption, and resolver abuse rather than confirmed code execution. Exposure depends on feature use: the GSS-API issue is especially relevant to Active Directory-integrated or Kerberos-secured DNS deployments, while the DoH flaw affects only servers with DNS-over-HTTPS enabled and can be mitigated by disabling that feature until upgrades are applied. ISC reported no known active exploitation at disclosure time, said no workaround is known for several of the bugs, and credited external researchers including Vitaly Simonovich, Naoki Wakamatsu, Naresh Kandula Parmar, and Shuhan Zhang for reporting the flaws.
Jun 29, 2026
ISC released security advisories addressing several high-severity vulnerabilities in *BIND 9* DNS software, affecting versions 9.11.x, 9.16.x, 9.18.x, 9.20.x, and 9.21.x. These flaws could allow attackers to conduct cache poisoning and denial of service (DoS) attacks, potentially disrupting DNS resolution and compromising the integrity of DNS responses. The vulnerabilities are tracked as CVE-2025-8677, CVE-2025-40778, and CVE-2025-40780, and have been rated as critical due to their potential impact on DNS infrastructure. Administrators are strongly advised to review the official advisories and apply the necessary patches to affected BIND 9 deployments. The Canadian Centre for Cyber Security and other security organizations have issued alerts urging immediate action to mitigate the risk of exploitation. Failure to update could expose organizations to significant operational and security risks, including service outages and the possibility of malicious redirection of network traffic.
Jun 29, 2026
**ISC disclosed a high-severity denial-of-service vulnerability in BIND 9** tracked as **CVE-2025-13878**, where remote attackers can crash the `named` daemon by sending specially crafted DNS traffic that triggers improper handling of malformed **BRID** and **HHIT** record data structures. The issue is remotely exploitable (no authentication or user interaction required) and is scored **CVSS 3.1: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)**, making publicly exposed DNS infrastructure a primary risk. The flaw affects both **authoritative name servers and DNS resolvers**, enabling an attacker to force a service outage by causing `named` to terminate unexpectedly. Reported affected versions include **BIND 9.18.40–9.18.43**, **9.20.13–9.20.17**, and **9.21.12–9.21.16**, with fixes available in **9.18.44**, **9.20.18**, and **9.21.17** (and corresponding *SPE* preview builds). The vulnerability was reported by **Vlatko Kosturjak (Marlink Cyber)**, and ISC issued early notification ahead of public disclosure, urging administrators to verify deployed versions and apply patched releases to prevent remote crash/DoS conditions.
Jun 29, 2026