Loading story…
Internet Systems Consortium (ISC) disclosed six vulnerabilities in BIND 9 and released patched versions 9.18.49, 9.20.23, and 9.21.22. The issues include CVE-2026-3039, a high-severity memory-exhaustion flaw during GSS-API TKEY negotiation that can crash named; CVE-2026-3593, a high-severity heap use-after-free in the DNS-over-HTTPS implementation triggered by crafted HTTP/2 traffic; CVE-2026-3592, an amplification issue involving self-pointed glue records that can drive disproportionate bandwidth and resource consumption; CVE-2026-5947, a race condition in SIG(0) validation under query-flood conditions that can lead to undefined behavior and process crashes; plus additional flaws involving invalid handling of CLASS != IN and an unbounded resend loop in the resolver.
ISC said the vulnerabilities are remotely exploitable in affected configurations, with the most serious impacts centered on denial of service, memory corruption, and resolver abuse rather than confirmed code execution. Exposure depends on feature use: the GSS-API issue is especially relevant to Active Directory-integrated or Kerberos-secured DNS deployments, while the DoH flaw affects only servers with DNS-over-HTTPS enabled and can be mitigated by disabling that feature until upgrades are applied. ISC reported no known active exploitation at disclosure time, said no workaround is known for several of the bugs, and credited external researchers including Vitaly Simonovich, Naoki Wakamatsu, Naresh Kandula Parmar, and Shuhan Zhang for reporting the flaws.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Debian issued security advisory DSA 6285-1 for bind9, making distribution-specific security updates available in response to the BIND 9 vulnerabilities disclosed by ISC. This marks downstream packaging and release of fixes for Debian systems.
Alongside the disclosure, ISC released updated BIND 9 versions 9.18.49, 9.20.23, and 9.21.22 to address the newly disclosed vulnerabilities. ISC also stated that prepared software packages could now be released publicly.
ISC publicly disclosed six vulnerabilities affecting BIND 9, including CVE-2026-3039, CVE-2026-3592, CVE-2026-3593, CVE-2026-5946, CVE-2026-5947, and CVE-2026-5950, after the embargo period ended. The issues included denial-of-service, amplification, use-after-free, undefined behavior, and resolver loop conditions.
ISC sent early notifications for at least CVE-2026-5947 and CVE-2026-3593 ahead of public disclosure. The advisories indicate this early notification occurred one week before publication.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityonline.info
Open sourcemsrc.microsoft.com
Open sourcecyber.gc.ca
Open sourcelists.debian.org
Open sourcekb.isc.org
Open sourcekb.isc.org
Open sourcekb.isc.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Internet Systems Consortium (ISC) disclosed four vulnerabilities in **BIND 9** affecting supported releases and Supported Preview Edition builds, including `CVE-2026-1519`, `CVE-2026-3104`, `CVE-2026-3119`, and `CVE-2026-3591`. The flaws impact DNSSEC validation and proof generation, authenticated queries containing `TKEY` records, and `SIG(0)` handling. Reported consequences include excessive CPU consumption during insecure delegation validation, a memory leak while preparing DNSSEC proofs, unexpected termination of the `named` daemon, and a stack use-after-return condition that could allow an ACL bypass. Affected branches include **BIND 9.11, 9.18, 9.20, and 9.21** across specified version ranges, and ISC said the public disclosure ended the embargo period so prepared packages could be released. Patched versions were issued as **9.18.47**, **9.20.21**, and **9.21.20**, and the Canadian Centre for Cyber Security urged administrators to review ISC’s advisories and apply the required updates.
Jun 29, 2026
ISC released security advisories addressing several high-severity vulnerabilities in *BIND 9* DNS software, affecting versions 9.11.x, 9.16.x, 9.18.x, 9.20.x, and 9.21.x. These flaws could allow attackers to conduct cache poisoning and denial of service (DoS) attacks, potentially disrupting DNS resolution and compromising the integrity of DNS responses. The vulnerabilities are tracked as CVE-2025-8677, CVE-2025-40778, and CVE-2025-40780, and have been rated as critical due to their potential impact on DNS infrastructure. Administrators are strongly advised to review the official advisories and apply the necessary patches to affected BIND 9 deployments. The Canadian Centre for Cyber Security and other security organizations have issued alerts urging immediate action to mitigate the risk of exploitation. Failure to update could expose organizations to significant operational and security risks, including service outages and the possibility of malicious redirection of network traffic.
Jun 29, 2026
**ISC disclosed a high-severity denial-of-service vulnerability in BIND 9** tracked as **CVE-2025-13878**, where remote attackers can crash the `named` daemon by sending specially crafted DNS traffic that triggers improper handling of malformed **BRID** and **HHIT** record data structures. The issue is remotely exploitable (no authentication or user interaction required) and is scored **CVSS 3.1: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)**, making publicly exposed DNS infrastructure a primary risk. The flaw affects both **authoritative name servers and DNS resolvers**, enabling an attacker to force a service outage by causing `named` to terminate unexpectedly. Reported affected versions include **BIND 9.18.40–9.18.43**, **9.20.13–9.20.17**, and **9.21.12–9.21.16**, with fixes available in **9.18.44**, **9.20.18**, and **9.21.17** (and corresponding *SPE* preview builds). The vulnerability was reported by **Vlatko Kosturjak (Marlink Cyber)**, and ISC issued early notification ahead of public disclosure, urging administrators to verify deployed versions and apply patched releases to prevent remote crash/DoS conditions.
Jun 29, 2026