Every CVE Search/ Get API key

CVE-2026-3592

Amplification vulnerabilities via self-pointed glue records

5.3 MediumFix available

BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.41%Up 0.4 points since May 21, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.3

Amplification vulnerabilities via self-pointed glue records

BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

Record
CVE-2026-3592
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-408
Updated
2026-11-02
EUVDEUVD-2026-31106 5.3

BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

Record
EUVD-2026-31106
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-63mj-2fw3-4w3h 5.3

BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a...

BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

Record
GHSA-63mj-2fw3-4w3h
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-408
Updated
2026-11-02
NVD 5.3

BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

Record
CVE-2026-3592
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-408
Updated
2026-11-02
OSVALPINE-CVE-2026-3592 5.3

BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

Record
ALPINE-CVE-2026-3592
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVBELL-CVE-2026-3592 5.3
Record
BELL-CVE-2026-3592
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 27 moreShow less
OSV 5.3

BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

Record
CVE-2026-3592
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVDEBIAN-CVE-2026-3592 5.3

BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

Record
DEBIAN-CVE-2026-3592
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2026-2600 7.5

bind security update

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly.

Security Fix(es):

BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets. Typically these servers will be found in Active Directory integrated DNS deployments and/or Kerberos-secured DNS environments. This issue affects BIND 9 versions 9.0.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.9.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.(CVE-2026-3039)

BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.(CVE-2026-3592)

Multiple flaws have been identified in named related to the handling of DNS messages whose CLASS is not Internet (IN) — for example, CHAOS or HESIOD, or DNS messages that specify meta-classes (ANY or NONE) in the question section. Specially crafted requests reaching the affected code paths — recursion, dynamic updates (UPDATE), zone change notifications (NOTIFY), or processing of IN-specific record types in non-IN data — can cause assertion failures in named. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.(CVE-2026-5946)

Record
OESA-2026-2600
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-2601 7.5

bind security update

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly.

Security Fix(es):

BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets. Typically these servers will be found in Active Directory integrated DNS deployments and/or Kerberos-secured DNS environments. This issue affects BIND 9 versions 9.0.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.9.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.(CVE-2026-3039)

BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.(CVE-2026-3592)

Multiple flaws have been identified in named related to the handling of DNS messages whose CLASS is not Internet (IN) — for example, CHAOS or HESIOD, or DNS messages that specify meta-classes (ANY or NONE) in the question section. Specially crafted requests reaching the affected code paths — recursion, dynamic updates (UPDATE), zone change notifications (NOTIFY), or processing of IN-specific record types in non-IN data — can cause assertion failures in named. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.(CVE-2026-5946)

Record
OESA-2026-2601
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-2655 7.5

bind security update

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly.

Security Fix(es):

BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets. Typically these servers will be found in Active Directory integrated DNS deployments and/or Kerberos-secured DNS environments. This issue affects BIND 9 versions 9.0.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.9.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.(CVE-2026-3039)

BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.(CVE-2026-3592)

Multiple flaws have been identified in named related to the handling of DNS messages whose CLASS is not Internet (IN) — for example, CHAOS or HESIOD, or DNS messages that specify meta-classes (ANY or NONE) in the question section. Specially crafted requests reaching the affected code paths — recursion, dynamic updates (UPDATE), zone change notifications (NOTIFY), or processing of IN-specific record types in non-IN data — can cause assertion failures in named. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.(CVE-2026-5946)

Record
OESA-2026-2655
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-2656 7.5

bind security update

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly.

Security Fix(es):

BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets. Typically these servers will be found in Active Directory integrated DNS deployments and/or Kerberos-secured DNS environments. This issue affects BIND 9 versions 9.0.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.9.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.(CVE-2026-3039)

BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.(CVE-2026-3592)

Multiple flaws have been identified in named related to the handling of DNS messages whose CLASS is not Internet (IN) — for example, CHAOS or HESIOD, or DNS messages that specify meta-classes (ANY or NONE) in the question section. Specially crafted requests reaching the affected code paths — recursion, dynamic updates (UPDATE), zone change notifications (NOTIFY), or processing of IN-specific record types in non-IN data — can cause assertion failures in named. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.(CVE-2026-5946)

Record
OESA-2026-2656
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-2759 5.3

dhcp security update

The Dynamic Host Configuration Protocol (DHCP) is a network management protocol used on UDP/IP networks whereby a DHCP server dynamically assigns an IP address and other network configuration parameters to each device on a network so they can communicate with other IP networks.

Security Fix(es):

BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.(CVE-2026-3592)

Record
OESA-2026-2759
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHSA-2026:20334 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:20334
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-3592 5.3

BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

Record
UBUNTU-CVE-2026-3592
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVAZL-87090 No score

CVE-2026-3592 affecting package bind for versions less than 9.20.23-1

BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

Record
AZL-87090
Updated
2026-11-02
OSVCLSA-2026-1780406442 No score

bind: Fix of 2 CVEs

  • CVE-2026-5950: fix unbounded resend loop in resolver bad-server handling
  • CVE-2026-3592: limit addresses returned per ADB find and dedup resolver SLIST to mitigate resource-exhaustion amplification
Record
CLSA-2026-1780406442
Updated
2026-11-02
OSVCLSA-2026-1780475528 No score

bind: Fix of 3 CVEs

  • CVE-2026-3592: limit per-ADB-find address count and deduplicate addresses across find lists in the resolver SLIST to mitigate amplification via self-pointed glue records
Record
CLSA-2026-1780475528
Updated
2026-11-02
OSVCLSA-2026-1780475769 No score

bind: Fix of 3 CVEs

  • CVE-2026-3592: limit per-ADB-find address count and deduplicate addresses across find lists in the resolver SLIST to mitigate amplification via self-pointed glue records
Record
CLSA-2026-1780475769
Updated
2026-11-02
OSVCLSA-2026-1780514354 No score

bind: Fix of CVE-2026-3592

  • CVE-2026-3592: limit per-ADB-find address count and deduplicate addresses across find lists in the resolver SLIST to mitigate amplification via self-pointed glue records
Record
CLSA-2026-1780514354
Updated
2026-11-02
OSVCLSA-2026-1780593591 No score

bind: Fix of 3 CVEs

  • CVE-2026-3592: limit per-ADB-find address count and deduplicate addresses across find lists in the resolver SLIST to mitigate amplification via self-pointed glue records
Record
CLSA-2026-1780593591
Updated
2026-11-02
OSVMGASA-2026-0163 No score

Updated bind packages fix security vulnerabilities

Updated bind package fixes security vulnerabilities:

  • BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039)
  • Amplification vulnerabilities via self-pointed glue records (CVE-2026-3592)
  • Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation (CVE-2026-3593)
  • Invalid handling of CLASS != IN (CVE-2026-5946)
  • SIG(0) validation during query flood may lead to undefined behavior (CVE-2026-5947) *Unbounded resend loop in BIND 9 resolver (CVE-2026-5950)
Record
MGASA-2026-0163
Updated
2026-11-02
OSVopenSUSE-SU-2026:10874-1 No score

bind-9.20.23-1.1 on GA media

These are all security issues fixed in the bind-9.20.23-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10874-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21123-1 No score

Security update for bind

This update for bind fixes the following issues

Upgrade to release 9.20.23:

  • CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (bsc#1265591).
  • CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records (bsc#1265592).
  • CVE-2026-3593: Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation (bsc#1265593).
  • CVE-2026-5946: Invalid handling of CLASS != IN (bsc#1265594).
  • CVE-2026-5947: SIG(0) validation during query flood may lead to undefined behavior (bsc#1265595).
  • CVE-2026-5950: Unbounded resend loop in BIND 9 resolver (bsc#1265596).
Record
openSUSE-SU-2026:21123-1
Updated
2026-11-02
OSVSUSE-SU-2026:22198-1 No score

Security update for bind

This update for bind fixes the following issues

Upgrade to release 9.20.23:

  • CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (bsc#1265591).
  • CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records (bsc#1265592).
  • CVE-2026-3593: Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation (bsc#1265593).
  • CVE-2026-5946: Invalid handling of CLASS != IN (bsc#1265594).
  • CVE-2026-5947: SIG(0) validation during query flood may lead to undefined behavior (bsc#1265595).
  • CVE-2026-5950: Unbounded resend loop in BIND 9 resolver (bsc#1265596).
Record
SUSE-SU-2026:22198-1
Updated
2026-11-02
OSVSUSE-SU-2026:2289-1 No score

Security update for bind

This update for bind fixes the following issues:

  • CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (bsc#1265591).
  • CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records (bsc#1265592).
  • CVE-2026-5946: Invalid handling of CLASS != IN (bsc#1265594).
Record
SUSE-SU-2026:2289-1
Updated
2026-11-02
OSVSUSE-SU-2026:2616-1 No score

Security update for bind

This update for bind fixes the following issues:

  • CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records (bsc#1265592).
  • CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (bsc#1265591).
  • CVE-2026-5946: Invalid handling of CLASS != IN (bsc#1265594).
Record
SUSE-SU-2026:2616-1
Updated
2026-11-02
OSVSUSE-SU-2026:2617-1 No score

Security update for bind

This update for bind fixes the following issues:

  • CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records (bsc#1265592).
  • CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (bsc#1265591).
  • CVE-2026-5946: Invalid handling of CLASS != IN (bsc#1265594).
Record
SUSE-SU-2026:2617-1
Updated
2026-11-02
OSVSUSE-SU-2026:2673-1 No score

Security update for bind

This update for bind fixes the following issues:

Security issues:

  • CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (bsc#1265591).
  • CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records (bsc#1265592).
  • CVE-2026-3593: Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation (bsc#1265593).
  • CVE-2026-5946: Invalid handling of CLASS != IN (bsc#1265594).
  • CVE-2026-5947: SIG(0) validation during query flood may lead to undefined behavior (bsc#1265595).
  • CVE-2026-5950: Unbounded resend loop in BIND 9 resolver (bsc#1265596).

Non security issue:

  • bind test failed with version 9.20.21 (bsc#1263494).
  • Upgrade to release 9.20.23
Record
SUSE-SU-2026:2673-1
Updated
2026-11-02
OSVSUSE-SU-2026:2676-1 No score

Security update for bind

This update for bind fixes the following issues

  • CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (bsc#1265591).
  • CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records (bsc#1265592).
  • CVE-2026-5946: Invalid handling of CLASS != IN (bsc#1265594).
  • CVE-2026-5950: Unbounded resend loop in BIND 9 resolver (bsc#1265596).
  • CVE-2026-3593: Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation (bsc#1265593).

Changes for bind:

  • Update to release 9.18.49
Record
SUSE-SU-2026:2676-1
Updated
2026-11-02
OSVSUSE-SU-2026:2779-1 No score

Security update for bind

This update for bind fixes the following issues:

  • CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (bsc#1265591).
  • CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records (bsc#1265592).
  • CVE-2026-5946: Invalid handling of CLASS != IN (bsc#1265594).
Record
SUSE-SU-2026:2779-1
Updated
2026-11-02
OSVSUSE-SU-2026:3517-1 No score

Security update for bind

This update for bind fixes the following issues:

  • CVE-2022-3094: UPDATE message flood may cause named to exhaust all available memory (bsc#1207471).
  • CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (bsc#1265591).
  • CVE-2026-3592: amplification vulnerabilities via self-pointed glue records (bsc#1265592).
  • CVE-2026-5946: invalid handling of CLASS != IN (bsc#1265594).
  • CVE-2026-10723: incorrect acceptance of NSEC3 records (bsc#1271982).
  • CVE-2026-11331: potential wildcard CNAME RPZ policy bypass (bsc#1271984).
  • CVE-2026-11622: potential memory usage beyond configured limits (bsc#1271986).
  • CVE-2026-11721: cache poisoning possible with label count discrepancy, RRSIG, and wildcards (bsc#1271987).
  • CVE-2026-13204: unexpected exit in certain situations with NSEC and NSEC3 both present (bsc#1271989).
  • CVE-2026-13321: DNSSEC validation bypass via out-of-zone NSEC Next field (bsc#1271990).
Record
SUSE-SU-2026:3517-1
Updated
2026-11-02
OSVUSN-8682-1 No score

bind9 vulnerabilities

Vitaly Simonovich discovered that Bind could exhaust memory during GSS-API TKEY negotiation. A remote attacker could possibly use this issue to cause Bind to use excessive resources, leading to a denial of service. (CVE-2026-3039)

Shuhan Zhang discovered that Bind incorrectly handled self-pointed glue records. A remote attacker could possibly use this issue to use Bind in denial of service amplification attacks against other systems. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-3592)

It was discovered that Bind incorrectly handled DNS messages whose class was not IN. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-5946)

Record
USN-8682-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
bind
Alpine:v3.20
 9.11.0 up to 9.18.49-r0
9.18.49-r0
bind
Alpine:v3.21
 9.11.0 up to 9.18.49-r0
9.18.49-r0
bind
Alpine:v3.22
 9.11.0 up to 9.20.23-r0
9.20.23-r0
bind
Alpine:v3.23
 9.11.0 up to 9.20.23-r0
9.20.23-r0
bind
Alpine:v3.24
 9.11.0 up to 9.20.23-r0
9.20.23-r0
bind
Azure Linux:3
 before 9.20.23-1
9.20.23-1
bind
Alpaquita:23
 9.18.11-r0 up to 9.18.49-r0
9.18.49-r0
bind
Alpaquita:25
 9.20.9-r0 up to 9.20.23-r0
9.20.23-r0
bind
Alpaquita:stream
 9.18.16-r0 up to 9.20.23-r0
9.20.23-r0
bind
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 32:9.16.23-11.el9_2.2.tuxcare.els12
32:9.16.23-11.el9_2.2.tuxcare.els12
Show 127 moreShow less
Affected packages
PackageAffectedFixed
bind-chroot
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 32:9.16.23-11.el9_2.2.tuxcare.els12
32:9.16.23-11.el9_2.2.tuxcare.els12
bind-devel
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 32:9.16.23-11.el9_2.2.tuxcare.els12
32:9.16.23-11.el9_2.2.tuxcare.els12
bind-dnssec-doc
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 32:9.16.23-11.el9_2.2.tuxcare.els12
32:9.16.23-11.el9_2.2.tuxcare.els12
bind-dnssec-utils
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 32:9.16.23-11.el9_2.2.tuxcare.els12
32:9.16.23-11.el9_2.2.tuxcare.els12
bind-doc
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 32:9.16.23-11.el9_2.2.tuxcare.els12
32:9.16.23-11.el9_2.2.tuxcare.els12
bind-libs
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 32:9.16.23-11.el9_2.2.tuxcare.els12
32:9.16.23-11.el9_2.2.tuxcare.els12
bind-license
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 32:9.16.23-11.el9_2.2.tuxcare.els12
32:9.16.23-11.el9_2.2.tuxcare.els12
bind-utils
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 32:9.16.23-11.el9_2.2.tuxcare.els12
32:9.16.23-11.el9_2.2.tuxcare.els12
python3-bind
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 32:9.16.23-11.el9_2.2.tuxcare.els12
32:9.16.23-11.el9_2.2.tuxcare.els12
bind
TuxCare:CentOS-Stream:8
 before 32:9.11.36-13.el8.tuxcare.els9
32:9.11.36-13.el8.tuxcare.els9
bind-chroot
TuxCare:CentOS-Stream:8
 before 32:9.11.36-13.el8.tuxcare.els9
32:9.11.36-13.el8.tuxcare.els9
bind-devel
TuxCare:CentOS-Stream:8
 before 32:9.11.36-13.el8.tuxcare.els9
32:9.11.36-13.el8.tuxcare.els9
bind-export-devel
TuxCare:CentOS-Stream:8
 before 32:9.11.36-13.el8.tuxcare.els9
32:9.11.36-13.el8.tuxcare.els9
bind-export-libs
TuxCare:CentOS-Stream:8
 before 32:9.11.36-13.el8.tuxcare.els9
32:9.11.36-13.el8.tuxcare.els9
bind-libs
TuxCare:CentOS-Stream:8
 before 32:9.11.36-13.el8.tuxcare.els9
32:9.11.36-13.el8.tuxcare.els9
bind-libs-lite
TuxCare:CentOS-Stream:8
 before 32:9.11.36-13.el8.tuxcare.els9
32:9.11.36-13.el8.tuxcare.els9
bind-license
TuxCare:CentOS-Stream:8
 before 32:9.11.36-13.el8.tuxcare.els9
32:9.11.36-13.el8.tuxcare.els9
bind-lite-devel
TuxCare:CentOS-Stream:8
 before 32:9.11.36-13.el8.tuxcare.els9
32:9.11.36-13.el8.tuxcare.els9
bind-pkcs11
TuxCare:CentOS-Stream:8
 before 32:9.11.36-13.el8.tuxcare.els9
32:9.11.36-13.el8.tuxcare.els9
bind-pkcs11-devel
TuxCare:CentOS-Stream:8
 before 32:9.11.36-13.el8.tuxcare.els9
32:9.11.36-13.el8.tuxcare.els9
bind-pkcs11-libs
TuxCare:CentOS-Stream:8
 before 32:9.11.36-13.el8.tuxcare.els9
32:9.11.36-13.el8.tuxcare.els9
bind-pkcs11-utils
TuxCare:CentOS-Stream:8
 before 32:9.11.36-13.el8.tuxcare.els9
32:9.11.36-13.el8.tuxcare.els9
bind-sdb
TuxCare:CentOS-Stream:8
 before 32:9.11.36-13.el8.tuxcare.els9
32:9.11.36-13.el8.tuxcare.els9
bind-sdb-chroot
TuxCare:CentOS-Stream:8
 before 32:9.11.36-13.el8.tuxcare.els9
32:9.11.36-13.el8.tuxcare.els9
bind-utils
TuxCare:CentOS-Stream:8
 before 32:9.11.36-13.el8.tuxcare.els9
32:9.11.36-13.el8.tuxcare.els9
python3-bind
TuxCare:CentOS-Stream:8
 before 32:9.11.36-13.el8.tuxcare.els9
32:9.11.36-13.el8.tuxcare.els9
bind
TuxCare:CentOS:8.5
 before 32:9.11.26-6.el8.tuxcare.els15
32:9.11.26-6.el8.tuxcare.els15
bind-chroot
TuxCare:CentOS:8.5
 before 32:9.11.26-6.el8.tuxcare.els15
32:9.11.26-6.el8.tuxcare.els15
bind-devel
TuxCare:CentOS:8.5
 before 32:9.11.26-6.el8.tuxcare.els15
32:9.11.26-6.el8.tuxcare.els15
bind-export-devel
TuxCare:CentOS:8.5
 before 32:9.11.26-6.el8.tuxcare.els15
32:9.11.26-6.el8.tuxcare.els15
bind-export-libs
TuxCare:CentOS:8.5
 before 32:9.11.26-6.el8.tuxcare.els15
32:9.11.26-6.el8.tuxcare.els15
bind-libs
TuxCare:CentOS:8.5
 before 32:9.11.26-6.el8.tuxcare.els15
32:9.11.26-6.el8.tuxcare.els15
bind-libs-lite
TuxCare:CentOS:8.5
 before 32:9.11.26-6.el8.tuxcare.els15
32:9.11.26-6.el8.tuxcare.els15
bind-license
TuxCare:CentOS:8.5
 before 32:9.11.26-6.el8.tuxcare.els15
32:9.11.26-6.el8.tuxcare.els15
bind-lite-devel
TuxCare:CentOS:8.5
 before 32:9.11.26-6.el8.tuxcare.els15
32:9.11.26-6.el8.tuxcare.els15
bind-pkcs11
TuxCare:CentOS:8.5
 before 32:9.11.26-6.el8.tuxcare.els15
32:9.11.26-6.el8.tuxcare.els15
bind-pkcs11-devel
TuxCare:CentOS:8.5
 before 32:9.11.26-6.el8.tuxcare.els15
32:9.11.26-6.el8.tuxcare.els15
bind-pkcs11-libs
TuxCare:CentOS:8.5
 before 32:9.11.26-6.el8.tuxcare.els15
32:9.11.26-6.el8.tuxcare.els15
bind-pkcs11-utils
TuxCare:CentOS:8.5
 before 32:9.11.26-6.el8.tuxcare.els15
32:9.11.26-6.el8.tuxcare.els15
bind-sdb
TuxCare:CentOS:8.5
 before 32:9.11.26-6.el8.tuxcare.els15
32:9.11.26-6.el8.tuxcare.els15
bind-sdb-chroot
TuxCare:CentOS:8.5
 before 32:9.11.26-6.el8.tuxcare.els15
32:9.11.26-6.el8.tuxcare.els15
bind-utils
TuxCare:CentOS:8.5
 before 32:9.11.26-6.el8.tuxcare.els15
32:9.11.26-6.el8.tuxcare.els15
python3-bind
TuxCare:CentOS:8.5
 before 32:9.11.26-6.el8.tuxcare.els15
32:9.11.26-6.el8.tuxcare.els15
bind
TuxCare:CentOS:8.4
 before 32:9.11.26-4.el8.4.tuxcare.els16
32:9.11.26-4.el8.4.tuxcare.els16
bind-chroot
TuxCare:CentOS:8.4
 before 32:9.11.26-4.el8.4.tuxcare.els16
32:9.11.26-4.el8.4.tuxcare.els16
bind-devel
TuxCare:CentOS:8.4
 before 32:9.11.26-4.el8.4.tuxcare.els16
32:9.11.26-4.el8.4.tuxcare.els16
bind-export-devel
TuxCare:CentOS:8.4
 before 32:9.11.26-4.el8.4.tuxcare.els16
32:9.11.26-4.el8.4.tuxcare.els16
bind-export-libs
TuxCare:CentOS:8.4
 before 32:9.11.26-4.el8.4.tuxcare.els16
32:9.11.26-4.el8.4.tuxcare.els16
bind-libs
TuxCare:CentOS:8.4
 before 32:9.11.26-4.el8.4.tuxcare.els16
32:9.11.26-4.el8.4.tuxcare.els16
bind-libs-lite
TuxCare:CentOS:8.4
 before 32:9.11.26-4.el8.4.tuxcare.els16
32:9.11.26-4.el8.4.tuxcare.els16
bind-license
TuxCare:CentOS:8.4
 before 32:9.11.26-4.el8.4.tuxcare.els16
32:9.11.26-4.el8.4.tuxcare.els16
bind-lite-devel
TuxCare:CentOS:8.4
 before 32:9.11.26-4.el8.4.tuxcare.els16
32:9.11.26-4.el8.4.tuxcare.els16
bind-pkcs11
TuxCare:CentOS:8.4
 before 32:9.11.26-4.el8.4.tuxcare.els16
32:9.11.26-4.el8.4.tuxcare.els16
bind-pkcs11-devel
TuxCare:CentOS:8.4
 before 32:9.11.26-4.el8.4.tuxcare.els16
32:9.11.26-4.el8.4.tuxcare.els16
bind-pkcs11-libs
TuxCare:CentOS:8.4
 before 32:9.11.26-4.el8.4.tuxcare.els16
32:9.11.26-4.el8.4.tuxcare.els16
bind-pkcs11-utils
TuxCare:CentOS:8.4
 before 32:9.11.26-4.el8.4.tuxcare.els16
32:9.11.26-4.el8.4.tuxcare.els16
bind-sdb
TuxCare:CentOS:8.4
 before 32:9.11.26-4.el8.4.tuxcare.els16
32:9.11.26-4.el8.4.tuxcare.els16
bind-sdb-chroot
TuxCare:CentOS:8.4
 before 32:9.11.26-4.el8.4.tuxcare.els16
32:9.11.26-4.el8.4.tuxcare.els16
bind-utils
TuxCare:CentOS:8.4
 before 32:9.11.26-4.el8.4.tuxcare.els16
32:9.11.26-4.el8.4.tuxcare.els16
python3-bind
TuxCare:CentOS:8.4
 before 32:9.11.26-4.el8.4.tuxcare.els16
32:9.11.26-4.el8.4.tuxcare.els16
bind
TuxCare:AlmaLinux:9.6
 before 32:9.16.23-31.el9_6.2.tuxcare.els3
32:9.16.23-31.el9_6.2.tuxcare.els3
bind-chroot
TuxCare:AlmaLinux:9.6
 before 32:9.16.23-31.el9_6.2.tuxcare.els3
32:9.16.23-31.el9_6.2.tuxcare.els3
bind-devel
TuxCare:AlmaLinux:9.6
 before 32:9.16.23-31.el9_6.2.tuxcare.els3
32:9.16.23-31.el9_6.2.tuxcare.els3
bind-dnssec-doc
TuxCare:AlmaLinux:9.6
 before 32:9.16.23-31.el9_6.2.tuxcare.els3
32:9.16.23-31.el9_6.2.tuxcare.els3
bind-dnssec-utils
TuxCare:AlmaLinux:9.6
 before 32:9.16.23-31.el9_6.2.tuxcare.els3
32:9.16.23-31.el9_6.2.tuxcare.els3
bind-doc
TuxCare:AlmaLinux:9.6
 before 32:9.16.23-31.el9_6.2.tuxcare.els3
32:9.16.23-31.el9_6.2.tuxcare.els3
bind-libs
TuxCare:AlmaLinux:9.6
 before 32:9.16.23-31.el9_6.2.tuxcare.els3
32:9.16.23-31.el9_6.2.tuxcare.els3
bind-license
TuxCare:AlmaLinux:9.6
 before 32:9.16.23-31.el9_6.2.tuxcare.els3
32:9.16.23-31.el9_6.2.tuxcare.els3
bind-utils
TuxCare:AlmaLinux:9.6
 before 32:9.16.23-31.el9_6.2.tuxcare.els3
32:9.16.23-31.el9_6.2.tuxcare.els3
python3-bind
TuxCare:AlmaLinux:9.6
 before 32:9.16.23-31.el9_6.2.tuxcare.els3
32:9.16.23-31.el9_6.2.tuxcare.els3
bind9
Debian:12
 before 1:9.18.49-1~deb12u2, plus listed versions
1:9.18.12-11:9.18.13-11:9.18.16-11:9.18.16-1~deb12u11:9.18.16-1~deb12u1~bpo11+1
Show 11 moreShow less
1:9.18.19-1~deb12u11:9.18.19-1~deb12u1~bpo11+11:9.18.24-11:9.18.24-1~bpo11+11:9.18.28-1~deb12u11:9.18.28-1~deb12u21:9.18.33-1~deb12u21:9.18.41-1~deb12u11:9.18.44-1~deb12u11:9.18.47-1~deb12u11:9.18.49-1~deb12u1
1:9.18.49-1~deb12u2
bind9
Debian:13
 before 1:9.20.23-1~deb13u1, plus listed versions
1:9.20.11-41:9.20.15-11:9.20.15-1~deb13u11:9.20.15-1~deb13u1~bpo12+11:9.20.15-2
Show 12 moreShow less
1:9.20.18-11:9.20.18-1~deb13u11:9.20.18-1~deb13u1~bpo12+11:9.20.19-11:9.20.19-1~bpo12+11:9.20.20-11:9.20.20-1~bpo12+11:9.20.21-11:9.20.21-1~deb13u11:9.20.21-1~deb13u1~bpo12+11:9.20.22-11:9.20.23-1~deb13u1~bpo12+1
1:9.20.23-1~deb13u1
bind9
Debian:14
 before 1:9.20.23-1, plus listed versions
1:9.20.11-41:9.20.15-11:9.20.15-1~deb13u11:9.20.15-1~deb13u1~bpo12+11:9.20.15-2
Show 13 moreShow less
1:9.20.18-11:9.20.18-1~deb13u11:9.20.18-1~deb13u1~bpo12+11:9.20.19-11:9.20.19-1~bpo12+11:9.20.20-11:9.20.20-1~bpo12+11:9.20.21-11:9.20.21-1~deb13u11:9.20.21-1~deb13u1~bpo12+11:9.20.22-11:9.20.23-1~deb13u11:9.20.23-1~deb13u1~bpo12+1
1:9.20.23-1
bind
Mageia:9
From an advisory covering 6 CVEs
 before 9.18.49-1.mga9
9.18.49-1.mga9
bind
openEuler:24.03-LTS-SP3
From an advisory covering 3 CVEs
 before 9.18.21-9.oe2403sp3
9.18.21-9.oe2403sp3
bind
openEuler:24.03-LTS-SP1
From an advisory covering 3 CVEs
 before 9.18.21-8.oe2403sp1
9.18.21-8.oe2403sp1
bind
openEuler:20.03-LTS-SP4
From an advisory covering 3 CVEs
 before 9.11.21-24.oe2003sp4
9.11.21-24.oe2003sp4
bind
openEuler:22.03-LTS-SP4
From an advisory covering 3 CVEs
 before 9.16.23-30.oe2203sp4
9.16.23-30.oe2203sp4
dhcp
openEuler:20.03-LTS-SP4
 before 4.4.2-17.oe2003sp4
4.4.2-17.oe2003sp4
dhcp
openEuler:22.03-LTS-SP4
 before 4.4.3-12.oe2203sp4
4.4.3-12.oe2203sp4
dhcp
openEuler:24.03-LTS-SP1
 before 4.4.3-13.oe2403sp1
4.4.3-13.oe2403sp1
dhcp
openEuler:24.03-LTS-SP3
 before 4.4.3-14.oe2403sp3
4.4.3-14.oe2403sp3
bind
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:9.18.49-1.hum1
0:9.18.49-1.hum1
bind-chroot
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:9.18.49-1.hum1
0:9.18.49-1.hum1
bind-devel
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:9.18.49-1.hum1
0:9.18.49-1.hum1
bind-dnssec-utils
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:9.18.49-1.hum1
0:9.18.49-1.hum1
bind-doc
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:9.18.49-1.hum1
0:9.18.49-1.hum1
bind-libs
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:9.18.49-1.hum1
0:9.18.49-1.hum1
bind-utils
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:9.18.49-1.hum1
0:9.18.49-1.hum1
bind
SUSE:Linux Enterprise Server 16.0
From an advisory covering 6 CVEs
 before 9.20.23-160000.1.1
9.20.23-160000.1.1
bind
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 6 CVEs
 before 9.20.23-160000.1.1
9.20.23-160000.1.1
bind
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 3 CVEs
 before 9.16.50-150500.8.38.1
9.16.50-150500.8.38.1
bind
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 3 CVEs
 before 9.16.50-150500.8.38.1
9.16.50-150500.8.38.1
bind
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 3 CVEs
 before 9.16.50-150500.8.38.1
9.16.50-150500.8.38.1
bind
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 3 CVEs
 before 9.16.50-150500.8.38.1
9.16.50-150500.8.38.1
bind
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 3 CVEs
 before 9.16.50-150500.8.38.1
9.16.50-150500.8.38.1
bind
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 3 CVEs
 before 9.16.50-150400.5.62.1
9.16.50-150400.5.62.1
bind
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 3 CVEs
 before 9.16.50-150400.5.62.1
9.16.50-150400.5.62.1
bind
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 3 CVEs
 before 9.16.50-150400.5.62.1
9.16.50-150400.5.62.1
bind
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 3 CVEs
 before 9.16.50-150400.5.62.1
9.16.50-150400.5.62.1
bind
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 6 CVEs
 before 9.20.23-150700.3.25.1
9.20.23-150700.3.25.1
bind
SUSE:Linux Enterprise Module for Server Applications 15 SP7
From an advisory covering 6 CVEs
 before 9.20.23-150700.3.25.1
9.20.23-150700.3.25.1
bind
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 5 CVEs
 before 9.18.49-150600.3.26.1
9.18.49-150600.3.26.1
bind
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 5 CVEs
 before 9.18.49-150600.3.26.1
9.18.49-150600.3.26.1
bind
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 3 CVEs
 before 9.16.6-150300.22.59.1
9.16.6-150300.22.59.1
bind
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 3 CVEs
 before 9.16.6-150300.22.59.1
9.16.6-150300.22.59.1
bind
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 3 CVEs
 before 9.16.6-150300.22.59.1
9.16.6-150300.22.59.1
bind
SUSE:Multi Linux Manager Tools SLE-Micro-5
From an advisory covering 10 CVEs
 before 9.16.6-150000.12.91.1
9.16.6-150000.12.91.1
bind
SUSE:Manager Client Tools for SLE Micro 5
From an advisory covering 10 CVEs
 before 9.16.6-150000.12.91.1
9.16.6-150000.12.91.1
bind9
Ubuntu:Pro:18.04:LTS
 before 1:9.11.3+dfsg-1ubuntu1.19+esm5, plus listed versions
1:9.10.3.dfsg.P4-12.6ubuntu11:9.11.2.P1-1ubuntu21:9.11.2.P1-1ubuntu31:9.11.2.P1-1ubuntu41:9.11.2.P1-1ubuntu5
Show 21 moreShow less
1:9.11.3+dfsg-1ubuntu11:9.11.3+dfsg-1ubuntu1.11:9.11.3+dfsg-1ubuntu1.21:9.11.3+dfsg-1ubuntu1.31:9.11.3+dfsg-1ubuntu1.51:9.11.3+dfsg-1ubuntu1.71:9.11.3+dfsg-1ubuntu1.81:9.11.3+dfsg-1ubuntu1.91:9.11.3+dfsg-1ubuntu1.101:9.11.3+dfsg-1ubuntu1.111:9.11.3+dfsg-1ubuntu1.121:9.11.3+dfsg-1ubuntu1.131:9.11.3+dfsg-1ubuntu1.141:9.11.3+dfsg-1ubuntu1.151:9.11.3+dfsg-1ubuntu1.161:9.11.3+dfsg-1ubuntu1.171:9.11.3+dfsg-1ubuntu1.181:9.11.3+dfsg-1ubuntu1.19+esm11:9.11.3+dfsg-1ubuntu1.19+esm21:9.11.3+dfsg-1ubuntu1.19+esm31:9.11.3+dfsg-1ubuntu1.19+esm4
1:9.11.3+dfsg-1ubuntu1.19+esm5
isc-dhcp
Ubuntu:18.04:LTS
 All versions, plus listed versions
4.3.5-3ubuntu24.3.5-3ubuntu34.3.5-3ubuntu44.3.5-3ubuntu54.3.5-3ubuntu6
Show 5 moreShow less
4.3.5-3ubuntu74.3.5-3ubuntu7.14.3.5-3ubuntu7.24.3.5-3ubuntu7.34.3.5-3ubuntu7.4
 None known
bind9
Ubuntu:Pro:20.04:LTS
 before 1:9.18.30-0ubuntu0.20.04.2+esm2, plus listed versions
1:9.11.5.P4+dfsg-5.1ubuntu21:9.11.5.P4+dfsg-5.1ubuntu31:9.11.5.P4+dfsg-5.1ubuntu41:9.11.5.P4+dfsg-5.1ubuntu51:9.11.14+dfsg-1ubuntu1
Show 25 moreShow less
1:9.11.14+dfsg-3ubuntu11:9.16.0-1ubuntu31:9.16.0-1ubuntu41:9.16.0-1ubuntu51:9.16.1-0ubuntu11:9.16.1-0ubuntu21:9.16.1-0ubuntu2.11:9.16.1-0ubuntu2.21:9.16.1-0ubuntu2.31:9.16.1-0ubuntu2.41:9.16.1-0ubuntu2.61:9.16.1-0ubuntu2.71:9.16.1-0ubuntu2.81:9.16.1-0ubuntu2.91:9.16.1-0ubuntu2.101:9.16.1-0ubuntu2.111:9.16.1-0ubuntu2.121:9.16.1-0ubuntu2.141:9.16.1-0ubuntu2.151:9.16.1-0ubuntu2.161:9.16.48-0ubuntu0.20.04.11:9.18.28-0ubuntu0.20.04.11:9.18.30-0ubuntu0.20.04.11:9.18.30-0ubuntu0.20.04.21:9.18.30-0ubuntu0.20.04.2+esm1
1:9.18.30-0ubuntu0.20.04.2+esm2
bind9-libs
Ubuntu:20.04:LTS
 All versions, plus listed versions
1:9.11.16+dfsg-3~build11:9.11.16+dfsg-3~ubuntu1
 None known
bind9
Ubuntu:22.04:LTS
 before 1:9.18.39-0ubuntu0.22.04.4, plus listed versions
1:9.16.15-1ubuntu11:9.16.15-1ubuntu21:9.16.15-1ubuntu31:9.18.0-2ubuntu11:9.18.0-2ubuntu2
Show 17 moreShow less
1:9.18.0-2ubuntu31:9.18.1-1ubuntu11:9.18.1-1ubuntu1.11:9.18.1-1ubuntu1.21:9.18.1-1ubuntu1.31:9.18.12-0ubuntu0.22.04.11:9.18.12-0ubuntu0.22.04.21:9.18.12-0ubuntu0.22.04.31:9.18.18-0ubuntu0.22.04.11:9.18.18-0ubuntu0.22.04.21:9.18.24-0ubuntu0.22.04.11:9.18.28-0ubuntu0.22.04.11:9.18.30-0ubuntu0.22.04.11:9.18.30-0ubuntu0.22.04.21:9.18.39-0ubuntu0.22.04.11:9.18.39-0ubuntu0.22.04.21:9.18.39-0ubuntu0.22.04.3
1:9.18.39-0ubuntu0.22.04.4
bind9-libs
Ubuntu:22.04:LTS
 All versions, plus listed versions
1:9.11.19+dfsg-2.1ubuntu11:9.11.19+dfsg-2.1ubuntu21:9.11.19+dfsg-2.1ubuntu3
 None known
bind9
Ubuntu:24.04:LTS
 before 1:9.18.39-0ubuntu0.24.04.5, plus listed versions
1:9.18.18-0ubuntu21:9.18.21-0ubuntu11:9.18.24-0ubuntu31:9.18.24-0ubuntu41:9.18.24-0ubuntu5
Show 6 moreShow less
1:9.18.28-0ubuntu0.24.04.11:9.18.30-0ubuntu0.24.04.11:9.18.30-0ubuntu0.24.04.21:9.18.39-0ubuntu0.24.04.11:9.18.39-0ubuntu0.24.04.21:9.18.39-0ubuntu0.24.04.3
1:9.18.39-0ubuntu0.24.04.5
isc-dhcp
Ubuntu:24.04:LTS
 All versions, plus listed versions
4.4.3-P1-2ubuntu54.4.3-P1-4ubuntu14.4.3-P1-4ubuntu2
 None known
bind9
Ubuntu:25.10
 before 1:9.20.11-1ubuntu2.4, plus listed versions
1:9.20.4-3ubuntu11:9.20.4-3ubuntu21:9.20.4-3ubuntu31:9.20.9-2ubuntu11:9.20.10-1ubuntu1
Show 4 moreShow less
1:9.20.11-1ubuntu11:9.20.11-1ubuntu21:9.20.11-1ubuntu2.11:9.20.11-1ubuntu2.2
1:9.20.11-1ubuntu2.4
isc-dhcp
Ubuntu:25.10
 All versions, plus listed versions
4.4.3-P1-4ubuntu2
 None known
bind9
Ubuntu:26.04:LTS
 before 1:9.20.18-1ubuntu2.1, plus listed versions
1:9.20.11-1ubuntu21:9.20.11-1ubuntu31:9.20.18-1ubuntu11:9.20.18-1ubuntu2
1:9.20.18-1ubuntu2.1
isc-dhcp
Ubuntu:26.04:LTS
 All versions, plus listed versions
4.4.3-P1-4ubuntu2
 None known
bind9
Ubuntu:Pro:14.04:LTS
From an advisory covering 3 CVEs
 before 1:9.9.5.dfsg-3ubuntu0.19+esm14, plus listed versions
1:9.9.3.dfsg.P2-4ubuntu11:9.9.3.dfsg.P2-4ubuntu21:9.9.3.dfsg.P2-4ubuntu31:9.9.5.dfsg-21:9.9.5.dfsg-3
Show 31 moreShow less
1:9.9.5.dfsg-3ubuntu0.11:9.9.5.dfsg-3ubuntu0.21:9.9.5.dfsg-3ubuntu0.31:9.9.5.dfsg-3ubuntu0.41:9.9.5.dfsg-3ubuntu0.51:9.9.5.dfsg-3ubuntu0.61:9.9.5.dfsg-3ubuntu0.71:9.9.5.dfsg-3ubuntu0.81:9.9.5.dfsg-3ubuntu0.91:9.9.5.dfsg-3ubuntu0.101:9.9.5.dfsg-3ubuntu0.111:9.9.5.dfsg-3ubuntu0.121:9.9.5.dfsg-3ubuntu0.131:9.9.5.dfsg-3ubuntu0.141:9.9.5.dfsg-3ubuntu0.151:9.9.5.dfsg-3ubuntu0.161:9.9.5.dfsg-3ubuntu0.171:9.9.5.dfsg-3ubuntu0.181:9.9.5.dfsg-3ubuntu0.191:9.9.5.dfsg-3ubuntu0.19+esm11:9.9.5.dfsg-3ubuntu0.19+esm21:9.9.5.dfsg-3ubuntu0.19+esm31:9.9.5.dfsg-3ubuntu0.19+esm41:9.9.5.dfsg-3ubuntu0.19+esm51:9.9.5.dfsg-3ubuntu0.19+esm61:9.9.5.dfsg-3ubuntu0.19+esm71:9.9.5.dfsg-3ubuntu0.19+esm91:9.9.5.dfsg-3ubuntu0.19+esm101:9.9.5.dfsg-3ubuntu0.19+esm111:9.9.5.dfsg-3ubuntu0.19+esm121:9.9.5.dfsg-3ubuntu0.19+esm13
1:9.9.5.dfsg-3ubuntu0.19+esm14
bind9
Ubuntu:Pro:16.04:LTS
From an advisory covering 3 CVEs
 before 1:9.10.3.dfsg.P4-8ubuntu1.19+esm10, plus listed versions
1:9.9.5.dfsg-11ubuntu11:9.9.5.dfsg-121:9.9.5.dfsg-12.11:9.9.5.dfsg-12.1ubuntu11:9.10.3.dfsg.P2-4
Show 32 moreShow less
1:9.10.3.dfsg.P2-51:9.10.3.dfsg.P4-31:9.10.3.dfsg.P4-41:9.10.3.dfsg.P4-51:9.10.3.dfsg.P4-81:9.10.3.dfsg.P4-8ubuntu11:9.10.3.dfsg.P4-8ubuntu1.11:9.10.3.dfsg.P4-8ubuntu1.21:9.10.3.dfsg.P4-8ubuntu1.31:9.10.3.dfsg.P4-8ubuntu1.41:9.10.3.dfsg.P4-8ubuntu1.51:9.10.3.dfsg.P4-8ubuntu1.61:9.10.3.dfsg.P4-8ubuntu1.71:9.10.3.dfsg.P4-8ubuntu1.81:9.10.3.dfsg.P4-8ubuntu1.91:9.10.3.dfsg.P4-8ubuntu1.101:9.10.3.dfsg.P4-8ubuntu1.111:9.10.3.dfsg.P4-8ubuntu1.121:9.10.3.dfsg.P4-8ubuntu1.141:9.10.3.dfsg.P4-8ubuntu1.151:9.10.3.dfsg.P4-8ubuntu1.161:9.10.3.dfsg.P4-8ubuntu1.171:9.10.3.dfsg.P4-8ubuntu1.181:9.10.3.dfsg.P4-8ubuntu1.191:9.10.3.dfsg.P4-8ubuntu1.19+esm11:9.10.3.dfsg.P4-8ubuntu1.19+esm21:9.10.3.dfsg.P4-8ubuntu1.19+esm31:9.10.3.dfsg.P4-8ubuntu1.19+esm51:9.10.3.dfsg.P4-8ubuntu1.19+esm61:9.10.3.dfsg.P4-8ubuntu1.19+esm71:9.10.3.dfsg.P4-8ubuntu1.19+esm81:9.10.3.dfsg.P4-8ubuntu1.19+esm9
1:9.10.3.dfsg.P4-8ubuntu1.19+esm10
bind9
Ubuntu:Pro:18.04:LTS
From an advisory covering 3 CVEs
 before 1:9.11.3+dfsg-1ubuntu1.19+esm5, plus listed versions
1:9.10.3.dfsg.P4-12.6ubuntu11:9.11.2.P1-1ubuntu21:9.11.2.P1-1ubuntu31:9.11.2.P1-1ubuntu41:9.11.2.P1-1ubuntu5
Show 21 moreShow less
1:9.11.3+dfsg-1ubuntu11:9.11.3+dfsg-1ubuntu1.11:9.11.3+dfsg-1ubuntu1.21:9.11.3+dfsg-1ubuntu1.31:9.11.3+dfsg-1ubuntu1.51:9.11.3+dfsg-1ubuntu1.71:9.11.3+dfsg-1ubuntu1.81:9.11.3+dfsg-1ubuntu1.91:9.11.3+dfsg-1ubuntu1.101:9.11.3+dfsg-1ubuntu1.111:9.11.3+dfsg-1ubuntu1.121:9.11.3+dfsg-1ubuntu1.131:9.11.3+dfsg-1ubuntu1.141:9.11.3+dfsg-1ubuntu1.151:9.11.3+dfsg-1ubuntu1.161:9.11.3+dfsg-1ubuntu1.171:9.11.3+dfsg-1ubuntu1.181:9.11.3+dfsg-1ubuntu1.19+esm11:9.11.3+dfsg-1ubuntu1.19+esm21:9.11.3+dfsg-1ubuntu1.19+esm31:9.11.3+dfsg-1ubuntu1.19+esm4
1:9.11.3+dfsg-1ubuntu1.19+esm5
bind9
Ubuntu:Pro:20.04:LTS
From an advisory covering 3 CVEs
 before 1:9.18.30-0ubuntu0.20.04.2+esm2, plus listed versions
1:9.11.5.P4+dfsg-5.1ubuntu21:9.11.5.P4+dfsg-5.1ubuntu31:9.11.5.P4+dfsg-5.1ubuntu41:9.11.5.P4+dfsg-5.1ubuntu51:9.11.14+dfsg-1ubuntu1
Show 25 moreShow less
1:9.11.14+dfsg-3ubuntu11:9.16.0-1ubuntu31:9.16.0-1ubuntu41:9.16.0-1ubuntu51:9.16.1-0ubuntu11:9.16.1-0ubuntu21:9.16.1-0ubuntu2.11:9.16.1-0ubuntu2.21:9.16.1-0ubuntu2.31:9.16.1-0ubuntu2.41:9.16.1-0ubuntu2.61:9.16.1-0ubuntu2.71:9.16.1-0ubuntu2.81:9.16.1-0ubuntu2.91:9.16.1-0ubuntu2.101:9.16.1-0ubuntu2.111:9.16.1-0ubuntu2.121:9.16.1-0ubuntu2.141:9.16.1-0ubuntu2.151:9.16.1-0ubuntu2.161:9.16.48-0ubuntu0.20.04.11:9.18.28-0ubuntu0.20.04.11:9.18.30-0ubuntu0.20.04.11:9.18.30-0ubuntu0.20.04.21:9.18.30-0ubuntu0.20.04.2+esm1
1:9.18.30-0ubuntu0.20.04.2+esm2
bind
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 9.20.23-1.1
9.20.23-1.1
bind
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 9.20.23-160000.1.1
9.20.23-160000.1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-3592 is a medium vulnerability (CVSS 5.3) in Isc Bind, published May 20, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in bind 9.18.49-r0.

References

Show 75 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open