Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

bind9.18: Memory Exhaustion and Denial of Service Risks

published 4 months ago

Summary

The BIND DNS server may run out of memory or be forced to stop working if it receives specially crafted messages. This affects the reliability of your DNS server and could disrupt your internet services. To stay secure, update your BIND server to the latest version as soon as possible.

What to do

Update rocky bind9.18 to version 2:9.18.29-14.el9_8.2.

Affected software

Ecosystem	Vendor	Product	Affected versions
Rocky Linux:9	rocky	bind9.18	< 2:9.18.29-14.el9_8.2 Fix: upgrade to 2:9.18.29-14.el9_8.2

Original advisory text

Important: bind9.18 security update

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly.

Security Fix(es):

* bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039)

* bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

https://errata.rockylinux.org/RLSA-2026:24368 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2479767 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2479771 Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Timeline

Published11 Jun 2026

Updated11 Jun 2026

First seen11 Jun 2026

Sources

RLSA-2026:24368 · OSV

Track software like this

Free during beta