This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] BIND 9 fixes 6 vulnerabilities
BIND 9 fixes 6 vulnerabilities in BIND 9 and BIND Supported Preview Edition [1]. The most severe of them are described below. Products and their fixed versions [1]: BIND 9 - 9.20.26, 9.21.24 BIND Supported Preview Edition - 9.20.26-S1 Debian releases and their fixed versions [2]: trixie (security) - 1:9.20.26-1~deb13u1 Ubuntu releases and their fixed versions [3]: resolute - 1:9.20.18-1ubuntu2.1 questing - 1:9.20.11-1ubuntu2.4 noble - 1:9.18.39-0ubuntu0.24.04.5 jammy - 1:9.18.39-0ubuntu0.22.04.4
An unauthenticated remote attacker can, on BIND servers configured with TKEY-based authentication via GSS-API tokens, cause excessive memory consumption by sending maliciously crafted packets and carry out a DoS [4].
The vulnerability is present in products:
- BIND 9; >=9.0.0, <=9.16.50; >=9.18.0, <=9.18.48; >=9.20.0, <=9.20.22; >=9.21.0, <=9.21.21;
- BIND 9 Supported Preview Edition; >=9.9.3-S1, <=9.16.50-S1; >=9.18.11-S1, <=9.18.48-S1; >=9.20.9-S1, <=9.20.22-S1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2026-3039 at cve.org, NVD
- CWE-771: Missing Reference to Active Allocated Resource at cwe.mitre.org
The vulnerability was publicly disclosed 20. 5. 2026.
An unauthenticated remote attacker can, by sending specially crafted HTTP/2 traffic to a DNS-over-HTTPS endpoint, exploit a use-after-free vulnerability, which may lead to memory corruption [5].
The vulnerability is present in products:
- BIND 9; >=9.20.0, <=9.20.22; >=9.21.0, <=9.21.21;
- BIND 9 Supported Preview Edition; >=9.20.9-S1, <=9.20.22-S1;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
More information:
- CVE-2026-3593 at cve.org, NVD
- CWE-416: Use After Free at cwe.mitre.org
The vulnerability was publicly disclosed 20. 5. 2026.
An unauthenticated remote attacker can carry out a DoS attack on the server by sending specially crafted DNS queries. Vulnerable systems are those that have recursion enabled, process dynamic updates (UPDATE), accept zone change notifications (NOTIFY), or process specific Internet record types (IN-specific) within zones and data outside the Internet class [6].
The vulnerability is present in products:
- BIND 9; >=9.11.0, <=9.16.50; >=9.18.0, <=9.18.48; >=9.20.0, <=9.20.22; >=9.21.0, <=9.21.21;
- BIND 9 Supported Preview Edition; >=9.11.3-S1, <=9.16.50-S1; >=9.18.11-S1, <=9.18.48-S1; >=9.20.9-S1, <=9.20.22-S1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2026-5946 at cve.org, NVD
- CWE-20: Improper Input Validation at cwe.mitre.org
- CWE-125: Out-of-bounds Read at cwe.mitre.org
- CWE-617: Reachable Assertion at cwe.mitre.org
- CWE-754: Improper Check for Unusual or Exceptional Conditions at cwe.mitre.org
- CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') at cwe.mitre.org
The vulnerability was publicly disclosed 20. 5. 2026.
An unauthenticated remote attacker can, by sending a DNS message with a SIG(0) signature during a query flood, cause undefined behavior as a result of a race condition and carry out a DoS [7].
The vulnerability is present in products:
- BIND 9; >=9.20.0, <=9.20.22; >=9.21.0, <=9.21.21;
- BIND 9 Supported Preview Edition; >=9.20.9-S1, <=9.20.22-S1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2026-5947 at cve.org, NVD
- CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') at cwe.mitre.org
- CWE-416: Use After Free at cwe.mitre.org
The vulnerability was publicly disclosed 20. 5. 2026.
Links
- [1] https://kb.isc.org/docs/aa-00913
- [2] https://security-tracker.debian.org/tracker/source-package/bind9
- [3] https://ubuntu.com/security/notices/USN-8293-1
- [4] https://kb.isc.org/docs/cve-2026-3039
- [5] https://kb.isc.org/docs/cve-2026-3593
- [6] https://kb.isc.org/docs/cve-2026-5946
- [7] https://kb.isc.org/docs/cve-2026-5947
By CESNET, z.s.p.o. Táňa Macháčková on 1. 6. 2026.