Brief Summary: BIND 9 CVE-2026-3039 Memory Exhaustion via GSS-API TKEY Negotiation

Introduction

Enterprise DNS infrastructure built on BIND 9 with Active Directory or Kerberos integration is exposed to a remote, unauthenticated denial of service attack that silently exhausts server memory until name resolution fails entirely. CVE-2026-3039, disclosed by the Internet Systems Consortium on May 20, 2026, carries a CVSS score of 7.5 and affects a wide range of BIND 9 versions, with no workaround available.

Technical Information

Root Cause: A Leaked Security Context Outside BIND's Memory Accounting

The vulnerability is classified under CWE-771 (Missing Reference to Active Allocated Resource). The core issue lies in how BIND 9 handles GSS-API TKEY negotiation. During this process, the server creates a security context inside the GSS library. When processing maliciously constructed packets, this security context is leaked. Critically, because the memory is allocated directly by the GSS library and not through BIND's own memory allocator, the leak is invisible to BIND's internal memory accounting mechanisms. BIND has no visibility into how much memory the GSS library has consumed, and therefore cannot enforce any limits or trigger cleanup.

In earlier versions, BIND attempted to support multi round GSS-API negotiation. This design decision contributed to improper state handling that enables the leak. The Kerberos and SPNEGO protocols, which are the relevant GSS-API mechanisms in these environments, actually complete authentication in a single round, making multi round support unnecessary and, as it turns out, dangerous.

Attack Flow

The attack is straightforward:

1. The attacker identifies a BIND 9 server configured with GSS-API TKEY authentication. These servers are typically found in Active Directory integrated DNS deployments or Kerberos secured DNS environments.
2. The attacker sends repeated, maliciously crafted TKEY queries to the target server over the network. No authentication or special privileges are required.
3. Each malicious TKEY query triggers the allocation of a GSS-API security context that is never properly freed.
4. Because the leaked memory resides in the GSS library's address space and bypasses BIND's memory accounting, the server has no mechanism to detect or limit the growing consumption.
5. Over time, available system memory is exhausted, and the BIND process fails, resulting in a complete denial of service for DNS resolution.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms the attack is network accessible, low complexity, requires no privileges or user interaction, and impacts availability to a high degree with no effect on confidentiality or integrity.

How the Fix Works

The patched releases address the vulnerability through two key changes:

1. Rejection of multi round GSS-API negotiation. The server now refuses to engage in multi round exchanges, since Kerberos and SPNEGO complete in a single round. This eliminates the improper state handling that allowed the context leak.
2. Enforcement of RFC 3645 requirements. The fix implements a previously missing check: the client must verify that mutual authentication and integrity flags are granted by the GSS-API mechanism. This brings the implementation into compliance with the protocol specification and closes the attack surface.

Affected Systems and Versions

The vulnerability affects BIND 9 servers that are configured to use TKEY based authentication via GSS-API tokens. The following version ranges are vulnerable:

Patched releases:

Servers that do not use GSS-API TKEY authentication are not affected. The vulnerable configuration is most commonly found in Active Directory integrated DNS and Kerberos secured DNS environments.

Vendor Security History

ISC maintains a well established track record of transparent and professional vulnerability disclosure. For CVE-2026-3039, ISC provided early notification to stakeholders on May 13, 2026, a full week before the public disclosure and patch release on May 20, 2026. Their advisories consistently include CVSS scoring, detailed impact analysis, affected version matrices, and direct upgrade paths. Given BIND 9's position as the most widely deployed open source DNS implementation, used by financial institutions, carriers, ISPs, universities, and government agencies worldwide, ISC's disciplined approach to security communications is essential to the broader internet ecosystem.

References

• ISC Advisory: CVE-2026-3039
• BIND 9.18.49 Download
• BIND 9.20.23 Download
• BIND 9.21.22 Download
• CWE-771: Missing Reference to Active Allocated Resource
• BIND 9.20 Changelog
• ISC BIND 9 Product Page
• Internet Systems Consortium