CVE-2026-3039

HighCVSS 7.5/10Last modified Sep 17, 2026

Description

BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets. Typically these servers will be found in Active Directory integrated DNS deployments and/or Kerberos-secured DNS environments. This issue affects BIND 9 versions 9.0.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.9.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-771 CWE-770

Affected software

No affected versions have been published.

Timeline

Published: May 20, 2026
Last modified: Sep 17, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-30407.2A vulnerability was identified in DrayTek Vigor 300B up to 1.5.1.6. This affects the function cgiGetFile of the file /cgi-bin/mainfunction.c CVE-2026-304029.8An issue in wgcloud v.2.3.7 and before allows a remote attacker to execute arbitrary code via the test connection function CVE-2026-304037.5There is an arbitrary file read vulnerability in the test connection function of backend database management in wgcloud v3.6.3 and before, w CVE-2026-304047.5The backend database management connection test feature in wgcloud v3.6.3 has a server-side request forgery (SSRF) vulnerability. This issue CVE-2026-304057.5An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT_HOP path attribute CVE-2026-30412.4A security vulnerability has been detected in xingfuggz BaykeShop up to 1.3.20. Impacted is an unknown function of the file src/baykeshop/co CVE-2026-30429.8A vulnerability was detected in itsourcecode Event Management System 1.0. The affected element is an unknown function of the file /admin/ind CVE-2026-30436.1A flaw has been found in itsourcecode Event Management System 1.0. The impacted element is an unknown function of the file /admin/navbar.php CVE-2026-30448.8A vulnerability has been found in Tenda AC8 16.03.34.06. This affects the function webCgiGetUploadFile of the file /cgi-bin/UploadCfg of the CVE-2026-30457.5The Appointment Booking Calendar — Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized access of sensitive data CVE-2026-304526.5Textpattern CMS 4.9.0 contains a Broken Access Control vulnerability in the article management system that allows authenticated users with l CVE-2026-304579.8An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code.