CVE-2026-3592
Amplified Resource Consumption in BIND Resolver
Publication date: 2026-05-20
Last updated on: 2026-05-20
Assigner: Internet Systems Consortium (ISC)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| isc | bind | From 9.11.0 (inc) to 9.16.50 (inc) |
| isc | bind | From 9.18.0 (inc) to 9.18.48 (inc) |
| isc | bind | From 9.20.0 (inc) to 9.20.22 (inc) |
| isc | bind | From 9.21.0 (inc) to 9.21.21 (inc) |
| isc | bind | From 9.11.3-S1 (inc) to 9.16.50-S1 (inc) |
| isc | bind | From 9.18.11-S1 (inc) to 9.18.48-S1 (inc) |
| isc | bind | From 9.20.9-S1 (inc) to 9.20.22-S1 (inc) |
| isc | bind | 9.18.49 |
| isc | bind | 9.20.23 |
| isc | bind | 9.21.22 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-408 | The product allows an entity to perform a legitimate but expensive operation before authentication or authorization has taken place. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
CVE-2026-3592 is a medium-severity vulnerability in BIND 9 DNS resolver software involving amplification caused by self-pointed glue records.
When a victim resolver queries a specially crafted zone, it consumes disproportionate resources, leading to excessive bandwidth usage and potential impairment of TCP functionality.
This primarily affects recursive resolvers, while authoritative-only servers with trusted zones are not affected unless tricked into querying an attack domain.
How can this vulnerability impact me? :
The vulnerability can cause your BIND 9 resolver to consume excessive resources when processing queries to specially crafted zones.
This resource exhaustion can lead to increased bandwidth usage and may impair TCP functionality, potentially degrading the performance and reliability of your DNS resolver.
What immediate steps should I take to mitigate this vulnerability?
The recommended immediate step to mitigate this vulnerability is to upgrade BIND 9 to the patched versions: 9.18.49, 9.20.23, or 9.21.22, or their corresponding Supported Preview Edition releases.
No workarounds are currently available for this vulnerability.