CVE-2026-3104CWE-401CWE-772

CVE-2026-3104

High · published March 25, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
68.5
In the wild
Unconfirmed
What it is

A specially crafted domain can be used to cause a memory leak in a BIND resolver simply by querying this domain.

This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1.

BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01219 · 68.5th percentile
Weaknesses
CWE-401 · Missing Release of Memory after Effective Lifetime; CWE-772 · Missing Release of Resource after Effective Lifetime
Published
2026-03-25T18:16Z
Affected products (2)
ProductVersionsFixed in
isc/bind≥ 9.20.0, < 9.20.219.20.21
isc/bind≥ 9.21.0, < 9.21.209.21.20
References (7)
https://downloads.isc.org/isc/bind9/9.20.21 · [email protected]https://downloads.isc.org/isc/bind9/9.21.20 · [email protected]https://kb.isc.org/docs/cve-2026-3104 · [email protected]https://access.redhat.com/errata/RHSA-2026:6935 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/security/cve/CVE-2026-3104 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://bugzilla.redhat.com/show_bug.cgi?id=2451310 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3104.json · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
EPSS history
Timeline
  • 25 MAR 13:29Z
    Memory leak in code preparing DNSSEC proofs of non-existence
    cvelistv5