CVE-2026-3104 — Vulnetix

Try Vulnetix Request Demo

CVE-2026-3104 PUBLISHED CVSS 7.5 HIGH

CVE-2026-3104: Memory Leak (High) A specially crafted domain causes a memory leak in BIND resolvers through the DNSSEC proof-of-non-existence code. Memory is never freed, leading to out-of-memory conditions. Affects BIND 9.20.0 -> 9.20.20 and 9.21.0 -> 9.21.19. No workarounds known. CVE-2026-1519: CPU Exhaustion (High) Maliciously crafted zones with excessive NSEC3 iterations cause high CPU load during DNSSEC validation. Affects BIND 9.11.0 through 9.21.19 across all branches. Workaround: disabling DNSSEC validation prevents exploitation but is not recommended: (dnssec-validation no;).

Risk Scores

CVSS v3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products

Vendor	Product	Versions
ISC	ISC BIND 9

Timeline

Mar 25, 2026 Coalition ESS Score
Mar 25, 2026 CVE Published
Mar 25, 2026 CVE Updated
Mar 25, 2026 PoC Published
Mar 25, 2026 PoC Published
Mar 25, 2026 PoC Published
Mar 25, 2026 PoC Published
Mar 25, 2026 PoC Published
Mar 25, 2026 PoC Published
Mar 26, 2026 PoC Published
Mar 26, 2026 PoC Published
Mar 26, 2026 PoC Published

References

https://ccb.belgium.be/advisories/warning-isc-bind-9-dns-vulnerabilities-patch-immediately advisory
https://kb.isc.org/docs/cve-2026-3104 vendor
https://kb.isc.org/docs/cve-2026-1519 vendor
https://nvd.nist.gov/vuln/detail/CVE-2026-3104 technical
https://nvd.nist.gov/vuln/detail/CVE-2026-1519 technical

Open in Interactive Console →