CVE-2026-3104: Memory leak in code preparing DNSSEC proofs of non-existence

Description

A specially crafted domain can be used to cause a memory leak in a BIND resolver simply by querying this domain. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.7% · higher than 53% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

B9

BIND 9 · ISC

9.20.0 through 9.20.20; 9.21.0 through 9.21.19; 9.20.9-S1 through 9.20.20-S1 · source: vendor

BI

Bind · Isc

9.20.0 before 9.20.21; 9.21.0 before 9.21.20 · source: NVD

RH

Red Hat Hardened Images · Red Hat

All versions, or not specified · source: CISA