← Back to blog

Bind DNS Vulnerabilities Expose Ubuntu Systems to DoS Risks

Multiple high-severity flaws in Bind DNS software could allow remote attackers to crash services or trigger resource exhaustion on Ubuntu 18.04 and 20.04 LTS.

TL;DR

  • Three CVEs affect Bind DNS software in Ubuntu 18.04 and 20.04 LTS.
  • Memory exhaustion via GSS-API TKEY negotiation may lead to DoS (CVE-2026-3039).
  • Improper handling of self-pointed glue records enables amplification attacks (CVE-2026-3592).
  • Invalid DNS message classes can cause Bind to crash (CVE-2026-5946).
  • Organizations should update Bind packages immediately.

Ubuntu has released updates addressing multiple critical vulnerabilities in the Bind Domain Name System (DNS) software. These flaws, affecting Ubuntu 18.04 and 20.04 LTS, could allow remote attackers to disrupt DNS services through denial of service or resource exhaustion.

The most severe issues involve improper handling of GSS-API TKEY negotiations and malformed DNS packets, which may result in service crashes or excessive memory consumption. Organizations relying on these Ubuntu versions must apply patches promptly to avoid potential disruptions or exploitation in amplification attacks.

Vulnerability Breakdown

  • CVE-2026-3039 allows remote attackers to exhaust system memory during GSS-API TKEY negotiation, potentially causing a denial of service.
  • CVE-2026-3592 involves incorrect processing of self-pointed glue records, enabling attackers to abuse Bind in DNS amplification attacks.
  • CVE-2026-5946 affects how Bind handles DNS messages with non-IN class values, allowing remote triggers of service crashes.

Affected Systems and Mitigation

  • Only Ubuntu 18.04 LTS and Ubuntu 20.04 LTS are impacted by CVE-2026-3592 and CVE-2026-5946.
  • All Ubuntu systems running Bind are vulnerable to CVE-2026-3039 unless patched.
  • Administrators should upgrade Bind packages using standard Ubuntu update procedures.
  • Monitoring DNS traffic for unusual query patterns can help detect attempted exploitation.

Sources

Sources

Security email updates

One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.