CVE-2026-3592

Vulnerability

The vulnerability exists in BIND 9 recursive resolvers when they query a specially crafted zone containing self-pointed glue records. Resolvers may consume disproportionate resources, including bandwidth and CPU, attempting to resolve such names. The issue affects BIND versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and the corresponding Supported Preview Edition versions [1].

Exploitation

An attacker must host a malicious zone and cause a victim resolver to query it (e.g., by sending a query for a domain within that zone). No authentication is required, and the attack can be launched remotely over the network [1]. The resolver will attempt to resolve the name by following self-pointed glue records, leading to excessive resource consumption.

Impact

Successful exploitation allows an attacker to cause the resolver to consume disproportionate amounts of bandwidth and possibly impair TCP connections, resulting in a denial-of-service condition. The vulnerability does not allow data confidentiality or integrity compromise [1].

Mitigation

ISC has released patched versions: BIND 9.18.49, 9.20.23, and 9.21.22 (and S-Preview equivalents 9.18.49-S1, 9.20.23-S1). Users should upgrade to the appropriate fixed version [1],[2],[3],[4]. No workarounds are available. Authoritative-only servers with trusted zones are not affected [1].