Medium severity5.3NVD Advisory· Published May 20, 2026· Updated May 21, 2026

CVE-2026-3592

Description

BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Isc/Bind9inferred
Range: >=9.11.0,<=9.16.50 || >=9.18.0,<=9.18.48 || >=9.20.0,<=9.20.22 || >=9.21.0,<=9.21.21 || >=9.11.3-S1,<=9.16.50-S1 || >=9.18.11-S1,<=9.18.48-S1 || >=9.20.9-S1,<=9.20.22-S1
Isc/Bind2 versions
cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*+ 1 more
- cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*range: >=9.11.0,<=9.16.50
- (no CPE)range: >=9.11.0 <=9.16.50, >=9.18.0 <=9.18.48, >=9.20.0 <=9.20.22, >=9.21.0 <=9.21.21, >=9.11.3-S1 <=9.16.50-S1, >=9.18.11-S1 <=9.18.48-S1, >=9.20.9-S1 <=9.20.22-S1
osv-coords3 versions
pkg:rpm/opensuse/bind&distro=openSUSE%20Tumbleweed pkg:rpm/suse/bind&distro=SUSE%20Linux%20Enterprise%20Server%2016.0 pkg:rpm/suse/bind&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0
< 9.20.23-1.1+ 2 more
- (no CPE)range: < 9.20.23-1.1
- (no CPE)range: < 9.20.23-160000.1.1
- (no CPE)range: < 9.20.23-160000.1.1

Patches

Vulnerability mechanics

References

downloads.isc.org/isc/bind9/9.18.49nvdPatch
downloads.isc.org/isc/bind9/9.20.23nvdPatch
downloads.isc.org/isc/bind9/9.21.22nvdPatch
kb.isc.org/docs/cve-2026-3592nvdVendor Advisory

News mentions

BIND 9 Software Vulnerabilities Exposes Resolvers and Authoritative Servers to Remote Exploits
Cyber Security News · May 27, 2026

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000