CVE-2026-3104: BIND 9 Memory Leak Vulnerability

CVE-2026-3104 Overview

A memory leak vulnerability has been identified in ISC BIND 9 that allows remote attackers to exhaust resolver memory through specially crafted domain queries. By querying a maliciously constructed domain, an attacker can trigger continuous memory allocation without proper deallocation, eventually leading to denial of service as the BIND resolver runs out of available memory.

This vulnerability is classified as CWE-772 (Missing Release of Resource after Effective Lifetime), indicating that the affected BIND versions fail to properly release allocated memory after processing certain DNS queries.

Critical Impact

Remote attackers can cause denial of service on BIND resolvers by exhausting system memory through repeated queries to specially crafted domains, potentially disrupting DNS resolution for entire networks.

Affected Products

• BIND 9 versions 9.20.0 through 9.20.20
• BIND 9 versions 9.21.0 through 9.21.19
• BIND 9 versions 9.20.9-S1 through 9.20.20-S1 (Supported Preview Edition)

Note: BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected by this vulnerability.

Discovery Timeline

• 2026-03-25 - CVE-2026-3104 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-3104

Vulnerability Analysis

This vulnerability exploits a flaw in BIND 9's memory management when processing DNS queries for specially crafted domains. The resolver allocates memory to handle the query but fails to properly release this memory after the query is processed. When an attacker repeatedly queries the malicious domain, memory consumption grows unbounded until the system exhausts available resources.

The attack can be executed remotely over the network without requiring authentication or user interaction. The impact is limited to availability, as the vulnerability does not allow for data exfiltration or code execution. However, successful exploitation can render DNS resolution services unavailable, affecting all clients dependent on the targeted resolver.

Root Cause

The root cause is classified as CWE-772: Missing Release of Resource after Effective Lifetime. The BIND resolver's query processing code path contains a memory allocation that is not paired with a corresponding deallocation under certain conditions triggered by specially crafted domain structures. This creates a memory leak that accumulates with each malicious query processed.

Attack Vector

The attack vector is network-based, requiring only that the attacker can send DNS queries to the vulnerable BIND resolver. The attack flow involves:

1. The attacker identifies a target BIND resolver running a vulnerable version
2. A specially crafted domain is registered or configured that triggers the memory leak condition
3. The attacker sends repeated queries for this domain to the target resolver
4. Each query causes the resolver to allocate memory that is never freed
5. Over time, memory exhaustion leads to resolver failure and denial of service

The vulnerability affects resolvers in recursive mode, as they must process queries for external domains. Authoritative-only servers may have reduced exposure depending on configuration.

Detection Methods for CVE-2026-3104

Indicators of Compromise

• Abnormally high memory utilization by the named process that grows over time without stabilizing
• Increased DNS query volume from single sources or for unusual domain patterns
• System logs showing memory allocation failures or out-of-memory conditions from BIND
• Resolver performance degradation or unresponsiveness during memory pressure

Detection Strategies

• Monitor named process memory consumption trends using tools like top, htop, or process monitoring agents
• Implement DNS query logging and analyze for unusual query patterns or repeated queries for suspicious domains
• Set up alerting thresholds for BIND resolver memory utilization exceeding normal operational baselines
• Deploy network-based intrusion detection rules to identify high-volume DNS query patterns targeting resolvers

Monitoring Recommendations

• Configure BIND statistics channels to track memory allocation metrics and query rates
• Implement continuous memory monitoring with automated alerting when thresholds are exceeded
• Review DNS query logs regularly for patterns indicating potential exploitation attempts
• Establish baseline metrics for normal resolver memory usage to identify anomalous growth patterns

How to Mitigate CVE-2026-3104

Immediate Actions Required

• Upgrade BIND to patched versions 9.20.21, 9.21.20, or 9.20.21-S1 immediately
• If immediate patching is not possible, implement rate limiting on DNS queries to reduce exploitation impact
• Monitor resolver memory usage closely and restart the service if memory consumption becomes critical
• Consider temporarily restricting resolver access to trusted networks if exposure is high

Patch Information

ISC has released patched versions that address this memory leak vulnerability:

• BIND 9.20.21 - Available from ISC BIND 9.20.21 Download
• BIND 9.21.20 - Available from ISC BIND 9.21.20 Download

For detailed information about the vulnerability and remediation guidance, refer to the ISC CVE-2026-3104 Documentation.

Workarounds

• Implement network-level rate limiting for DNS queries to reduce the speed at which memory can be exhausted
• Configure automated service restart triggers based on memory utilization thresholds as a temporary measure
• Restrict recursive queries to trusted client IP ranges using BIND ACLs to limit attack surface
• Consider deploying additional resolver instances behind load balancers to distribute query load

# Example BIND ACL configuration to restrict recursive queries
acl "trusted-clients" {
    10.0.0.0/8;
    192.168.0.0/16;
    172.16.0.0/12;
    localhost;
};

options {
    recursion yes;
    allow-recursion { trusted-clients; };
    allow-query-cache { trusted-clients; };
};