CVE Explorer
CVE-2026-3592
BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources.
This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"defaultStatus":"unaffected","product":"BIND 9","vendor":"ISC","versions":[{"lessThanOrEqual":"9.16.50","status":"affected","version":"9.11.0","versionType":"custom"},{"lessThanOrEqual":"9.18.48","status":"affected","version":"9.18.0","versionType":"custom"},{"lessThanOrEqual":"9.20.22","status":"affected","version":"9.20.0","versionType":"custom"},{"lessThanOrEqual":"9.21.21","status":"affected","version":"9.21.0","versionType":"custom"},{"lessThanOrEqual":"9.16.50-S1","status":"affected","version":"9.11.3-S1","versionType":"custom"},{"lessThanOrEqual":"9.18.48-S1","status":"affected","versi…
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:a8717f40d657465c413b755ad4c2301715726747b70a5d07a19732a9e6b67c6a · sha256:1546dce46f44e1b8… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:a8717f40d657465c413b755ad4c2301715726747b70a5d07a19732a9e6b67c6a · sha256:1546dce46f44e1b8… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-408","description":"CWE-408 Incorrect Behavior Order - Early Amplification","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:a8717f40d657465c413b755ad4c2301715726747b70a5d07a19732a9e6b67c6a · sha256:1546dce46f44e1b8… · /containers/cna/problemTypes/0/descriptions/0
Source references
4 source assertions{"tags":["patch"],"url":"https://downloads.isc.org/isc/bind9/9.18.49"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:a8717f40d657465c413b755ad4c2301715726747b70a5d07a19732a9e6b67c6a · sha256:1546dce46f44e1b8… · /containers/cna/references/1
{"tags":["patch"],"url":"https://downloads.isc.org/isc/bind9/9.20.23"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:a8717f40d657465c413b755ad4c2301715726747b70a5d07a19732a9e6b67c6a · sha256:1546dce46f44e1b8… · /containers/cna/references/2
{"tags":["patch"],"url":"https://downloads.isc.org/isc/bind9/9.21.22"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:a8717f40d657465c413b755ad4c2301715726747b70a5d07a19732a9e6b67c6a · sha256:1546dce46f44e1b8… · /containers/cna/references/3
{"name":"CVE-2026-3592","tags":["vendor-advisory"],"url":"https://kb.isc.org/docs/cve-2026-3592"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:a8717f40d657465c413b755ad4c2301715726747b70a5d07a19732a9e6b67c6a · sha256:1546dce46f44e1b8… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.