CVE-2026-3104
Published: 25 March 2026
Summary
CVE-2026-3104 is a high-severity Missing Release of Resource after Effective Lifetime (CWE-772) vulnerability in Isc (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely identification, reporting, and correction of flaws such as the memory leak in vulnerable BIND resolver versions through patching.
Implements controls to protect against denial-of-service attacks like repeated malicious DNS queries causing memory exhaustion.
Mandates secure configuration of recursive or caching DNS resolvers with query validation and rate limiting to mitigate crafted domain exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote memory-leak DoS in public-facing BIND DNS resolver directly enables T1190 (exploitation of internet-facing application) and achieves T1499.004 (endpoint DoS via application exploitation).
NVD Description
A specially crafted domain can be used to cause a memory leak in a BIND resolver simply by querying this domain. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions…
more
9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.
Deeper analysisAI
CVE-2026-3104 is a memory leak vulnerability (CWE-772) in the BIND resolver, triggered by querying a specially crafted domain. It affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. Versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are not affected. The issue has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high availability impact with no confidentiality or integrity effects.
An unauthenticated attacker with network access can exploit this vulnerability remotely with low complexity and no user interaction required. By repeatedly querying the malicious domain, the attacker induces a memory leak in the BIND resolver, potentially leading to denial-of-service through gradual resource exhaustion and service degradation or crash.
ISC advisories recommend upgrading to patched versions BIND 9.20.21 or 9.21.20, available at the respective download links. Additional details are provided in the ISC knowledge base article at https://kb.isc.org/docs/cve-2026-3104.
Details
- CWE(s)