PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-3592 ISC CVE debrief

CVE-2026-3592 is an availability issue in BIND recursive resolvers. According to NVD and ISC references, a victim resolver that queries a specially crafted zone can consume disproportionate resources, creating an amplified resource consumption or exhaustion condition. The published affected range spans multiple BIND 9 branches, including 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and the corresponding -S1 builds listed by NVD.

Vendor
ISC
Product
BIND 9
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-20
Original CVE updated
2026-05-21
Advisory published
2026-05-20
Advisory updated
2026-05-21

Who should care

Organizations running BIND recursive resolvers, DNS infrastructure teams, managed DNS providers, and defenders responsible for internet-facing DNS services should pay attention. Systems that resolve untrusted external names are the most relevant exposure point.

Technical summary

NVD lists this issue with CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, indicating a network-reachable issue with no privileges or user interaction required and primarily availability impact. NVD also maps the weakness to CWE-408. The core behavior described is resolver resource amplification when processing queries for a specially crafted zone, which can lead to disproportionate CPU, memory, or related resolver resource use and degrade service responsiveness.

Defensive priority

Medium. This is not described as a confidentiality or integrity issue, but it can meaningfully affect DNS resolver availability and performance in environments that depend on BIND for name resolution.

Recommended defensive actions

  • Review whether any BIND instances fall within the affected versions listed by NVD for CVE-2026-3592.
  • Apply the ISC-provided fixed releases referenced by NVD: 9.18.49, 9.20.23, or 9.21.22, or the corresponding vendor guidance for your supported branch.
  • Check the ISC advisory linked by NVD for any branch-specific upgrade instructions or operational mitigations.
  • Prioritize internet-facing recursive resolvers and shared DNS infrastructure first, since those are the most exposed to untrusted query traffic.
  • Monitor resolver resource usage and query behavior for unusual load patterns while patching is planned or in progress.
  • If immediate upgrade is not possible, use defensive DNS controls and traffic filtering consistent with your operational policy to reduce exposure to untrusted zones.

Evidence notes

All substantive claims in this debrief come from the supplied NVD record and its ISC references. The CVE was published on 2026-05-20 and last modified the same day, which is the correct timing context for this issue. The source corpus identifies BIND as the affected product family and lists affected versions plus fixed-release download pages and an ISC advisory URL; no additional exploit details were used.

Official resources

Publicly disclosed on 2026-05-20. NVD listed the record as undergoing analysis at the time of the supplied source snapshot.