cve-2026-3039

CVE-2026-3039 is a high-severity remote denial-of-service vulnerability in ISC BIND 9, disclosed on May 20, 2026. The flaw affects servers using GSS-API TKEY authentication, where maliciously crafted negotiation packets can cause memory exhaustion in the named process, leading to DNS service disruption. While not a Windows DNS Server vulnerability, it directly impacts Windows estates that rely on Active Directory-integrated DNS and Kerberos-secured environments. Windows administrators managing hybrid DNS infrastructure should assess their exposure, as the bug can break DNS service even though it originates in BIND. Discussions on WindowsForum cover mitigation strategies, detection methods, and the broader implications for Windows-centric networks.