Is CVE-2026-3592 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-3592 being exploited in the wild.

How severe is CVE-2026-3592?

Medium severity, with a CVSS score of 5.3, published 20 May 2026.

Which products and versions are affected?

Isc BIND 9 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, 9.20.9-S1 through 9.20.22-S1.

Is there a fix for CVE-2026-3592?

A patch was published on 2026-05-20. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-3592 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-3592?

Check whether you run Isc BIND 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-3592: ISC BIND resource exhaustion in DNS resolver

CVE-2026-3592 · Severity: medium · CVSS 5.3 · Published 2026-05-20

BIND, a widely used system for translating website names into IP addresses, is vulnerable to a resource exhaustion attack. An attacker can create a malicious DNS zone that, when queried by a BIND resolver, causes the system to consume excessive processing power or memory. This can lead to significant performance degradation or a denial of service for users relying on that DNS server.

Technologies: Isc BIND 9. Vendors: Isc.

Quick answers

Is CVE-2026-3592 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-3592 being exploited in the wild.
How severe is CVE-2026-3592?: Medium severity, with a CVSS score of 5.3, published 20 May 2026.
Which products and versions are affected?: Isc BIND 9 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, 9.20.9-S1 through 9.20.22-S1.
Is there a fix for CVE-2026-3592?: A patch was published on 2026-05-20. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-3592 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-3592?: Check whether you run Isc BIND 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

BIND 9 resolvers are susceptible to a Denial of Service (DoS) vulnerability classified as Early Amplification (CWE-408). The vulnerability is triggered when a resolver attempts to process queries for a specially crafted malicious DNS zone. This results in disproportionate resource consumption (CPU or memory) relative to the query size. The attack can be launched remotely over the network without authentication. ISC has released patches in versions 9.18.49, 9.20.23, and 9.21.22 to address this issue.

Affected products

ISC BIND 9 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, 9.20.9-S1 through 9.20.22-S1

Timeline

2026-05-20: disclosed
2026-05-20: patched
2026-05-20: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.