CVE-2026-3592 MEDIUM

CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records

Vendor Isc
Product BIND 9
Weakness CWE-408
Published May 20, 2026
Last update May 20, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

What the vulnerability does

01Description

BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

Key dates

02Disclosure timeline

May 20, 2026 CVE published
May 20, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2020-1657 Junos OS: SRX Series: An attacker sending spoofed packets to IPSec peers may cause a Denial of Service. CVE-2026-41374 OpenClaw < 2026.3.31 - Resource Consumption via Discord Audio Preflight Before Member Authorization CVE-2022-2576 CVE-2026-41405 OpenClaw < 2026.3.31 - Resource Exhaustion via Unauthenticated MS Teams Webhook Body Parsing CVE-2026-41331 OpenClaw < 2026.3.31 - Resource Consumption via Unauthorized Telegram Audio Preflight Transcription