ISC Internet Systems Consortium or ISC is a non profit that supports internet infrastructure (such as BIND)
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any ISC product.
RSS Feeds for ISC security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in ISC products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by ISC Sorted by Most Security Vulnerabilities since 2018
ISC BIND90 vulnerabilities
BIND is an open source DNS server. It was the first DNS server, and is maintained by the Internet Systems Consortium
By the Year
In 2026 there have been 6 vulnerabilities in ISC with an average score of 7.0 out of ten. Last year, in 2025 ISC had 11 security vulnerabilities published. If vulnerabilities keep coming in at the current rate, it appears that number of security vulnerabilities in ISC in 2026 could surpass last years number. Last year, the average CVE base score was greater by 0.37
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 6 | 6.98 |
| 2025 | 11 | 7.35 |
| 2024 | 10 | 7.32 |
| 2023 | 9 | 7.50 |
| 2022 | 14 | 6.97 |
| 2021 | 7 | 7.44 |
| 2020 | 9 | 6.58 |
| 2019 | 25 | 7.02 |
It may take a day or so for new ISC vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent ISC Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2026-3591 | Mar 25, 2026 |
Use-After-Return in ISC BIND 9 named for SIG(0) (9.20.020, 9.21.019, 9.20.9S120)A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected. |
BIND
|
| CVE-2026-3119 | Mar 25, 2026 |
BIND 9 Crash via Signed TSIG TKEY Query (9.20.0 9.21.19)Under certain conditions, `named` may crash when processing a correctly signed query containing a TKEY record. The affected code can only be reached if an incoming request has a valid transaction signature (TSIG) from a key declared in the `named` configuration. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected. |
BIND
|
| CVE-2026-3104 | Mar 25, 2026 |
ISC BIND 9 9.20.09.20.20 Memory Leak via Crafted DomainA specially crafted domain can be used to cause a memory leak in a BIND resolver simply by querying this domain. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected. |
BIND
|
| CVE-2026-1519 | Mar 25, 2026 |
BIND 9 DNSSEC Zone Crafting CPU Exhaustion (9.11-9.21)If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive queries (see: https://kb.isc.org/docs/why-does-my-authoritative-server-make-recursive-queries). This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.46, 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.46-S1, and 9.20.9-S1 through 9.20.20-S1. |
BIND
|
| CVE-2026-3608 | Mar 25, 2026 |
Kea DHCP Daemons Stack Overflow via API Socket (2.6.02.6.4, 3.0.03.0.2)Sending a maliciously crafted message to the kea-ctrl-agent, kea-dhcp-ddns, kea-dhcp4, or kea-dhcp6 daemons over any configured API socket or HA listener can cause the receiving daemon to exit with a stack overflow error. This issue affects Kea versions 2.6.0 through 2.6.4 and 3.0.0 through 3.0.2. |
Kea
|
| CVE-2025-13878 | Jan 21, 2026 |
BIND 9 9.18.40-43, 9.20.13-17, 9.21.12-16 named crash via malformed BRID/HHITMalformed BRID/HHIT records can cause `named` to terminate unexpectedly. This issue affects BIND 9 versions 9.18.40 through 9.18.43, 9.20.13 through 9.20.17, 9.21.12 through 9.21.16, 9.18.40-S1 through 9.18.43-S1, and 9.20.13-S1 through 9.20.17-S1. |
BIND
|
| CVE-2025-11232 | Oct 29, 2025 |
Kea DHCP 3.0-3.1 Crash via default host configTo trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at the default setting, which is "[^A-Za-z0-9.-]"; "hostname-char-replacement" must be empty (the default); and "ddns-qualifying-suffix" must *NOT* be empty (the default is empty). DDNS updates do not need to be enabled for this issue to manifest. A client that sends certain option content would then cause kea-dhcp4 to exit unexpectedly. This issue affects Kea versions 3.0.1 through 3.0.1 and 3.1.1 through 3.1.2. |
Kea
|
| CVE-2025-40780 | Oct 22, 2025 |
BIND 9 PRNG flaw predicts source port/query ID (before 9.21.13/S1)In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use. This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1. |
BIND
|
| CVE-2025-40778 | Oct 22, 2025 |
Cache Injection via Lenient Record Acceptance in BIND 9 (up to 9.21.12)Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1. |
BIND
|
| CVE-2025-8677 | Oct 22, 2025 |
CPU Exhaustion via Malformed DNSKEY in BIND 9 (9.189.21)Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1. |
BIND
|
| CVE-2025-8696 | Sep 10, 2025 |
DoS via Excess Data in Stork UI v1.0.0-2.3.0If an unauthenticated user sends a large amount of data to the Stork UI, it may cause memory and disk use problems for the system running the Stork server. This issue affects Stork versions 1.0.0 through 2.3.0. |
|
| CVE-2025-40779 | Aug 27, 2025 |
Kea DHCPv4 Unicast Assertion Failure (2.7.1-2.7.9, 3.0.0, 3.1.0)If a DHCPv4 client sends a request with some specific options, and Kea fails to find an appropriate subnet for the client, the `kea-dhcp4` process will abort with an assertion failure. This happens only if the client request is unicast directly to Kea; broadcast messages do not cause the problem. This issue affects Kea versions 2.7.1 through 2.7.9, 3.0.0, and 3.1.0. |
Kea
|
| CVE-2025-40777 | Jul 16, 2025 |
CNAME Chain Assertion Failure in BIND 9 9.20.0–9.20.10 Caching ResolverIf a `named` caching resolver is configured with `serve-stale-enable` `yes`, and with `stale-answer-client-timeout` set to `0` (the only allowable value other than `disabled`), and if the resolver, in the process of resolving a query, encounters a CNAME chain involving a specific combination of cached or authoritative records, the daemon will abort with an assertion failure. This issue affects BIND 9 versions 9.20.0 through 9.20.10, 9.21.0 through 9.21.9, and 9.20.9-S1 through 9.20.10-S1. |
BIND
|
| CVE-2025-40776 | Jul 16, 2025 |
Cache Poisoning in BIND 9 (named) before 9.20.10 via ECSA `named` caching resolver that is configured to send ECS (EDNS Client Subnet) options may be vulnerable to a cache-poisoning attack. This issue affects BIND 9 versions 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.37-S1, and 9.20.9-S1 through 9.20.10-S1. |
BIND
|
| CVE-2025-32803 | May 28, 2025 |
World-readable log/lease files in Kea 2.4.0-2.4.1, 2.6.0-2.6.2, 2.7.0-2.7.8In some cases, Kea log files or lease files may be world-readable. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8. |
Kea
|
| CVE-2025-32802 | May 28, 2025 |
Kea 2.4.x-2.4.1/2.6.x-2.6.2/2.7.x-2.7.8 API Arbitrary File OverwriteKea configuration and API directives can be used to overwrite arbitrary files, subject to permissions granted to Kea. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8. |
Kea
|
| CVE-2024-11187 | Jan 29, 2025 |
DoS via Excessive ADDITIONAL Records in ISC BIND 9 (9.1121.3)It is possible to construct a zone such that some queries to it will generate responses containing numerous records in the Additional section. An attacker sending many such queries can cause either the authoritative server itself or an independent resolver to use disproportionate resources processing the queries. Zones will usually need to have been deliberately crafted to attack this exposure. This issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.32-S1. |
BIND
|
| CVE-2024-0760 | Jul 23, 2024 |
BIND 9 TCP Flood Leads to Instability (9.18.19.18.27, 9.19.09.19.24)A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may recover after the attack ceases. Use of ACLs will not mitigate the attack. This issue affects BIND 9 versions 9.18.1 through 9.18.27, 9.19.0 through 9.19.24, and 9.18.11-S1 through 9.18.27-S1. |
BIND
|
| CVE-2024-1737 | Jul 23, 2024 |
BIND 9.11-9.19 RR Caching Overwrite Performance DegradationResolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname (of any RTYPE) can suffer from degraded performance as content is being added or updated, and also when handling client queries for this name. This issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.4-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1. |
BIND
|
| CVE-2024-4076 | Jul 23, 2024 |
BIND 9 (9.16.13-9.19.24) Local Zone Lookup Assertion Failure (CVE-2024-4076)Client queries that trigger serving stale data and that also require lookups in local authoritative zone data may result in an assertion failure. This issue affects BIND 9 versions 9.16.13 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.33-S1 through 9.11.37-S1, 9.16.13-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1. |
BIND
|
| CVE-2024-28872 | Jul 11, 2024 |
Stork TLS cert validation flaw (0.15.01.15.0) allows agent command injectionThe TLS certificate validation code is flawed. An attacker can obtain a TLS certificate from the Stork server and use it to connect to the Stork agent. Once this connection is established with the valid certificate, the attacker can send malicious commands to a monitored service (Kea or BIND 9), possibly resulting in confidential data loss and/or denial of service. It should be noted that this vulnerability is not related to BIND 9 or Kea directly, and only customers using the Stork management tool are potentially affected. This issue affects Stork versions 0.15.0 through 1.15.0. |
Stork
|
| CVE-2023-50387 | Feb 14, 2024 |
DNSSEC KeyTrap DoS via DNSKEY/RRSIG overevaluation in BIND 9Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records. |
BIND
|
| CVE-2023-6516 | Feb 13, 2024 |
BIND 9 9.16.09.16.45 cachedatabase cleanup leads to memory exhaustionTo keep its cache database efficient, `named` running as a recursive resolver occasionally attempts to clean up the database. It uses several methods, including some that are asynchronous: a small chunk of memory pointing to the cache element that can be cleaned up is first allocated and then queued for later processing. It was discovered that if the resolver is continuously processing query patterns triggering this type of cache-database maintenance, `named` may not be able to handle the cleanup events in a timely manner. This in turn enables the list of queued cleanup events to grow infinitely large over time, allowing the configured `max-cache-size` limit to be significantly exceeded. This issue affects BIND 9 versions 9.16.0 through 9.16.45 and 9.16.8-S1 through 9.16.45-S1. |
BIND
|
| CVE-2023-4408 | Feb 13, 2024 |
BIND 9 DNS Parsing Complexity DoS (v9.0.0-9.19.19)The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1. |
BIND
|
| CVE-2023-5517 | Feb 13, 2024 |
BIND9 Crash: assertion failure via nxdomain-redirect (v9.129.19)A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when: - `nxdomain-redirect <domain>;` is configured, and - the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response. This issue affects BIND 9 versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1. |
BIND
|
| CVE-2023-5679 | Feb 13, 2024 |
BIND 9 named Crash via DNS64+serve-stale v9.16.129.19.19A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure during recursive resolution, when both of these features are enabled. This issue affects BIND 9 versions 9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1. |
BIND
|
| CVE-2023-5680 | Feb 13, 2024 |
BIND 9 ECS Cache Clean Degradation (9.11.3-9.18.21)If a resolver cache has a very large number of ECS records stored for the same name, the process of cleaning the cache database node for this name can significantly impair query performance. This issue affects BIND 9 versions 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1. |
BIND
|
| CVE-2023-3341 | Sep 20, 2023 |
Stack Overflow via Recursive Packet Parsing in BIND 9 Control ChannelThe code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing code to run out of available stack memory, causing `named` to terminate unexpectedly. Since each incoming control channel message is fully parsed before its contents are authenticated, exploiting this flaw does not require the attacker to hold a valid RNDC key; only network access to the control channel's configured TCP port is necessary. This issue affects BIND 9 versions 9.2.0 through 9.16.43, 9.18.0 through 9.18.18, 9.19.0 through 9.19.16, 9.9.3-S1 through 9.16.43-S1, and 9.18.0-S1 through 9.18.18-S1. |
BIND
|
| CVE-2023-4236 | Sep 20, 2023 |
BIND 9 9.18.018: DNSTLS Assertion CrashA flaw in the networking code handling DNS-over-TLS queries may cause `named` to terminate unexpectedly due to an assertion failure. This happens when internal data structures are incorrectly reused under significant DNS-over-TLS query load. This issue affects BIND 9 versions 9.18.0 through 9.18.18 and 9.18.11-S1 through 9.18.18-S1. |
BIND
|
| CVE-2023-2828 | Jun 21, 2023 |
BIND 9 Cache Bypass Exploit (named) Allows max-cache-size Exceeded 9.119.19Every `named` instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to authoritative servers. The size limit for that cache database can be configured using the `max-cache-size` statement in the configuration file; it defaults to 90% of the total amount of memory available on the host. When the size of the cache reaches 7/8 of the configured limit, a cache-cleaning algorithm starts to remove expired and/or least-recently used RRsets from the cache, to keep memory use below the configured limit. It has been discovered that the effectiveness of the cache-cleaning algorithm used in `named` can be severely diminished by querying the resolver for specific RRsets in a certain order, effectively allowing the configured `max-cache-size` limit to be significantly exceeded. This issue affects BIND 9 versions 9.11.0 through 9.16.41, 9.18.0 through 9.18.15, 9.19.0 through 9.19.13, 9.11.3-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1. |
BIND
|
| CVE-2023-2829 | Jun 21, 2023 |
BIND 9 named Resc Termination via Malformed NSEC (9.16.8S19.18.15S1)A `named` instance configured to run as a DNSSEC-validating recursive resolver with the Aggressive Use of DNSSEC-Validated Cache (RFC 8198) option (`synth-from-dnssec`) enabled can be remotely terminated using a zone with a malformed NSEC record. This issue affects BIND 9 versions 9.16.8-S1 through 9.16.41-S1 and 9.18.11-S1 through 9.18.15-S1. |
BIND
|
| CVE-2023-2911 | Jun 21, 2023 |
BIND 9 named Stack Overflow via Recusive Client Quota Loop (9.16.339.16.41)If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable yes;` and `stale-answer-client-timeout 0;`, a sequence of serve-stale-related lookups could cause `named` to loop and terminate unexpectedly due to a stack overflow. This issue affects BIND 9 versions 9.16.33 through 9.16.41, 9.18.7 through 9.18.15, 9.16.33-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1. |
BIND
|
| CVE-2022-3924 | Jan 26, 2023 |
Stale-Answer Race in BIND 9 9.16.129.19.8 Causing Assertion FailureThis issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value greater than zero. If the resolver receives many queries that require recursion, there will be a corresponding increase in the number of clients that are waiting for recursion to complete. If there are sufficient clients already waiting when a new client query is received so that it is necessary to SERVFAIL the longest waiting client (see BIND 9 ARM `recursive-clients` limit and soft quota), then it is possible for a race to occur between providing a stale answer to this older client and sending an early timeout SERVFAIL, which may cause an assertion failure. This issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.12-S1 through 9.16.36-S1. |
BIND
|
| CVE-2022-3094 | Jan 26, 2023 |
BIND 9.169.19 DoS via Flooding Dynamic DNS UpdatesSending a flood of dynamic DNS updates may cause `named` to allocate large amounts of memory. This, in turn, may cause `named` to exit due to a lack of free memory. We are not aware of any cases where this has been exploited. Memory is allocated prior to the checking of access permissions (ACLs) and is retained during the processing of a dynamic update from a client whose access credentials are accepted. Memory allocated to clients that are not permitted to send updates is released immediately upon rejection. The scope of this vulnerability is limited therefore to trusted clients who are permitted to make dynamic zone changes. If a dynamic update is REFUSED, memory will be released again very quickly. Therefore it is only likely to be possible to degrade or stop `named` by sending a flood of unaccepted dynamic updates comparable in magnitude to a query flood intended to achieve the same detrimental outcome. BIND 9.11 and earlier branches are also affected, but through exhaustion of internal resources rather than memory constraints. This may reduce performance but should not be a significant problem for most servers. Therefore we don't intend to address this for BIND versions prior to BIND 9.16. This issue affects BIND 9 versions 9.16.0 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.8-S1 through 9.16.36-S1. |
BIND
|
| CVE-2022-3488 | Jan 26, 2023 |
BIND 9 Repeated Response ECS Assertion Failure (Fixed 9.11.38, 9.16.37)Processing of repeated responses to the same query, where both responses contain ECS pseudo-options, but where the first is broken in some way, can cause BIND to exit with an assertion failure. 'Broken' in this context is anything that would cause the resolver to reject the query response, such as a mismatch between query and answer name. This issue affects BIND 9 versions 9.11.4-S1 through 9.11.37-S1 and 9.16.8-S1 through 9.16.36-S1. |
BIND
|
| CVE-2022-3736 | Jan 26, 2023 |
BIND 9 Resolver Crash with Stale Cache/Answer & RRSIG Query (9.16.12-9.19.8)BIND 9 resolver can crash when stale cache and stale answers are enabled, option `stale-answer-client-timeout` is set to a positive integer, and the resolver receives an RRSIG query. This issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.12-S1 through 9.16.36-S1. |
BIND
|
| CVE-2022-3346 | Dec 28, 2022 |
BIND DNSSEC RRSIG Owner Name Validation BypassDNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. The owner name of RRSIG RRs is not validated, permitting an attacker to present the RRSIG for an attacker-controlled domain in a response for any other domain. |
BIND
|
| CVE-2022-2928 | Oct 07, 2022 |
ISC DHCP 4.4.0-4.4.3 Refcount Overflow in option_code_hash_lookup()In ISC DHCP 4.4.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1, when the function option_code_hash_lookup() is called from add_option(), it increases the option's refcount field. However, there is not a corresponding call to option_dereference() to decrement the refcount field. The function add_option() is only used in server responses to lease query packets. Each lease query response calls this function for several options, so eventually, the reference counters could overflow and cause the server to abort. |
Dhcp
|
| CVE-2022-2929 | Oct 07, 2022 |
ISC DHCP <4.4.3 / 4.1-ESV-R16-P1 Mem Exhaustion via Long FQDN LabelsIn ISC DHCP 1.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1 a system with access to a DHCP server, sending DHCP packets crafted to include fqdn labels longer than 63 bytes, could eventually cause the server to run out of memory. |
Dhcp
|
| CVE-2022-2906 | Sep 21, 2022 |
Memory Exhaustion DoS in Unknown ComponentAn attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service. |
BIND
|
| CVE-2022-38177 | Sep 21, 2022 |
Memory Leak in ISC BIND via Malformed ECDSA SignaturesBy spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources. |
BIND
|
| CVE-2022-38178 | Sep 21, 2022 |
Memory Leak via Malformed EdDSA in BIND DNS ResolverBy spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources. |
BIND
|
| CVE-2022-2795 | Sep 21, 2022 |
BIND 9 DNS Resolver DoS via Query FloodingBy flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service. |
BIND
|
| CVE-2022-2881 | Sep 21, 2022 |
Buffer Overread CVE-2022-2881: Potential Info Disclosure or CrashThe underlying bug might cause read past end of the buffer and either read memory it should not read, or crash the process. |
BIND
|
| CVE-2022-3080 | Sep 21, 2022 |
BIND named Crash via Resolver Query (CVE-2022-3080)By sending specific queries to the resolver, an attacker can cause named to crash. |
BIND
|
| CVE-2022-1183 | May 19, 2022 |
On vulnerable configurations, the named daemon may, in some circumstances, terminate with an assertion failureOn vulnerable configurations, the named daemon may, in some circumstances, terminate with an assertion failure. Vulnerable configurations are those that include a reference to http within the listen-on statements in their named.conf. TLS is used by both DNS over TLS (DoT) and DNS over HTTPS (DoH), but configurations using DoT alone are unaffected. Affects BIND 9.18.0 -> 9.18.2 and version 9.19.0 of the BIND 9.19 development branch. |
BIND
|
| CVE-2021-25220 | Mar 23, 2022 |
BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including Supported Preview Editions - are also believed to be affected but have not been tested as they are EOL. The cache could become poisoned with incorrect records leading to queries being made to the wrong servers, which might also result in false information being returned to clients. |
BIND
|
| CVE-2022-0635 | Mar 23, 2022 |
Versions affected: BIND 9.18.0 When a vulnerable version of named receives a series of specific queriesVersions affected: BIND 9.18.0 When a vulnerable version of named receives a series of specific queries, the named process will eventually terminate due to a failed assertion check. |
BIND
|
| CVE-2022-0396 | Mar 23, 2022 |
BIND 9.16.11 -> 9.16.26, 9.17.0 -> 9.18.0 and versions 9.16.11-S1 -> 9.16.26-S1 of the BIND Supported Preview EditionBIND 9.16.11 -> 9.16.26, 9.17.0 -> 9.18.0 and versions 9.16.11-S1 -> 9.16.26-S1 of the BIND Supported Preview Edition. Specifically crafted TCP streams can cause connections to BIND to remain in CLOSE_WAIT status for an indefinite period of time, even after the client has terminated the connection. |
BIND
|
| CVE-2022-0667 | Mar 22, 2022 |
When the vulnerability is triggered the BIND process will exitWhen the vulnerability is triggered the BIND process will exit. BIND 9.18.0 |
BIND
|