CLEANSTART-2025-QG41840 named contains a feature which allows operators to issue commands to a running server by communicating with the server process over a control channel, using a utility program such as rndc

🗓️ 31 Oct 2026 14:00:46Reported by GoogleType

osv_cleanstart🔗 osv.dev👁 4 Views

Security vulnerability in the named bind package control channel.

Reporter	Title	Published	Views	Family All 87
ALT Linux	Security fix for the ALT Linux 9 package bind version 9.10.4.P8-alt1	12 Apr 201700:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 8 package bind version 9.10.4.P8-alt1	12 Apr 201700:00	–	altlinux
IBM Security Bulletins	Security Bulletin: IBM i is affected by networking BIND vulnerabilities (CVE-2017-3136, CVE-2017-3137 and CVE-2017-3138)	18 Dec 201914:26	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in BIND affect Power Hardware Management Console	23 Sep 202101:45	–	ibm
AlpineLinux	CVE-2017-3138	16 Jan 201920:00	–	alpinelinux
ArchLinux	[ASA-201704-11] bind: denial of service	29 Apr 201700:00	–	archlinux
Tenable Nessus	ISC BIND 9 < 9.9.9-P8 / 9.9.9-S10 / 9.9.10rc3 / 9.10.4-P8 / 9.10.5rc3 / 9.11.0-P5 / 9.11.1r3 Multiple Vunlerabilities	19 Apr 201700:00	–	nessus
Tenable Nessus	Debian DLA-957-1 : bind9 security update	30 May 201700:00	–	nessus
Tenable Nessus	Debian DSA-3854-1 : bind9 - security update	15 May 201700:00	–	nessus
Tenable Nessus	Fedora 24 : 32:bind (2017-0a876b0ba5)	24 Apr 201700:00	–	nessus

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2025/CLEANSTART-2025-QG41840.json
osv	www.osv.dev/vulnerability/CVE-2017-3138
nvd	www.nvd.nist.gov/vuln/detail/CVE-2017-3138

31 Oct 2026 16:03Current

6.5Medium risk

Vulners AI Score6.5

CVSS 35.3

EPSS0.05503

named bind control channel rndc