CVE-2023-50868

CVE-2023-50868 is a DNSSEC-related denial of service issue (NSEC3 Closest Encloser proof) that can cause CPU exhaustion. The connected documents confirm impact on DNS implementations such as Unbound and BIND/BIND9 and describe the root cause as processors performing thousands of hash iterations f...

CVE-2023-50387

CVE-2023-50387 (KeyTrap) affects DNSSEC processing in DNS resolvers. Multiple advisories note excessive CPU/DoS risk when validating DNSKEY/RRSIG in zones with many records. Affected products include Bind (bind9) and Unbound across Linux distributions (e.g., AL2, AlmaLinux) with patches/released ...

CVE-2014-8500

CVE-2014-8500 affects ISC BIND 9.0.x–9.8.x, 9.9.0–9.9.6, and 9.10.0–9.10.1, where delegation chaining is not limited, enabling remote attackers to cause memory exhaustion or a named crash via a large or infinite number of referrals. Impact: denial of service; all recursive resolvers are affected,...

CVE-2015-4620

Vulnerability CVE-2015-4620 affects ISC BIND when configured as a DNSSEC-validating recursive resolver. name.c in BIND 9.7.x–9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2 can crash the server (assertion failure and daemon exit) after crafting zone data and issuing a query for a name in that z...

CVE-2020-8617

CVE-2020-8617 involves ISC BIND and is triggered by a logic error in the TSIG validity check (tsig.c). A remote attacker who can guess or know the TSIG key name could cause the server to reach an inconsistent state or trigger an assertion failure, leading to a denial of service. Several connected...

CVE-2017-3141

CVE-2017-3141 arises from an unquoted service path in the Windows installer for BIND, enabling local privilege escalation if host file permissions permit. Affected versions include BIND 9.2.6-P2→9.2.9, 9.3.2-P1→9.3.6, 9.4.0→9.8.8, 9.9.0→9.9.10, 9.10.0→9.10.5, 9.11.0→9.11.1, 9.9.3-S1→9.9.10-S1, an...

CVE-2023-3341

CVE-2023-3341 describes a stack-exhaustion DoS in ISC BIND’s control channel; recursive parsing of control channel messages can overflow stack, causing named to terminate. Affected are BIND/NAMED versions across multiple series (e.g., 9.2.0–9.16.43, 9.18.0–9.18.18, 9.19.0–9.19.16, plus S1 variant...

CVE-2021-25215

CVE-2021-25215 affects BIND 9 upstream and downstream builds. The vulnerability is an assertion failure in the named process when handling DNAME-related queries, which can cause named to terminate. Affected versions include BIND 9.0.0–9.11.29, 9.12.0–9.16.13, and specific S1/“Supported Preview” b...

CVE-2018-5740

CVE-2018-5740 is a flaw in the deny-answer-aliases feature of BIND that can cause an assertion failure in named, potentially restarting the bind process (denial of service). Affected BIND versions include 9.7.0–9.8.8, 9.9.0–9.9.13, 9.10.0–9.10.8, 9.11.0–9.11.4, 9.12.0–9.12.2, and 9.13.0–9.13.2. R...

CVE-2023-4408

The CVE-2023-4408 issue is a vulnerability in the DNS message parsing of BIND's named where the parsing path has an overly high computational complexity. A crafted large or malformed DNS message can cause high CPU usage on affected BIND 9 releases, potentially impacting both authoritative servers...

CVE-2022-3094

CVE-2022-3094 affects ISC BIND and allows denial of service by flooding dynamic DNS UPDATE requests. A memory allocation occurs before ACL checks, and memory retained for accepted clients can exhaust resources; memory for non-permitted clients is released on rejection. The impact is a DoS (availa...

CVE-2017-3143

The CVE-2017-3143 issue is a TSIG authentication bypass in ISC BIND that could allow an attacker who can communicate with an authoritative DNS server and knows a valid TSIG key name to manipulate BIND into accepting an unauthorized dynamic update. The vulnerability affects multiple BIND releases ...

CVE-2023-2828

CVE-2023-2828 concerns the BIND 9 DNS server’s named component. The vulnerability stems from the cache-cleaning logic: when the resolver is queried for specific RRsets in a certain order, the configured max-cache-size can be exceeded, potentially causing memory exhaustion. Affected are multiple B...

CVE-2017-3145

CVE-2017-3145 affects BIND: the resolver incorrectly sequenced cleanup operations on upstream recursion fetch contexts, causing a use-after-free that can trigger an assertion failure and crash named. Affected versions include BIND 9.0.0 through 9.8.x, 9.9.0–9.9.11, 9.10.0–9.10.6, 9.11.0–9.11.2, 9...

CVE-2016-8864

CVE-2016-8864 affects ISC BIND DNS server. A denial-of-service can be triggered by processing responses containing a DNAME answer in db.c/resolver.c during recursive queries, causing an assertion failure and named exit. Affected are BIND 9.x releases listed in the advisory (pre-9.9.9-P4, pre-9.10...

CVE-2022-3924

CVE-2022-3924 is a vulnerability in ISC BIND where stale-answer-client-timeout (enabled with a positive value) can cause a race between returning a stale answer and an early SERVFAIL, potentially triggering an assertion failure and DoS. Affected are BIND 9.16.12–9.16.36, 9.18.0–9.18.10, 9.19.0–9....

CVE-2002-0651

CVE-2002-0651 relates to a buffer overflow in DNS resolver code used by libc, glibc, and libbind (originating from ISC BIND). Connected advisories describe that versions of ISC BIND upstream prior to 9.2.1 were vulnerable to a resolver buffer overflow which could be triggered by crafted DNS respo...

CVE-2022-3736

CVE-2022-3736 affects ISC BIND 9 resolvers. When stale-answer-cache is enabled and stale-answer-timeout is >0, receiving an RRSIG query can cause named to crash. Affected versions include 9.16.12–9.16.36, 9.18.0–9.18.10, 9.19.0–9.19.8 (and associated S1 builds). Patches exist: remediation is t...

CVE-2018-5743

CVE-2018-5743 affects BIND in multiple releases (notably 9.9.0–9.14.0, including some 9.11/9.13 branches). The flaw allows the named process to exceed its configured limit on simultaneous TCP connections, risking exhaustion of file descriptors and potentially affecting associated log/zone file ma...

CVE-2023-6516

CVE-2023-6516 affects ISC BIND (named) as a denial-of-service vector via an out-of-memory condition in the cache-cleanup path when recursive queries trigger maintenance. The issue can allow memory usage to exceed max-cache-size, potentially causing DoS on vulnerable BIND 9 installations. Affected...

CVE-2016-2776

CVE-2016-2776 describes a denial-of-service in ISC BIND where a crafted DNS query leads to an assertion failure in buffer.c while building responses, causing named to exit. Affected products/versions include BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3. The root ca...

CVE-2022-38177

CVE-2022-38177 is a memory-leak vulnerability in ISC BIND's DNSSEC code (ECDSA) that can allow a remote attacker spoofing responses to exhaust memory and crash named. Affected BIND versions prior to patched releases are prone; remediation is to upgrade to patched builds (e.g., BIND 9.16.33-1 or n...

CVE-2015-5986

ISC BIND vulnerability CVE-2015-5986 arises from an incorrect boundary check in openpgpkey_61.c within named, allowing remote attackers to crash the server via a crafted DNS response. Affected products/versions: BIND 9.9.7 before 9.9.7‑P3 and 9.10.x before 9.10.2‑P4. Exploitation can cause a deni...

CVE-2022-38178

CVE-2022-38178 affects BIND 9 DNS resolver. Attackers can spoof responses with a malformed EdDSA signature to trigger a memory leak, gradually exhausting memory and potentially crashing named. Connected advisories (Brocade SANnav postings with CVE-2022-38178, and ALAS/AmazonLinux entries) confirm...

CVE-2002-0029

CVE-2002-0029 concerns buffer overflows in the DNS stub resolver library used by ISC BIND (versions 4.9.2–4.9.10) and in derived libraries such as BSD libc and GNU glibc. The overflow occurs when processing certain DNS server responses that trigger the getnetbyname or getnetbyaddr code paths, all...

CVE-2016-9131

CVE-2016-9131 concerns ISC BIND and is triggered by improper handling of responses during recursion. A remote attacker can send a malformed RTYPE ANY response to cause an assertion failure and named process exit, i.e., a denial-of-service. Public advisories confirm affected versions across multip...

CVE-2015-8461

CVE-2015-8461 affects ISC BIND 9.9.8-P2 and 9.10.3-P2. A race condition in resolver.c when processing socket errors can trigger an INSIST assertion failure and cause named to exit, leading to remote denial of service. Remediation is to apply the fixed releases (9.9.8-P2 / 9.10.3-P2) or update to ...

CVE-2023-5679

CVE-2023-5679 : A bad interaction between DNS64 and serve-stale in ISC BIND can cause named to crash with an assertion failure during recursive resolution when both features are enabled. Affected products/versions include BIND 9.16.x (notably up to 9.16.45) and 9.18.x/9.19.x series with correspon...

CVE-2020-8623

CVE-2020-8623 affects BIND up to various maintained branches (notably 9.10.0–9.17.x). Root cause: native PKCS#11 code can trigger an assertion failure when processing queries for RSA-signed zones if BIND is built with --enable-native-pkcs11, leading to a crash and potential availability impact. A...

CVE-2013-4854

CVE-2013-4854 affects ISC BIND, where the RFC 5011 RDATA handling in rdata.c can trigger an assertion failure during log message construction when processing a malformed RDATA, allowing remote DoS with named exiting. Vulnerable ranges include BIND 9.7.x and 9.8.x before 9.8.5-P2 and 9.8.6b1, 9.9....

CVE-2023-5517

CVE-2023-5517 is a BIND vulnerability where a flaw in query-handling can cause named to exit with an assertion failure when nxdomain-redirect is configured and a PTR query for an RFC 1918 address would yield NXDOMAIN. Affected: BIND 9.x (various 9.12.0–9.19.19 and related 9.16/9.18 ranges; versio...

CVE-2012-5166

Summary (CVE-2012-5166) The BIND DNS server (named) is vulnerable to a remote DoS when specific combinations of RDATA are loaded in a query target, causing the server to lock up or crash. In affected environments using BIG-IP/F5 implementations, multiple product lines list vulnerable BIND compone...

CVE-2012-4244

CVE-2012-4244 affects BIND 9.x with RDATA values exceeding 65535 bytes, enabling remote DoS via assertion failure in the named daemon. Connected advisories confirm a broad impact across multiple distributions and products (FreeBSD SA-12:06.bind; CentOS/RHEL updates; Fedora package updates; F5 adv...

CVE-2019-6477

CVE-2019-6477 affects BIND (DNS server). It allows TCP-pipelined queries to bypass per-connection tcp-client limits, potentially causing denial of service by exhausting server resources and making the service unresponsive. Affected distributions reference patched releases: Debian DSA-4689-1 notes...

CVE-2012-3817

CVE-2012-3817 affects BIND when DNSSEC validation is enabled. Under high query load, BIND could use data from the failing-query cache before it is fully initialized, causing an assertion failure and resulting in a denial of service (remote crash of named). Affected ranges include various 9.4.x–9....

CVE-2020-8620

CVE-2020-8620 affects BIND 9.15.6–9.16.5 and 9.17.0–9.17.3, where libuv-based TCP handling allows an attacker to send data to trigger an assertion failure and crash the server. The vulnerability stems from an incorrectly specified maximum buffer size that can be exploited by a specially crafted l...

CVE-2015-5722

CVE-2015-5722 affects ISC BIND: a DoS via parsing a malformed DNSSEC key triggers an assertion failure in buffer.c, causing the validating resolver to exit. A remote attacker can exploit this with a crafted DNS query for a zone containing a malformed key. The vulnerability exists in BIND 9.x befo...

CVE-2016-2848

ISC BIND vulnerability CVE-2016-2848 affects BIND 9.1.0–9.8.4-P2 and 9.9.0–9.9.2-P2, allowing remote attackers to cause a denial of service (assertion failure and daemon exit) by sending malformed options data in an OPT resource record. Exploitation is via specially crafted DNS packets; impact is...

CVE-2015-5477

CVE-2015-5477 affects ISC BIND 9.x prior to 9.9.7-P2 and 9.10.x prior to 9.10.2-P3. Root cause: improper handling of TKEY DNS resource records causes an assertion failure, forcing the named daemon to exit and potentially crash. Impact: remote denial of service via crafted TKEY queries. Remediatio...

CVE-2013-2266

CVE-2013-2266 affects ISC BIND’s libdns, allowing remote attackers to trigger a denial of service by sending a crafted regular expression that drives memory usage. Affected are BIND 9.7.x and 9.8.x before 9.8.4-P2, 9.8.5 before 9.8.5b2, 9.9.x before 9.9.2-P2, and 9.9.3 before 9.9.3b2. Several ven...

CVE-2010-0382

CVE-2010-0382 affects ISC BIND 9.0.x–9.3.x and several newer 9.4/9.5/9.6/9.7 builds with DNSSEC validation enabled. The issue arises from a regression during the fix for CVE-2009-4022 and allows a remote attacker to influence a response via out-of-bailiwick data without re-fetching from the origi...

CVE-2018-5744

CVE-2018-5744 is a memory freeze/DoS in BIND caused by a failure to free memory when processing EDNS option combinations. Affected are BIND 9.10.7–9.10.8-P1, 9.11.3–9.11.5-P1, 9.12.0–9.12.3-P1, 9.10.7-S1–9.11.5-S3 (SPE), and 9.13.0–9.13.6 in the development line. Public advisories (e.g., Arch Lin...

CVE-2016-9444

CVE-2016-9444 affects ISC BIND 9.x; a crafted DS resource record in an answer can cause the named DNS server to crash via an assertion failure, if the BIND recursion option is enabled. The vulnerability is exploited remotely by an unauthenticated attacker and may cause the named process to exit (...

CVE-2018-5742

CVE-2018-5742 describes an assertion failure in BIND9 caused by a backport-related path in buffer.c:420, leading to a crash (denial of service). Affected are Red Hat family packages: bind-9.9.4-65.el7 through 9.9.4-72.el7, with no ISC releases affected; other distributions that replicated the err...

CVE-2008-4163

CVE-2008-4163 affects ISC BIND 9 for Windows: 9.3.5-P2-W1, 9.4.2-P2-W1, and 9.5.0-P2-W1. Described as an unspecified vulnerability that allows remote attackers to cause a denial of service by terminating the UDP client handler, via unknown vectors. Multiple connected sources (Red Hat, Ubuntu, Deb...

CVE-2020-8621

CVE-2020-8621 affects BIND when QNAME minimization is enabled together with forward-first forwarding, potentially causing the server to crash. The vulnerable ranges are BIND 9.14.0–9.16.5 and 9.17.0–9.17.3; forward-only configurations are not affected. The issue is due to an assertion failure in ...

CVE-2022-3080

CVE-2022-3080 affects ISC BIND: a DoS in named where a resolver can crash after receiving specially crafted queries when stale-cache/stale-answers options are used (zero stale-answer-timeout with a stale CNAME). Public advisories (IBM AIX, ALMAS/AlmaLinux, Cloud Foundry, Debian/Ubuntu notes) desc...

CVE-2026-5946

Summary of CVE-2026-5946 (CVE entry for named in BIND) : The issue involves the DNS message handling in the BIND 9 recursive resolver (named) when processing DNS classes other than IN (e.g., CHAOS/HESIOD) or non-IN data in questions. According to the sources, specially crafted requests reaching c...

CVE-2023-2829

CVE-2023-2829 affects BIND 9: named may terminate when synth-from-dnssec is enabled and a zone contains a malformed NSEC record. Affected versions are BIND 9.16.8-S1–9.16.41-S1 and 9.18.11-S1–9.18.15-S1. The issue is caused by parsing/processing of DNSSEC-cache data (NSEC) and can be triggered re...

CVE-2017-3135

ISC BIND 9 DNS64 and RPZ combined can crash the server. CVE-2017-3135 causes an assertion failure or NULL pointer dereference when query responses are rewritten with both DNS64 and RPZ enabled, leading to a denial of service. Affected versions include BIND 9.8.8 and 9.9.3–9.9.9 (S1–S7/P5), 9.9.10...