Bind (Isc) - vulnerabilities (CVEs)

216 CVEs, 4 in the last 30 days, 1956 known versions, newest CVE from 2026-10-21. Vendor: Isc.

CVEs of Bind

CVE-2026-97313 - CVSS 7.5 (high), 2026-10-21: A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure,…
CVE-2026-96888 - CVSS 7.5 (high), 2026-10-21: A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the…
CVE-2026-94300 - CVSS 8.1 (high), 2026-10-21: Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it…
CVE-2026-19630 - CVSS 7.5 (high), 2026-10-21: In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS…
CVE-2026-77119 - CVSS 5.9 (medium), 2026-09-16: A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned…
CVE-2026-75029 - CVSS 5.3 (medium), 2026-09-16: In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on…
CVE-2026-19668 - CVSS 5.3 (medium), 2026-09-16: A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record. Default…
CVE-2026-19033 - CVSS 6.5 (medium), 2026-09-16: For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG…
CVE-2026-80274 - CVSS 7.5 (high), 2026-09-16: If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3…
CVE-2026-76163 - CVSS 7.5 (high), 2026-09-16: If BIND is loaded with a "`named.conf`" file that contains no global "`options`" block, an attacker can send a query of QTYPE TKEY which may cause an…
CVE-2026-19666 - CVSS 7.5 (high), 2026-09-16: On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process…
CVE-2026-81563 - CVSS 7.5 (high), 2026-09-16: A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal…
CVE-2026-78301 - CVSS 5.8 (medium), 2026-09-16: A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND…
CVE-2026-77692 - CVSS 7.5 (high), 2026-09-16: An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the…
CVE-2026-19941 - CVSS 5.9 (medium), 2026-09-16: An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream…
CVE-2026-19662 - CVSS 5.9 (medium), 2026-09-16: An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed…
CVE-2026-19667 - CVSS 7.5 (high), 2026-09-16: If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache…
CVE-2026-81736 - CVSS 7.5 (high), 2026-09-16: If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate…
CVE-2026-13321 - CVSS 8.6 (high), 2026-07-22: The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. This issue affects BIND 9 versions…
CVE-2026-13204 - CVSS 7.5 (high), 2026-07-22: If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may…
CVE-2026-12617 - CVSS 7.5 (high), 2026-07-22: The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically,…
CVE-2026-11721 - CVSS 7.5 (high), 2026-07-22: It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained.…
CVE-2026-11622 - CVSS 7.5 (high), 2026-07-22: A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to…
CVE-2026-11605 - CVSS 7.5 (high), 2026-07-22: The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not…
CVE-2026-11331 - CVSS 7.5 (high), 2026-07-22: An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error…
CVE-2026-10822 - CVSS 6.5 (medium), 2026-07-22: If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first…
CVE-2026-10723 - CVSS 6.8 (medium), 2026-07-22: BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND…
CVE-2026-5950 - CVSS 5.3 (medium), 2026-05-20: An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to…
CVE-2026-5947 - CVSS 7.5 (high), 2026-05-20: Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signed with SIG(0), it…
CVE-2026-5946 - CVSS 7.5 (high), 2026-05-20: Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`,…
CVE-2026-3593 - CVSS 9.8 (critical), 2026-05-20: A use-after-free vulnerability exists within the DNS-over-HTTPS implementation. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through…
CVE-2026-3592 - CVSS 5.3 (medium), 2026-05-20: BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone, the…
CVE-2026-3039 - CVSS 7.5 (high), 2026-05-20: BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and…
CVE-2026-3591 - CVSS 5.4 (medium), 2026-03-25: A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker…
CVE-2026-3119 - CVSS 6.5 (medium), 2026-03-25: Under certain conditions, `named` may crash when processing a correctly signed query containing a TKEY record. The affected code can only be reached if an…
CVE-2026-3104 - CVSS 7.5 (high), 2026-03-25: A specially crafted domain can be used to cause a memory leak in a BIND resolver simply by querying this domain. This issue affects BIND 9 versions 9.20.0…
CVE-2026-1519 - CVSS 7.5 (high), 2026-03-25: If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only…
CVE-2025-13878 - CVSS 7.5 (high), 2026-01-21: Malformed BRID/HHIT records can cause `named` to terminate unexpectedly. This issue affects BIND 9 versions 9.18.40 through 9.18.43, 9.20.13 through 9.20.17,…
CVE-2024-4076 - CVSS 7.5 (high), 2024-07-23: Client queries that trigger serving stale data and that also require lookups in local authoritative zone data may result in an assertion failure. This issue…
CVE-2024-1975 - CVSS 7.5 (high), 2024-07-23: If a server hosts a zone containing a "KEY" Resource Record, or a resolver DNSSEC-validates a "KEY" Resource Record from a DNSSEC-signed domain in cache, a…
CVE-2024-1737 - CVSS 7.5 (high), 2024-07-23: Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname (of any RTYPE) can suffer from degraded…
CVE-2024-0760 - CVSS 7.5 (high), 2024-07-23: A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may…
CVE-2023-50868 - CVSS 7.5 (high), 2024-02-14: The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service…
CVE-2023-50387 - CVSS 7.5 (high), 2024-02-14: Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU…
CVE-2023-6516 - CVSS 7.5 (high), 2024-02-13: To keep its cache database efficient, `named` running as a recursive resolver occasionally attempts to clean up the database. It uses several methods,…
CVE-2023-5679 - CVSS 7.5 (high), 2024-02-13: A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure during recursive resolution, when both of these features…
CVE-2023-5517 - CVSS 7.5 (high), 2024-02-13: A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when: - `nxdomain-redirect <domain>;` is configured, and - the…
CVE-2023-4408 - CVSS 7.5 (high), 2024-02-13: The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic,…
CVE-2023-5680 - CVSS 5.3 (medium), 2024-02-13: If a resolver cache has a very large number of ECS records stored for the same name, the process of cleaning the cache database node for this name can…
CVE-2023-4236 - CVSS 7.5 (high), 2023-09-20: A flaw in the networking code handling DNS-over-TLS queries may cause `named` to terminate unexpectedly due to an assertion failure. This happens when…
CVE-2023-3341 - CVSS 7.5 (high), 2023-09-20: The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth is only limited by…
CVE-2023-2829 - CVSS 7.5 (high), 2023-06-21: A `named` instance configured to run as a DNSSEC-validating recursive resolver with the Aggressive Use of DNSSEC-Validated Cache (RFC 8198) option…
CVE-2023-2828 - CVSS 7.5 (high), 2023-06-21: Every `named` instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to…
CVE-2023-2911 - CVSS 7.5 (high), 2023-06-21: If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable yes;` and `stale-answer-client-timeout 0;`, a…
CVE-2022-3924 - CVSS 7.5 (high), 2023-01-26: This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value…
CVE-2022-3736 - CVSS 7.5 (high), 2023-01-26: BIND 9 resolver can crash when stale cache and stale answers are enabled, option `stale-answer-client-timeout` is set to a positive integer, and the resolver…
CVE-2022-3488 - CVSS 7.5 (high), 2023-01-26: Processing of repeated responses to the same query, where both responses contain ECS pseudo-options, but where the first is broken in some way, can cause BIND…
CVE-2022-3094 - CVSS 7.5 (high), 2023-01-26: Sending a flood of dynamic DNS updates may cause `named` to allocate large amounts of memory. This, in turn, may cause `named` to exit due to a lack of free…
CVE-2022-3080 - CVSS 7.5 (high), 2022-09-21: By sending specific queries to the resolver, an attacker can cause named to crash.
CVE-2022-2881 - CVSS 8.2 (high), 2022-09-21: The underlying bug might cause read past end of the buffer and either read memory it should not read, or crash the process.
CVE-2022-38178 - CVSS 7.5 (high), 2022-09-21: By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually…
CVE-2022-2795 - CVSS 5.3 (medium), 2022-09-21: By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying…
CVE-2022-38177 - CVSS 7.5 (high), 2022-09-21: By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually…
CVE-2022-2906 - CVSS 7.5 (high), 2022-09-21: An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would…
CVE-2022-1183 - CVSS 7.5 (high), 2022-05-19: On vulnerable configurations, the named daemon may, in some circumstances, terminate with an assertion failure. Vulnerable configurations are those that…
CVE-2021-25220 - CVSS 6.8 (medium), 2022-03-23: BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9…
CVE-2022-0635 - CVSS 7.5 (high), 2022-03-23: Versions affected: BIND 9.18.0 When a vulnerable version of named receives a series of specific queries, the named process will eventually terminate due to a…
CVE-2022-0396 - CVSS 5.3 (medium), 2022-03-23: BIND 9.16.11 -> 9.16.26, 9.17.0 -> 9.18.0 and versions 9.16.11-S1 -> 9.16.26-S1 of the BIND Supported Preview Edition. Specifically crafted TCP streams can…
CVE-2022-0667 - CVSS 7.5 (high), 2022-03-22: When the vulnerability is triggered the BIND process will exit. BIND 9.18.0
CVE-2021-25219 - CVSS 5.3 (medium), 2021-10-27: In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as…
CVE-2021-25218 - CVSS 7.5 (high), 2021-08-18: In BIND 9.16.19, 9.17.16. Also, version 9.16.19-S1 of BIND Supported Preview Edition When a vulnerable version of named receives a query under the…
CVE-2021-25215 - CVSS 7.5 (high), 2021-04-29: In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well…
CVE-2021-25216 - CVSS 9.8 (critical), 2021-04-29: In BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well…
CVE-2021-25214 - CVSS 6.5 (medium), 2021-04-29: In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview…
CVE-2020-8625 - CVSS 8.1 (high), 2021-02-17: BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default…
CVE-2020-8621 - CVSS 7.5 (high), 2020-08-21: In BIND 9.14.0 -> 9.16.5, 9.17.0 -> 9.17.3, If a server is configured with both QNAME minimization and 'forward first' then an attacker who can send queries…
CVE-2020-8624 - CVSS 4.3 (medium), 2020-08-21: In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 ->…
CVE-2020-8620 - CVSS 7.5 (high), 2020-08-21: In BIND 9.15.6 -> 9.16.5, 9.17.0 -> 9.17.3, An attacker who can establish a TCP connection with the server and send data on that connection can exploit this…
CVE-2020-8623 - CVSS 7.5 (high), 2020-08-21: In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that…
CVE-2020-8622 - CVSS 6.5 (medium), 2020-08-21: In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the…
CVE-2020-8619 - CVSS 4.9 (medium), 2020-06-17: In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND Supported Preview Edition 9.11.14-S1 -> 9.11.19-S1: Unless…
CVE-2020-8618 - CVSS 4.9 (medium), 2020-06-17: An attacker who is permitted to send zone data to a server via zone transfer can exploit this to intentionally trigger the assertion failure with a specially…
CVE-2020-8617 - CVSS 7.5 (high), 2020-05-19: Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully…
CVE-2020-8616 - CVSS 8.6 (high), 2020-05-19: A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the…
CVE-2019-6477 - CVSS 7.5 (high), 2019-11-26: With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without…
CVE-2013-5661 - CVSS 5.9 (medium), 2019-11-05: Cache Poisoning issue exists in DNS Response Rate Limiting.
CVE-2018-5742 - CVSS 7.5 (high), 2019-10-30: While backporting a feature for a newer branch of BIND9, RedHat introduced a path leading to an assertion failure in buffer.c:420. Affects RedHat versions…
CVE-2019-6475 - CVSS 7.5 (high), 2019-10-17: Mirror zones are a BIND feature allowing recursive servers to pre-cache zone data provided by other servers. A mirror zone is similar to a zone of type…
CVE-2019-6476 - CVSS 7.5 (high), 2019-10-17: A defect in code added to support QNAME minimization can cause named to exit with an assertion failure if a forwarder returns a referral rather than resolving…
CVE-2019-6471 - CVSS 5.9 (medium), 2019-10-09: A race condition which may occur when discarding malformed packets can result in BIND exiting due to a REQUIRE assertion failure in dispatch.c. Versions…
CVE-2019-6469 - CVSS 7.5 (high), 2019-10-09: An error in the EDNS Client Subnet (ECS) feature for recursive resolvers can cause BIND to exit with an assertion failure when processing a response that has…
CVE-2019-6468 - CVSS 7.5 (high), 2019-10-09: In BIND Supported Preview Edition, an error in the nxdomain-redirect feature can occur in versions which support EDNS Client Subnet (ECS) features. In those…
CVE-2019-6467 - CVSS 7.5 (high), 2019-10-09: A programming error in the nxdomain-redirect feature can cause an assertion failure in query.c if the alternate namespace used by nxdomain-redirect is a…
CVE-2019-6465 - CVSS 5.3 (medium), 2019-10-09: Controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones are writable Versions affected: BIND 9.9.0 ->…
CVE-2018-5745 - CVSS 4.9 (medium), 2019-10-09: "managed-keys" is a feature which allows a BIND resolver to automatically maintain the keys used by trust anchors which operators configure for use in DNSSEC…
CVE-2018-5744 - CVSS 7.5 (high), 2019-10-09: A failure to free memory can occur when processing messages having a specific combination of EDNS options. Versions affected are: BIND 9.10.7 -> 9.10.8-P1,…
CVE-2018-5743 - CVSS 7.5 (high), 2019-10-09: By design, BIND is intended to limit the number of TCP clients that can be connected at any given time. The number of allowed connections is a tunable…
CVE-2018-5740 - CVSS 7.5 (high), 2019-01-16: "deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method…
CVE-2018-5741 - CVSS 6.5 (medium), 2019-01-16: To provide fine-grained controls over the ability to use Dynamic DNS (DDNS) to update records in a zone, BIND 9 provides a feature called update-policy.…
CVE-2017-3136 - CVSS 5.9 (medium), 2019-01-16: A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate. An attacker could…