CVE-2026-80274 | High | 7.5 | 2026-09-16 | If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 pro… |
CVE-2026-77119 | Medium | 5.9 | 2026-09-16 | A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned ans… |
CVE-2026-76163 | High | 7.5 | 2026-09-16 | If BIND is loaded with a "`named.conf`" file that contains no global "`options`" block, an attacker can send a query of QTYPE TKEY which may cause an assertion… |
CVE-2026-75029 | Medium | 5.3 | 2026-09-16 | In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on… |
CVE-2026-19668 | Medium | 5.3 | 2026-09-16 | A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record. Default… |
CVE-2026-19666 | High | 7.5 | 2026-09-16 | On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process w… |
CVE-2026-19033 | Medium | 6.5 | 2026-09-16 | For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG… |
CVE-2026-81736 | High | 7.5 | 2026-09-16 | If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate C… |
CVE-2026-81563 | High | 7.5 | 2026-09-16 | A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal reso… |
CVE-2026-78301 | Medium | 5.8 | 2026-09-16 | A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND auth… |
CVE-2026-77692 | High | 7.5 | 2026-09-16 | An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transpo… |
CVE-2026-19941 | Medium | 5.9 | 2026-09-16 | An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream le… |
CVE-2026-19667 | High | 7.5 | 2026-09-16 | If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache en… |
CVE-2026-19662 | Medium | 5.9 | 2026-09-16 | An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zon… |
CVE-2026-13321 | High | 8.6 | 2026-07-22 | The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone.
This issue affects BIND 9 versions 9… |
CVE-2026-13204 | High | 7.5 | 2026-07-22 | If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may ex… |
CVE-2026-12617 | High | 7.5 | 2026-07-22 | The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically… |
CVE-2026-11721 | High | 7.5 | 2026-07-22 | It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. Th… |
CVE-2026-11622 | High | 7.5 | 2026-07-22 | A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to b… |
CVE-2026-11605 | High | 7.5 | 2026-07-22 | The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not… |
CVE-2026-11331 | High | 7.5 | 2026-07-22 | An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condi… |
CVE-2026-10822 | Medium | 6.5 | 2026-07-22 | If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit.
BIND will first… |
CVE-2026-10723 | Medium | 6.8 | 2026-07-22 | BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses.
This issue affects BIND 9… |
CVE-2026-5950 | Medium | 5.3 | 2026-05-20 | An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to ca… |
CVE-2026-5947 | High | 7.5 | 2026-05-20 | Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signed with SIG(0), it b… |
CVE-2026-5946 | High | 7.5 | 2026-05-20 | Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, o… |
CVE-2026-3593 | High | 7.4 | 2026-05-20 | A use-after-free vulnerability exists within the DNS-over-HTTPS implementation.
This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21… |
CVE-2026-3592 | Medium | 5.3 | 2026-05-20 | BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone, the reso… |
CVE-2026-3039 | High | 7.5 | 2026-05-20 | BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processi… |
CVE-2026-3591 | Medium | 5.4 | 2026-03-25 | A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker… |
CVE-2026-3119 | Medium | 6.5 | 2026-03-25 | Under certain conditions, `named` may crash when processing a correctly signed query containing a TKEY record. The affected code can only be reached if an inco… |
CVE-2026-3104 | High | 7.5 | 2026-03-25 | A specially crafted domain can be used to cause a memory leak in a BIND resolver simply by querying this domain.
This issue affects BIND 9 versions 9.20.0 thro… |
CVE-2026-1519 | High | 7.5 | 2026-03-25 | If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only server… |
CVE-2026-3608 | High | 7.5 | 2026-03-25 | Sending a maliciously crafted message to the kea-ctrl-agent, kea-dhcp-ddns, kea-dhcp4, or kea-dhcp6 daemons over any configured API socket or HA listener can c… |
CVE-2025-13878 | High | 7.5 | 2026-01-21 | Malformed BRID/HHIT records can cause `named` to terminate unexpectedly.
This issue affects BIND 9 versions 9.18.40 through 9.18.43, 9.20.13 through 9.20.17, 9… |
CVE-2025-11232 | High | 7.5 | 2025-10-29 | To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at the default setting, which is "[^A-Za-z0-… |
CVE-2025-8677 | High | 7.5 | 2025-10-22 | Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion.
This issue affects BIND 9 versions… |
CVE-2025-40780 | High | 8.6 | 2025-10-22 | In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source po… |
CVE-2025-40778 | High | 8.6 | 2025-10-22 | Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache.
This issue aff… |
CVE-2025-8696 | High | 7.5 | 2025-09-10 | If an unauthenticated user sends a large amount of data to the Stork UI, it may cause memory and disk use problems for the system running the Stork server.
Thi… |
CVE-2025-40779 | High | 7.5 | 2025-08-27 | If a DHCPv4 client sends a request with some specific options, and Kea fails to find an appropriate subnet for the client, the `kea-dhcp4` process will abort w… |
CVE-2025-40777 | High | 7.5 | 2025-07-16 | If a `named` caching resolver is configured with `serve-stale-enable` `yes`, and with `stale-answer-client-timeout` set to `0` (the only allowable value other… |
CVE-2025-40776 | High | 8.6 | 2025-07-16 | A `named` caching resolver that is configured to send ECS (EDNS Client Subnet) options may be vulnerable to a cache-poisoning attack.
This issue affects BIND 9… |
CVE-2025-32803 | Medium | 4.0 | 2025-05-28 | In some cases, Kea log files or lease files may be world-readable.
This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through… |
CVE-2025-32802 | Medium | 6.1 | 2025-05-28 | Kea configuration and API directives can be used to overwrite arbitrary files, subject to permissions granted to Kea. Many common configurations run Kea as ro… |
CVE-2025-32801 | High | 7.8 | 2025-05-28 | Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea as root, leave the API entry points unse… |
CVE-2025-40775 | High | 7.5 | 2025-05-21 | When an incoming DNS protocol message includes a Transaction Signature (TSIG), BIND always checks it. If the TSIG contains an invalid value in the algorithm f… |
CVE-2024-12705 | High | 7.5 | 2025-01-29 | Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic.
This issue affec… |
CVE-2024-11187 | High | 7.5 | 2025-01-29 | It is possible to construct a zone such that some queries to it will generate responses containing numerous records in the Additional section. An attacker send… |
CVE-2024-4076 | High | 7.5 | 2024-07-23 | Client queries that trigger serving stale data and that also require lookups in local authoritative zone data may result in an assertion failure.
This issue af… |
CVE-2024-1975 | High | 7.5 | 2024-07-23 | If a server hosts a zone containing a "KEY" Resource Record, or a resolver DNSSEC-validates a "KEY" Resource Record from a DNSSEC-signed domain in cache, a cli… |
CVE-2024-1737 | High | 7.5 | 2024-07-23 | Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname (of any RTYPE) can suffer from degraded performance… |
CVE-2024-0760 | High | 7.5 | 2024-07-23 | A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may recov… |
CVE-2024-28872 | High | 8.9 | 2024-07-11 | The TLS certificate validation code is flawed. An attacker can obtain a TLS certificate from the Stork server and use it to connect to the Stork agent. Once th… |
CVE-2023-50868 | High | 7.5 | 2024-02-14 | The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU… |
CVE-2023-50387 | High | 7.5 | 2024-02-14 | Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumpti… |
CVE-2023-6516 | High | 7.5 | 2024-02-13 | To keep its cache database efficient, `named` running as a recursive resolver occasionally attempts to clean up the database. It uses several methods, includin… |
CVE-2023-5680 | Medium | 5.3 | 2024-02-13 | If a resolver cache has a very large number of ECS records stored for the same name, the process of cleaning the cache database node for this name can signific… |
CVE-2023-5679 | High | 7.5 | 2024-02-13 | A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure during recursive resolution, when both of these features a… |
CVE-2023-5517 | High | 7.5 | 2024-02-13 | A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when:
- `nxdomain-redirect <domain>;` is configured, and
- t… |
CVE-2023-4408 | High | 7.5 | 2024-02-13 | The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, b… |
CVE-2023-4236 | High | 7.5 | 2023-09-20 | A flaw in the networking code handling DNS-over-TLS queries may cause `named` to terminate unexpectedly due to an assertion failure. This happens when internal… |
CVE-2023-3341 | High | 7.5 | 2023-09-20 | The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth is only limited by… |
CVE-2023-2911 | High | 7.5 | 2023-06-21 | If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable yes;` and `stale-answer-client-timeout 0;`, a sequen… |
CVE-2023-2829 | High | 7.5 | 2023-06-21 | A `named` instance configured to run as a DNSSEC-validating recursive resolver with the Aggressive Use of DNSSEC-Validated Cache (RFC 8198) option (`synth-from… |
CVE-2023-2828 | High | 7.5 | 2023-06-21 | Every `named` instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to author… |
CVE-2022-3924 | High | 7.5 | 2023-01-26 | This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value… |
CVE-2022-3736 | High | 7.5 | 2023-01-26 | BIND 9 resolver can crash when stale cache and stale answers are enabled, option `stale-answer-client-timeout` is set to a positive integer, and the resolver r… |
CVE-2022-3488 | High | 7.5 | 2023-01-26 | Processing of repeated responses to the same query, where both responses contain ECS pseudo-options, but where the first is broken in some way, can cause BIND… |
CVE-2022-3094 | High | 7.5 | 2023-01-26 | Sending a flood of dynamic DNS updates may cause `named` to allocate large amounts of memory. This, in turn, may cause `named` to exit due to a lack of free me… |
CVE-2022-2929 | Medium | 6.5 | 2022-10-07 | In ISC DHCP 1.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1 a system with access to a DHCP server, sending DHCP packets crafted to include fqdn labels long… |
CVE-2022-2928 | Medium | 6.5 | 2022-10-07 | In ISC DHCP 4.4.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1, when the function option_code_hash_lookup() is called from add_option(), it increases the op… |
CVE-2022-3080 | High | 7.5 | 2022-09-21 | By sending specific queries to the resolver, an attacker can cause named to crash. |
CVE-2022-38178 | High | 7.5 | 2022-09-21 | By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually… |
CVE-2022-38177 | High | 7.5 | 2022-09-21 | By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually… |
CVE-2022-2906 | High | 7.5 | 2022-09-21 | An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would… |
CVE-2022-2881 | Medium | 5.5 | 2022-09-21 | The underlying bug might cause read past end of the buffer and either read memory it should not read, or crash the process. |
CVE-2022-2795 | Medium | 5.3 | 2022-09-21 | By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitima… |
CVE-2022-1183 | High | 7.5 | 2022-05-19 | On vulnerable configurations, the named daemon may, in some circumstances, terminate with an assertion failure. Vulnerable configurations are those that includ… |
CVE-2021-25220 | Medium | 6.8 | 2022-03-23 | BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 e… |
CVE-2022-0635 | High | 7.5 | 2022-03-23 | Versions affected: BIND 9.18.0 When a vulnerable version of named receives a series of specific queries, the named process will eventually terminate due to a f… |
CVE-2022-0396 | Medium | 5.3 | 2022-03-23 | BIND 9.16.11 -> 9.16.26, 9.17.0 -> 9.18.0 and versions 9.16.11-S1 -> 9.16.26-S1 of the BIND Supported Preview Edition. Specifically crafted TCP streams can cau… |
CVE-2022-0667 | High | 7.5 | 2022-03-22 | When the vulnerability is triggered the BIND process will exit. BIND 9.18.0 |
CVE-2021-25219 | Medium | 5.3 | 2021-10-27 | In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as rele… |
CVE-2021-25218 | High | 7.5 | 2021-08-18 | In BIND 9.16.19, 9.17.16. Also, version 9.16.19-S1 of BIND Supported Preview Edition When a vulnerable version of named receives a query under the circumstance… |
CVE-2021-25217 | High | 7.4 | 2021-05-26 | In ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16, ISC DHCP 4.4.0 -> 4.4.2 (Other branches of ISC DHCP (i.e., releases in the 4.0.x series or lower and releases in the 4.3… |
CVE-2021-25216 | High | 8.1 | 2021-04-29 | In BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well a… |
CVE-2021-25215 | High | 7.5 | 2021-04-29 | In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as… |
CVE-2021-25214 | Medium | 6.5 | 2021-04-29 | In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview E… |
CVE-2020-8625 | High | 8.1 | 2021-02-17 | BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default s… |
CVE-2020-8624 | Medium | 4.3 | 2020-08-21 | In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1… |
CVE-2020-8623 | High | 7.5 | 2020-08-21 | In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that c… |
CVE-2020-8622 | Medium | 6.5 | 2020-08-21 | In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the n… |
CVE-2020-8621 | High | 7.5 | 2020-08-21 | In BIND 9.14.0 -> 9.16.5, 9.17.0 -> 9.17.3, If a server is configured with both QNAME minimization and 'forward first' then an attacker who can send queries to… |
CVE-2020-8620 | High | 7.5 | 2020-08-21 | In BIND 9.15.6 -> 9.16.5, 9.17.0 -> 9.17.3, An attacker who can establish a TCP connection with the server and send data on that connection can exploit this to… |
CVE-2020-8619 | Medium | 4.9 | 2020-06-17 | In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND Supported Preview Edition 9.11.14-S1 -> 9.11.19-S1: Unless a… |
CVE-2020-8618 | Medium | 4.9 | 2020-06-17 | An attacker who is permitted to send zone data to a server via zone transfer can exploit this to intentionally trigger the assertion failure with a specially c… |
CVE-2020-8617 | High | 7.5 | 2020-05-19 | Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesse… |
CVE-2020-8616 | High | 8.6 | 2020-05-19 | A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the us… |
CVE-2019-6477 | High | 7.5 | 2019-11-26 | With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelinin… |