Isc Bind
184 CVEs affecting Isc Bind. Latest disclosed: 2026-05-20. Critical: 0, High: 63.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-8616 | High | 8.6 | 2020-05-19 | A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the us… |
CVE-2016-1286 | High | 8.6 | 2016-03-09 | named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via… |
CVE-2021-25216 | High | 8.1 | 2021-04-29 | In BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well a… |
CVE-2020-8625 | High | 8.1 | 2021-02-17 | BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default s… |
CVE-2001-0497 | High | 7.8 | 2001-07-21 | dnskeygen in BIND 8.2.4 and earlier, and dnssec-keygen in BIND 9.1.2 and earlier, set insecure permissions for a HMAC-MD5 shared secret key file used for DNS T… |
CVE-2026-5947 | High | 7.5 | 2026-05-20 | Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signed with SIG(0), it b… |
CVE-2026-5946 | High | 7.5 | 2026-05-20 | Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, o… |
CVE-2026-3039 | High | 7.5 | 2026-05-20 | BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processi… |
CVE-2026-3104 | High | 7.5 | 2026-03-25 | A specially crafted domain can be used to cause a memory leak in a BIND resolver simply by querying this domain. This issue affects BIND 9 versions 9.20.0 thro… |
CVE-2026-1519 | High | 7.5 | 2026-03-25 | If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only server… |
CVE-2023-50868 | High | 7.5 | 2024-02-14 | The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU… |
CVE-2023-50387 | High | 7.5 | 2024-02-14 | Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumpti… |
CVE-2023-6516 | High | 7.5 | 2024-02-13 | To keep its cache database efficient, `named` running as a recursive resolver occasionally attempts to clean up the database. It uses several methods, includin… |
CVE-2023-5679 | High | 7.5 | 2024-02-13 | A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure during recursive resolution, when both of these features a… |
CVE-2023-5517 | High | 7.5 | 2024-02-13 | A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when: - `nxdomain-redirect <domain>;` is configured, and - t… |
CVE-2023-4408 | High | 7.5 | 2024-02-13 | The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, b… |
CVE-2023-4236 | High | 7.5 | 2023-09-20 | A flaw in the networking code handling DNS-over-TLS queries may cause `named` to terminate unexpectedly due to an assertion failure. This happens when internal… |
CVE-2023-3341 | High | 7.5 | 2023-09-20 | The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth is only limited by… |
CVE-2023-2911 | High | 7.5 | 2023-06-21 | If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable yes;` and `stale-answer-client-timeout 0;`, a sequen… |
CVE-2023-2829 | High | 7.5 | 2023-06-21 | A `named` instance configured to run as a DNSSEC-validating recursive resolver with the Aggressive Use of DNSSEC-Validated Cache (RFC 8198) option (`synth-from… |