https://vulnogram.org/ Most recent CVEs assigned by Internet Systems Consortium (ISC) (isc). https://vulnogram.org/seaview/icons/isc.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-77119 https://vulnogram.org/CVE-2026-77119 A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20… Medium Network Exploitable Wed, 16 Sep 2026 14:17:11 GMT https://vulnogram.org/CVE-2026-75029 https://vulnogram.org/CVE-2026-75029 In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increase… Medium Network Exploitable Wed, 16 Sep 2026 14:15:12 GMT https://vulnogram.org/CVE-2026-19668 https://vulnogram.org/CVE-2026-19668 A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record. Default limits on "max-records-per-type" and "max-types-per-name" help mitigate the exposure. This i… Medium Network Exploitable Wed, 16 Sep 2026 14:12:34 GMT https://vulnogram.org/CVE-2026-19033 https://vulnogram.org/CVE-2026-19033 For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG… Medium Network Exploitable Wed, 16 Sep 2026 14:10:08 GMT https://vulnogram.org/CVE-2026-80274 https://vulnogram.org/CVE-2026-80274 If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected prog… High Network Exploitable Wed, 16 Sep 2026 14:07:20 GMT https://vulnogram.org/CVE-2026-76163 https://vulnogram.org/CVE-2026-76163 If BIND is loaded with a "`named.conf`" file that contains no global "`options`" block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure and subsequent unexpected program exit. This issue affects BIND 9 versions 9.20.0… High Network Exploitable Wed, 16 Sep 2026 14:05:34 GMT https://vulnogram.org/CVE-2026-19666 https://vulnogram.org/CVE-2026-19666 On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 th… High Network Exploitable Wed, 16 Sep 2026 14:02:30 GMT https://vulnogram.org/CVE-2026-81563 https://vulnogram.org/CVE-2026-81563 A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver… High Network Exploitable Wed, 16 Sep 2026 14:00:04 GMT https://vulnogram.org/CVE-2026-78301 https://vulnogram.org/CVE-2026-78301 A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone th… Medium Wed, 16 Sep 2026 13:58:11 GMT https://vulnogram.org/CVE-2026-77692 https://vulnogram.org/CVE-2026-77692 An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.… High Network Exploitable Wed, 16 Sep 2026 13:55:45 GMT https://vulnogram.org/CVE-2026-19941 https://vulnogram.org/CVE-2026-19941 An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record. This issue affect… Medium Network Exploitable Wed, 16 Sep 2026 13:52:49 GMT https://vulnogram.org/CVE-2026-19662 https://vulnogram.org/CVE-2026-19662 An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds… Medium Network Exploitable Wed, 16 Sep 2026 13:50:10 GMT https://vulnogram.org/CVE-2026-19667 https://vulnogram.org/CVE-2026-19667 If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts. This issue affects BI… High Network Exploitable Wed, 16 Sep 2026 13:46:56 GMT https://vulnogram.org/CVE-2026-81736 https://vulnogram.org/CVE-2026-81736 If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.5… High Network Exploitable Wed, 16 Sep 2026 13:44:28 GMT https://vulnogram.org/CVE-2026-13321 https://vulnogram.org/CVE-2026-13321 The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.… High Network Exploitable Wed, 22 Jul 2026 14:16:10 GMT https://vulnogram.org/CVE-2026-13204 https://vulnogram.org/CVE-2026-13204 If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 ve… High Network Exploitable Wed, 22 Jul 2026 14:15:30 GMT https://vulnogram.org/CVE-2026-12617 https://vulnogram.org/CVE-2026-12617 The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the autho… High Network Exploitable Wed, 22 Jul 2026 14:14:46 GMT https://vulnogram.org/CVE-2026-11721 https://vulnogram.org/CVE-2026-11721 It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's… High Network Exploitable Wed, 22 Jul 2026 14:13:08 GMT https://vulnogram.org/CVE-2026-11622 https://vulnogram.org/CVE-2026-11622 A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memor… High Network Exploitable Wed, 22 Jul 2026 14:12:19 GMT https://vulnogram.org/CVE-2026-11605 https://vulnogram.org/CVE-2026-11605 The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but super… High Network Exploitable Wed, 22 Jul 2026 14:11:37 GMT https://vulnogram.org/CVE-2026-11331 https://vulnogram.org/CVE-2026-11331 An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ… High Network Exploitable Wed, 22 Jul 2026 14:10:44 GMT https://vulnogram.org/CVE-2026-10822 https://vulnogram.org/CVE-2026-10822 If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS… Medium Network Exploitable Wed, 22 Jul 2026 14:09:57 GMT https://vulnogram.org/CVE-2026-10723 https://vulnogram.org/CVE-2026-10723 BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1… Medium Network Exploitable Wed, 22 Jul 2026 14:08:19 GMT https://vulnogram.org/CVE-2026-5950 https://vulnogram.org/CVE-2026-5950 An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions. T… Medium Network Exploitable Wed, 20 May 2026 13:10:19 GMT https://vulnogram.org/CVE-2026-5947 https://vulnogram.org/CVE-2026-5947 Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signed with SIG(0), it begins work to validate that signature. If, during that validation, the "recursive-clients" l… High Network Exploitable Wed, 20 May 2026 13:10:11 GMT https://vulnogram.org/CVE-2026-5946 https://vulnogram.org/CVE-2026-5946 Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section. Special… High Network Exploitable Wed, 20 May 2026 13:10:03 GMT https://vulnogram.org/CVE-2026-3593 https://vulnogram.org/CVE-2026-3593 A use-after-free vulnerability exists within the DNS-over-HTTPS implementation. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.0 through 9.18.48 and 9.18.11-S1… High Network Exploitable Wed, 20 May 2026 13:09:47 GMT https://vulnogram.org/CVE-2026-3592 https://vulnogram.org/CVE-2026-3592 BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This issue affects BIND 9 versions 9.11.0 thro… Medium Network Exploitable Wed, 20 May 2026 13:09:21 GMT https://vulnogram.org/CVE-2026-3039 https://vulnogram.org/CVE-2026-3039 BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets. Typically these servers will be found in Active Directo… High Network Exploitable Wed, 20 May 2026 13:09:04 GMT https://vulnogram.org/CVE-2026-3591 https://vulnogram.org/CVE-2026-3591 A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL… Medium Wed, 25 Mar 2026 13:34:14 GMT https://vulnogram.org/CVE-2026-3119 https://vulnogram.org/CVE-2026-3119 Under certain conditions, `named` may crash when processing a correctly signed query containing a TKEY record. The affected code can only be reached if an incoming request has a valid transaction signature (TSIG) from a key declared in the `named` co… Medium Wed, 25 Mar 2026 13:31:54 GMT https://vulnogram.org/CVE-2026-3104 https://vulnogram.org/CVE-2026-3104 A specially crafted domain can be used to cause a memory leak in a BIND resolver simply by querying this domain. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18… High Network Exploitable Wed, 25 Mar 2026 13:29:19 GMT https://vulnogram.org/CVE-2026-1519 https://vulnogram.org/CVE-2026-1519 If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers ma… High Network Exploitable Wed, 25 Mar 2026 13:25:19 GMT https://vulnogram.org/CVE-2026-3608 https://vulnogram.org/CVE-2026-3608 Sending a maliciously crafted message to the kea-ctrl-agent, kea-dhcp-ddns, kea-dhcp4, or kea-dhcp6 daemons over any configured API socket or HA listener can cause the receiving daemon to exit with a stack overflow error. This issue affects Kea versi… High Network Exploitable Wed, 25 Mar 2026 08:46:48 GMT https://vulnogram.org/CVE-2025-13878 https://vulnogram.org/CVE-2025-13878 Malformed BRID/HHIT records can cause `named` to terminate unexpectedly. This issue affects BIND 9 versions 9.18.40 through 9.18.43, 9.20.13 through 9.20.17, 9.21.12 through 9.21.16, 9.18.40-S1 through 9.18.43-S1, and 9.20.13-S1 through 9.20.17-S1. High Network Exploitable Wed, 21 Jan 2026 14:43:27 GMT https://vulnogram.org/CVE-2025-11232 https://vulnogram.org/CVE-2025-11232 To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at the default setting, which is "[^A-Za-z0-9.-]"; "hostname-char-replacement" must be empty (the default); and "ddns-qualifying-suffix… High Network Exploitable Wed, 29 Oct 2025 18:02:39 GMT https://vulnogram.org/CVE-2025-40780 https://vulnogram.org/CVE-2025-40780 In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use. This issue affects BIND 9 versions 9.16.0 through 9.16.… High Network Exploitable Wed, 22 Oct 2025 15:48:27 GMT https://vulnogram.org/CVE-2025-40778 https://vulnogram.org/CVE-2025-40778 Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13… High Network Exploitable Wed, 22 Oct 2025 15:47:13 GMT https://vulnogram.org/CVE-2025-8677 https://vulnogram.org/CVE-2025-8677 Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through… High Network Exploitable Wed, 22 Oct 2025 15:43:10 GMT https://vulnogram.org/CVE-2025-8696 https://vulnogram.org/CVE-2025-8696 If an unauthenticated user sends a large amount of data to the Stork UI, it may cause memory and disk use problems for the system running the Stork server. This issue affects Stork versions 1.0.0 through 2.3.0. High Network Exploitable Wed, 10 Sep 2025 17:59:52 GMT https://vulnogram.org/CVE-2025-40779 https://vulnogram.org/CVE-2025-40779 If a DHCPv4 client sends a request with some specific options, and Kea fails to find an appropriate subnet for the client, the `kea-dhcp4` process will abort with an assertion failure. This happens only if the client request is unicast directly to Ke… High Network Exploitable Wed, 27 Aug 2025 20:23:29 GMT https://vulnogram.org/CVE-2025-40777 https://vulnogram.org/CVE-2025-40777 If a `named` caching resolver is configured with `serve-stale-enable` `yes`, and with `stale-answer-client-timeout` set to `0` (the only allowable value other than `disabled`), and if the resolver, in the process of resolving a query, encounters a CN… High Network Exploitable Wed, 16 Jul 2025 17:38:06 GMT https://vulnogram.org/CVE-2025-40776 https://vulnogram.org/CVE-2025-40776 A `named` caching resolver that is configured to send ECS (EDNS Client Subnet) options may be vulnerable to a cache-poisoning attack. This issue affects BIND 9 versions 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.37-S1, and 9.20.9-S1 throug… High Network Exploitable Wed, 16 Jul 2025 13:41:01 GMT https://vulnogram.org/CVE-2025-32803 https://vulnogram.org/CVE-2025-32803 In some cases, Kea log files or lease files may be world-readable. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8. Medium Wed, 28 May 2025 17:08:20 GMT https://vulnogram.org/CVE-2025-32802 https://vulnogram.org/CVE-2025-32802 Kea configuration and API directives can be used to overwrite arbitrary files, subject to permissions granted to Kea. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in ins… Medium Wed, 28 May 2025 17:08:11 GMT https://vulnogram.org/CVE-2025-32801 https://vulnogram.org/CVE-2025-32801 Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths. This issue affects Kea… High Wed, 28 May 2025 17:03:34 GMT https://vulnogram.org/CVE-2025-40775 https://vulnogram.org/CVE-2025-40775 When an incoming DNS protocol message includes a Transaction Signature (TSIG), BIND always checks it. If the TSIG contains an invalid value in the algorithm field, BIND immediately aborts with an assertion failure. This issue affects BIND 9 versions… High Network Exploitable Wed, 21 May 2025 12:35:01 GMT https://vulnogram.org/CVE-2024-12705 https://vulnogram.org/CVE-2024-12705 Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic. This issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, an… High Network Exploitable Wed, 29 Jan 2025 21:40:27 GMT https://vulnogram.org/CVE-2024-11187 https://vulnogram.org/CVE-2024-11187 It is possible to construct a zone such that some queries to it will generate responses containing numerous records in the Additional section. An attacker sending many such queries can cause either the authoritative server itself or an independent re… High Network Exploitable Wed, 29 Jan 2025 21:40:11 GMT https://vulnogram.org/CVE-2024-4076 https://vulnogram.org/CVE-2024-4076 Client queries that trigger serving stale data and that also require lookups in local authoritative zone data may result in an assertion failure. This issue affects BIND 9 versions 9.16.13 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.… High Network Exploitable Tue, 23 Jul 2024 14:40:57 GMT