B9
Product
BIND 9
65
CVEs
0
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 1High 42Medium 21Low 1
Watch
Add BIND 9 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-19662 | 5.9 | Sep 16 | qpcache NOQNAME proof use-after-free crashes recursive resolver Affected: 9.11.0 through 9.18.50; 9.20.0 through 9.20.27; 9.11.3-S1 through 9.18.50-S1; 9.20.9-S1 through 9.20.27-S1 |
| CVE-2026-5947 | 5.9 | May 20 | SIG(0) validation during query flood may lead to undefined behavior Affected: 9.20.0 through 9.20.22; 9.21.0 through 9.21.21; 9.20.9-S1 through 9.20.22-S1 |
| CVE-2017-3135 | 5.9 | Jan 16 | Combination of DNS64 and RPZ Can Lead to Crash Affected: BIND 9 9.8.8, 9.9.3-S1 -> 9.9.9-S7, 9.9.3 -> 9.9.9-P5, 9.9.10b1, 9.10.0 -> 9.10.4-P5, 9.10.5b1, 9.11.0 -> 9.11.0-P2, 9.11.1b1 |
| CVE-2016-9778 | 5.9 | Jan 16 | An error handling certain queries using the nxdomain-redirect feature could cause a REQUIRE assertion failure in db.c Affected: BIND 9 9.9.8-S1 -> 9.9.8-S3, 9.9.9-S1 -> 9.9.9-S6, 9.11.0-9.11.0-P1 |
| CVE-2017-3143 | 5.9 | Jan 16 | An error in TSIG authentication can permit unauthorized dynamic updates Affected: 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2 |
| CVE-2017-3140 | 5.9 | Jan 16 | An error processing RPZ rules can cause named to loop endlessly after handling a query Affected: 9.9.10, 9.10.5, 9.11.0->9.11.1, 9.9.10-S1, 9.10.5-S1 |
| CVE-2017-3136 | 5.9 | Jan 16 | An error handling synthesized records could cause an assertion failure when using DNS64 with "break-dnssec yes;" Affected: 9.8.0 -> 9.8.8-P1, 9.9.0 -> 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.0 -> 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0 -> 9.11.0-P3, 9.11.1b1->9.11.1rc1, 9.9.3-S1 -> 9.9.9-S8 |
| CVE-2026-78301 | 5.8 | Sep 16 | Out-of-zone database nodes can become authoritative zone cuts Affected: 9.11.0 through 9.18.50; 9.20.0 through 9.20.27; 9.21.0 through 9.21.25; 9.11.3-S1 through 9.18.50-S1; 9.20.9-S1 through 9.20.27-S1 |
| CVE-2026-3591 | 5.4 | Mar 25 | A stack use-after-return flaw in SIG(0) handling code may enable ACL bypass Affected: 9.20.0 through 9.20.20; 9.21.0 through 9.21.19; 9.20.9-S1 through 9.20.20-S1 |
| CVE-2026-75029 | 5.3 | Sep 16 | Message parser retains every identical singleton RDATA, enabling wire-to-work amplification Affected: 9.11.0 through 9.18.50; 9.20.0 through 9.20.27; 9.21.0 through 9.21.25; 9.11.3-S1 through 9.18.50-S1; 9.20.9-S1 through 9.20.27-S1 |
| CVE-2026-19668 | 5.3 | Sep 16 | Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching Affected: 9.11.0 through 9.18.50; 9.20.0 through 9.20.27; 9.21.0 through 9.21.25; 9.11.3-S1 through 9.18.50-S1; 9.20.9-S1 through 9.20.27-S1 |
| CVE-2026-5950 | 5.3 | May 20 | Unbounded resend loop in BIND 9 resolver Affected: 9.18.36 through 9.18.48; 9.20.8 through 9.20.22; 9.21.7 through 9.21.21; 9.18.36-S1 through 9.18.48-S1; 9.20.9-S1 through 9.20.22-S1 |
| CVE-2026-3592 | 5.3 | May 20 | Amplification vulnerabilities via self-pointed glue records Affected: 9.11.0 through 9.16.50; 9.18.0 through 9.18.48; 9.20.0 through 9.20.22; 9.21.0 through 9.21.21; 9.11.3-S1 through 9.16.50-S1; 9.18.11-S1 through 9.18.48-S1; +1 more |
| CVE-2017-3138 | 5.3 | Jan 16 | named exits with a REQUIRE assertion failure if it receives a null command string on its control channel Affected: 9.9.9->9.9.9-P7, 9.9.10b1->9.9.10rc2, 9.10.4->9.10.4-P7, 9.10.5b1->9.10.5rc2, 9.11.0->9.11.0-P4, 9.11.1b1->9.11.1rc2, 9.9.9-S1->9.9.9-S9 |
| CVE-2017-3142 | 3.7 | Jan 16 | An error in TSIG authentication can permit unauthorized zone transfers Affected: 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2 |