IS
Vendor
ISC
325
CVEs
1
On KEV
4
New 30D
Products
BI9.8
BIND
ISC
188 CVEs1 on KEV0 new
B99.8
BIND 9
ISC
70 CVEs0 on KEV4 new
DH7.5
Dhcp
Isc
25 CVEs0 on KEV0 new
IN9.8
Inn
Isc
14 CVEs0 on KEV0 new
KE7.8
Kea
ISC
10 CVEs0 on KEV0 new
DH7.5
Dhcpd
Isc
8 CVEs0 on KEV0 new
ID7.5
ISC DHCP
ISC
4 CVEs0 on KEV0 new
DC–
Dhcp Client
Isc
2 CVEs0 on KEV0 new
ST8.1
Stork
ISC
2 CVEs0 on KEV0 new
DB–
Dnsco Bind
Isc
1 CVEs0 on KEV0 new
KD7.5
Kea DHCP
ISC
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-97313 | B9 BIND 9 ISC | 7.5 | Oct 21 | Specific RPZ configurations and query patterns may result in an unexpected exit |
| CVE-2026-96888 | B9 BIND 9 ISC | 7.5 | Oct 21 | Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization |
| CVE-2026-94300 | B9 BIND 9 ISC | 8.1 | Oct 21 | Concurrent GSS-TSIG messages corrupt memory |
| CVE-2026-19630 | B9 BIND 9 ISC | 7.5 | Oct 21 | Amplified resource exhaustion in inbound message processing |
| CVE-2026-77119 | B9 BIND 9 ISC | 5.9 | Sep 16 | NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets |
| CVE-2026-75029 | B9 BIND 9 ISC | 5.3 | Sep 16 | Message parser retains every identical singleton RDATA, enabling wire-to-work amplification |
| CVE-2026-19668 | B9 BIND 9 ISC | 5.3 | Sep 16 | Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching |
| CVE-2026-19033 | B9 BIND 9 ISC | 6.5 | Sep 16 | Unauthenticated IXFR deltas are applied to the live zone before TSIG verification |
| CVE-2026-80274 | B9 BIND 9 ISC | 7.5 | Sep 16 | Validating resolver can abort while caching a mismatched NOQNAME proof |
| CVE-2026-76163 | B9 BIND 9 ISC | 7.5 | Sep 16 | named aborts on a TKEY query when the user configuration has no global options statement |
| CVE-2026-19666 | B9 BIND 9 ISC | 7.5 | Sep 16 | Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path |
| CVE-2026-81563 | B9 BIND 9 ISC | 7.5 | Sep 16 | SVCB AliasMode additional-data error leaks qpcache references |
| CVE-2026-78301 | B9 BIND 9 ISC | 5.8 | Sep 16 | Out-of-zone database nodes can become authoritative zone cuts |
| CVE-2026-77692 | B9 BIND 9 ISC | 7.5 | Sep 16 | Unauthenticated remote crash of named via a single DoH SIG(0) request |
| CVE-2026-19941 | B9 BIND 9 ISC | 5.9 | Sep 16 | checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof |
| CVE-2026-19662 | B9 BIND 9 ISC | 5.9 | Sep 16 | qpcache NOQNAME proof use-after-free crashes recursive resolver |
| CVE-2026-19667 | B9 BIND 9 ISC | 7.5 | Sep 16 | Remote assertion failure via 16-bit length truncation in `dns_ncache_add()` |
| CVE-2026-81736 | B9 BIND 9 ISC | 7.5 | Sep 16 | Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees |
| CVE-2026-13321 | B9 BIND 9 ISC | 8.6 | Jul 22 | DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field |
| CVE-2026-13204 | B9 BIND 9 ISC | 7.5 | Jul 22 | Unexpected exit in certain situations with NSEC and NSEC3 both present |
| CVE-2026-12617 | B9 BIND 9 ISC | 7.5 | Jul 22 | Record ordering based unexpected exit with CNAME or DNAME |
| CVE-2026-11721 | B9 BIND 9 ISC | 7.5 | Jul 22 | Cache poisoning possible with label count discrepancy, RRSIG, and wildcards |
| CVE-2026-11622 | B9 BIND 9 ISC | 7.5 | Jul 22 | Potential memory usage beyond configured limits |
| CVE-2026-11605 | B9 BIND 9 ISC | 7.5 | Jul 22 | Unnecessary validation of DNSSEC signed records |
| CVE-2026-11331 | B9 BIND 9 ISC | 7.5 | Jul 22 | Potential wildcard CNAME RPZ policy bypass |
| CVE-2026-10822 | B9 BIND 9 ISC | 6.5 | Jul 22 | Key Record using PRIVATEDNS algorithm may lead to unexpected exit |
| CVE-2026-10723 | B9 BIND 9 ISC | 6.8 | Jul 22 | Incorrect acceptance of NSEC3 records |
| CVE-2026-5950 | B9 BIND 9 ISC | 5.3 | May 20 | Unbounded resend loop in BIND 9 resolver |
| CVE-2026-5947 | B9 BIND 9 ISC | 5.9 | May 20 | SIG(0) validation during query flood may lead to undefined behavior |
| CVE-2026-5946 | B9 BIND 9 ISC | 7.5 | May 20 | Invalid handling of CLASS != IN |
| CVE-2026-3593 | B9 BIND 9 ISC | 9.8 | May 20 | Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation |
| CVE-2026-3592 | B9 BIND 9 ISC | 5.3 | May 20 | Amplification vulnerabilities via self-pointed glue records |
| CVE-2026-3039 | B9 BIND 9 ISC | 7.5 | May 20 | BIND 9 server memory exhaustion during GSS-API TKEY negotiation |
| CVE-2026-3591 | B9 BIND 9 ISC | 5.4 | Mar 25 | A stack use-after-return flaw in SIG(0) handling code may enable ACL bypass |
| CVE-2026-3119 | B9 BIND 9 ISC | 6.5 | Mar 25 | Authenticated query containing a TKEY record may cause named to terminate unexpectedly |
| CVE-2026-3104 | B9 BIND 9 ISC | 7.5 | Mar 25 | Memory leak in code preparing DNSSEC proofs of non-existence |
| CVE-2026-1519 | B9 BIND 9 ISC | 7.5 | Mar 25 | Excessive NSEC3 iterations cause high CPU load during insecure delegation validation |
| CVE-2026-3608 | KE Kea ISC | 7.5 | Mar 25 | Stack overflow in Kea daemons |
| CVE-2025-13878 | B9 BIND 9 ISC | 7.5 | Jan 21 | Malformed BRID/HHIT records can cause named to terminate unexpectedly |
| CVE-2025-11232 | KE Kea ISC | 7.5 | Oct 29 | Invalid characters cause assert |
| CVE-2025-40780 | B9 BIND 9 ISC | 8.6 | Oct 22 | Cache poisoning due to weak PRNG |
| CVE-2025-40778 | B9 BIND 9 ISC | 8.6 | Oct 22 | Cache poisoning attacks with unsolicited RRs |
| CVE-2025-8677 | B9 BIND 9 ISC | 7.5 | Oct 22 | Resource exhaustion via malformed DNSKEY handling |
| CVE-2025-8696 | ST Stork ISC | 7.5 | Sep 10 | DoS attack against the Stork UI from an unauthenticated user |
| CVE-2025-40779 | KE Kea ISC | 7.5 | Aug 27 | Kea crash upon interaction between specific client options and subnet selection |
| CVE-2025-40777 | B9 BIND 9 ISC | 7.5 | Jul 16 | A possible assertion failure when 'stale-answer-client-timeout' is set to '0' |
| CVE-2025-40776 | B9 BIND 9 ISC | 8.6 | Jul 16 | Birthday Attack against Resolvers supporting ECS |
| CVE-2025-32803 | KE Kea ISC | 4.0 | May 28 | Insecure file permissions can result in confidential information leakage |
| CVE-2025-32802 | KE Kea ISC | 6.1 | May 28 | Insecure handling of file paths allows multiple local attacks |
| CVE-2025-32801 | KE Kea ISC | 7.8 | May 28 | Loading a malicious hook library can lead to local privilege escalation |
| CVE-2025-40775 | B9 BIND 9 ISC | 7.5 | May 21 | DNS message with invalid TSIG causes an assertion failure |
| CVE-2024-12705 | B9 BIND 9 ISC | 7.5 | Jan 29 | DNS-over-HTTPS implementation suffers from multiple issues under heavy query load |
| CVE-2024-11187 | B9 BIND 9 ISC | 7.5 | Jan 29 | Many records in the additional section cause CPU exhaustion |
| CVE-2024-4076 | B9 BIND 9 ISC | 7.5 | Jul 23 | Assertion failure when serving both stale cache data and authoritative zone content |
| CVE-2024-1975 | B9 BIND 9 ISC | 7.5 | Jul 23 | SIG(0) can be used to exhaust CPU resources |
| CVE-2024-1737 | B9 BIND 9 ISC | 7.5 | Jul 23 | BIND's database will be slow if a very large number of RRs exist at the same name |
| CVE-2024-0760 | B9 BIND 9 ISC | 7.5 | Jul 23 | A flood of DNS messages over TCP may make the server unstable |
| CVE-2024-28872 | ST Stork ISC | 8.1 | Jul 11 | Incorrect TLS certificate validation can lead to escalated privileges |
| CVE-2023-50868 | BI Bind Isc | 7.5 | Feb 14 | The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for… |
| CVE-2023-50387 | BI Bind Isc | 7.5 | Feb 14 | Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more… |