Product by ISC
Bind 9
87 known vulnerabilities in Bind 9 (ISC), 0 of them actively exploited (CISA KEV).
Key figures
87
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-77692 | Unauthenticated remote crash of named via a single DoH SIG(0) request | 7.5 | |
| High | CVE-2025-13878 | Malformed BRID/HHIT records can cause named to terminate unexpectedly | 7.5 | |
| High | CVE-2025-8677 | Resource exhaustion via malformed DNSKEY handling | 7.5 | |
| High | CVE-2025-40775 | DNS message with invalid TSIG causes an assertion failure | 7.5 | |
| High | CVE-2024-12705 | DNS-over-HTTPS implementation suffers from multiple issues under heavy query load | 7.5 | |
| High | CVE-2024-11187 | Many records in the additional section cause CPU exhaustion | 7.5 | |
| High | CVE-2022-3736 | ISC BIND 9: security vulnerability | 7.5 | |
| High | CVE-2018-5740 | A flaw in the "deny-answer-aliases" feature can cause an assertion failure in named | 7.5 | |
| High | CVE-2022-3488 | ISC BIND 9: security vulnerability | 7.5 | |
| High | CVE-2022-3924 | ISC BIND 9: security vulnerability | 7.5 | |
| High | CVE-2017-3145 | Improper fetch cleanup sequencing in the resolver can cause named to crash | 7.5 | |
| High | CVE-2022-3094 | An UPDATE message flood may cause named to exhaust all available memory | 7.5 | |
| High | CVE-2017-3143 | An error in TSIG authentication can permit unauthorized dynamic updates | 7.5 | |
| High | CVE-2017-3135 | Combination of DNS64 and RPZ Can Lead to Crash | 7.5 | |
| High | CVE-2024-0760 | A flood of DNS messages over TCP may make the server unstable | 7.5 | |
| High | CVE-2017-3137 | ISC BIND 9: security vulnerability | 7.5 | |
| High | CVE-2016-9778 | ISC BIND 9: security vulnerability | 7.5 | |
| High | CVE-2018-5743 | Limiting simultaneous TCP clients was ineffective | 7.5 | |
| High | CVE-2018-5734 | A malformed request can trigger an assertion failure in badcache.c | 7.5 | |
| High | CVE-2026-5946 | Invalid handling of CLASS != IN | 7.5 | |
| High | CVE-2023-2828 | named's configured cache size limit can be significantly exceeded | 7.5 | |
| Medium | CVE-2017-3136 | ISC BIND 9: Denial of Service | 5.9 | |
| High | CVE-2018-5737 | ISC BIND 9: Denial of Service | 5.9 | |
| High | CVE-2023-3341 | A stack exhaustion flaw in control channel code may cause named to terminate unexpectedly | 7.5 | |
| Medium | CVE-2017-3138 | ISC BIND 9: security vulnerability | 6.5 |