ISC BIND any version

named may terminate unexpectedly under high DNS-over-TLS query load

BIND 9 server memory exhaustion during GSS-API TKEY negotiation

Memory leaks in code handling Diffie-Hellman key exchange via TKEY RRs (OpenSSL 3.0.0+ only)

BIND 9 resolvers configured to answer from stale cache with zero stale-answer-client-timeout may terminate unexpectedly

Invalid handling of CLASS != IN

Excessive NSEC3 iterations cause high CPU load during insecure delegation validation

An oversight while backporting a feature leads to an assertion failure in buffer.c:420

Parsing large DNS messages may cause excessive CPU load

A flaw in mirror zone validity checking can allow zone data to be spoofed

Querying RFC 1918 reverse zones may cause an assertion failure when "nxdomain-redirect" is enabled

Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution

Memory leak in code preparing DNSSEC proofs of non-existence

Specific recursive query patterns may lead to an out-of-memory condition

Malformed NSEC records can cause named to terminate unexpectedly when synth-from-dnssec is enabled

SIG(0) validation during query flood may lead to undefined behavior

openpgpkey_61.c in named in ISC BIND 9.9.7 before 9.9.7-P3 and 9.10.x before 9.10.2-P4 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a crafted DNS response.

named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed packet to the rndc (aka control channel) interface, related to alist.c and sexpr.c.

DNS forwarders - cache poisoning vulnerability

ISC BIND through 9.9.9-P1, 9.10.x through 9.10.4-P1, and 9.11.x through 9.11.0b1 allows primary DNS servers to cause a denial of service (secondary DNS server crash) via a large AXFR response, and possibly allows IXFR servers to cause a denial of service (IXFR client crash) via a large IXFR response and allows remote authenticated users to cause a denial of service (primary DNS server crash) via a large UPDATE message.

A broken inbound incremental zone update (IXFR) can cause named to terminate unexpectedly

A truncated TSIG response can lead to an assertion failure

Update policies krb5-subdomain and ms-subdomain do not enforce controls promised in their documentation

Authenticated query containing a TKEY record may cause named to terminate unexpectedly

ISC BIND 9.x before 9.9.9-P2, 9.10.x before 9.10.4-P2, and 9.11.x before 9.11.0b2, when lwresd or the named lwres option is enabled, allows remote attackers to cause a denial of service (daemon crash) via a long request that uses the lightweight resolver protocol.

An error processing RPZ rules can cause named to loop endlessly after handling a query

An error handling synthesized records could cause an assertion failure when using DNS64 with "break-dnssec yes;"

Cache Poisoning issue exists in DNS Response Rate Limiting.

A race condition when discarding malformed packets can cause BIND to exit with an assertion failure

A stack use-after-return flaw in SIG(0) handling code may enable ACL bypass

Lame cache can be abused to severely degrade resolver performance

An error in TSIG authentication can permit unauthorized zone transfers

Zone transfer controls for writable DLZ zones were not effective

DoS from specifically crafted TCP packets

Processing large delegations may severely degrade resolver performance

Unbounded resend loop in BIND 9 resolver

Amplification vulnerabilities via self-pointed glue records

An assertion failure can occur if a trust anchor rolls over to an unsupported key algorithm when using managed-keys

A buffer boundary check assertion in rdataset.c can fail incorrectly during zone transfer

A buffer boundary check assertion in rdataset.c can fail incorrectly during zone transfer

ISC BIND before 9.7.2-P2, when DNSSEC validation is enabled, does not properly handle certain bad signatures if multiple trust anchors exist for a single zone, which allows remote attackers to cause a denial of service (daemon crash) via a DNS query.