5.5Medium

CVE-2022-2881Buffer overread in statistics channel code

ISC BIND9 Published: 2022-09-21 13:15 (4 years ago)

Description

The underlying bug might cause read past end of the buffer and either read memory it should not read, or crash the process.

Weakness (CWE): CWE-125

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
ISC	BIND9	Open Source Branch 9.18 9.18.0 through versions before 9.18.7, Development Branch 9.19 9.19.0 through versions before 9.19.5

References and patches

CVSS score

5.5Medium

Source: isc · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: High
User interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: None
Availability: High

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H

EPSS (chance of exploitation in 30 days)

1.41%

higher than 73% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: partial

Timeline

ID reserved2022-08-17
Published2022-09-21 13:15
Reached IP-DB2026-10-24 23:37
Last updated2025-05-28 18:26

Assigned by (CNA): isc

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — ISC BIND 9

7.5High

CVE-2026-97313 22 days ago

Specific RPZ configurations and query patterns may result in an unexpected exit

ISC BIND 9

A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have …

7.5High

CVE-2026-96888 22 days ago

Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization

ISC BIND 9

A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through…

8.1High

CVE-2026-94300 22 days ago

Concurrent GSS-TSIG messages corrupt memory

ISC BIND 9

Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacke…

7.5High

CVE-2026-19630 22 days ago

Amplified resource exhaustion in inbound message processing

ISC BIND 9

In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate am…

5.9Medium

CVE-2026-77119 1 month ago

NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets

ISC BIND 9

A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21…

5.3Medium

CVE-2026-75029 1 month ago

Message parser retains every identical singleton RDATA, enabling wire-to-work amplification

ISC BIND 9

In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory …