Description
With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelining enabled. A client using a TCP-pipelined connection to a server could consume more resources than the server has been provisioned to handle. When a TCP connection with a large number of pipelined queries is closed, the load on the server releasing these multiple resources can cause it to become unresponsive, even for queries that can be answered authoritatively or from cache. (This is most likely to be perceived as an intermittent server problem).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ISC | BIND9 | 9.11.6-P1 -> 9.11.12, 9.12.4-P1 -> 9.12.4-P2, 9.14.1 -> 9.14.7, and versions 9.11.5-S6 -> 9.11.12-S1 of BIND 9 Supported Preview Edition. Versions 9.15.0 -> 9.15.5 of the BIND 9.15 development branch are also affected | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bind9 | 1:9.11.14+dfsg-1 | — |
| Debian 13 | bind9 | 1:9.11.14+dfsg-1 | — |
| Debian 12 | bind9 | 1:9.11.14+dfsg-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | bind9 | 1:9.11.3+dfsg-1ubuntu1.11 | USN-4197-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | bind +16 | 32:9.11.13-3.el8 | RHSA-2020:1845 |
| RHEL 7 | bind +15 | 32:9.11.4-16.P2.el7 | RHSA-2020:1061 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP2 | bind | 9.16.6-12.32.1 | SUSE-SU-2020:2914-1 |
| SLES 15 SP2 | sysuser-tools | 2.0-4.2.8 | SUSE-SU-2020:2914-1 |
| SLES 15 SP1 | bind | 9.16.6-12.32.1 | SUSE-SU-2020:2914-1 |
| SLES 15 SP1 | sysuser-tools | 2.0-4.2.8 | SUSE-SU-2020:2914-1 |
| SLES 15 | bind | 9.16.6-12.32.1 | SUSE-SU-2020:2914-1 |
| SLES 15 | sysuser-tools | 2.0-4.2.8 | SUSE-SU-2020:2914-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 | bind | 9.16.6-12.32.1 | SUSE-SU-2020:2914-1 |
| SLES for SAP 15 | sysuser-tools | 2.0-4.2.8 | SUSE-SU-2020:2914-1 |
| SLE HPC 15 | bind | 9.16.6-12.32.1 | SUSE-SU-2020:2914-1 |
| SLE HPC 15 | sysuser-tools | 2.0-4.2.8 | SUSE-SU-2020:2914-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | bind | 9.16.20-1.4 | openSUSE-SU-2024:10650-1 |
| openSUSE Leap 15.2 | bind | 9.16.6-lp152.14.3.1 | openSUSE-SU-2020:1699-1 |
| openSUSE Leap 15.2 | libuv | 1.18.0-lp152.4.3.1 | openSUSE-SU-2020:1699-1 |
| openSUSE Leap 15.2 | sysuser-tools | 2.0-lp152.5.3.1 | openSUSE-SU-2020:1699-1 |
| openSUSE Leap 15.1 | bind | 9.16.6-lp151.11.9.1 | openSUSE-SU-2020:1701-1 |
| openSUSE Leap 15.1 | libuv | 1.18.0-lp151.3.3.1 | openSUSE-SU-2020:1701-1 |
| openSUSE Leap 15.1 | sysuser-tools | 2.0-lp151.4.3.1 | openSUSE-SU-2020:1701-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | bind | 9.14.8-r0 | — |
| Alpine v3.23 | bind | 9.14.8-r0 | — |
| Alpine v3.22 | bind | 9.14.8-r0 | — |
| Alpine v3.21 | bind | 9.14.8-r0 | — |
| Alpine v3.20 | bind | 9.14.8-r0 | — |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | bind | 9.14.8-r0 | — |
| Alpine v3.18 | bind | 9.14.8-r0 | — |
| Alpine v3.17 | bind | 9.14.8-r0 | — |
| Alpine v3.16 | bind | 9.14.8-r0 | — |
| Alpine v3.15 | bind | 9.14.8-r0 | — |
| Alpine v3.14 | bind | 9.14.8-r0 | — |
| Alpine v3.13 | bind | 9.14.8-r0 | — |
| Alpine v3.12 | bind | 9.14.8-r0 | — |
| Alpine v3.11 | bind | 9.14.8-r0 | — |
| Alpine v3.10 | bind | 9.14.8-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | bind +15 | 32:9.11.4-9.P2.amzn2.0.4 | ALAS2-2020-1441 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | bind +16 | 32:9.11.13-3.el8 | ELSA-2020-1845 |
| Oracle Linux 7 | bind +15 | 32:9.11.4-16.P2.el7 | ELSA-2020-1061 |
Advisories 10
- RHSA-2020:1061 Red Hat Security Advisory: bind security and bug fix update Red Hat Security Advisories (RHSA) · Sep 2, 2026
- RHSA-2020:1845 Red Hat Security Advisory: bind security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- USN-4197-1 bind9 vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- SUSE-SU-2020:2914-1 Security update for bind SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1699-1 Security update for bind SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10650-1 bind-9.16.20-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1701-1 Security update for bind SUSE / openSUSE Security Updates · Feb 4, 2026
- ALAS2-2020-1441 Moderate: bind security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 1, 2020
- ELSA-2020-1845 Moderate: bind security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 5, 2020
- ELSA-2020-1061 Moderate: bind security and bug fix update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Apr 6, 2020
References
- https://kb.isc.org/docs/cve-2019-6477
- https://www.synology.com/security/advisory/Synology_SA_19_39
- FEDORA-2019-73a8737068 vendor-advisory
- https://support.f5.com/csp/article/K15840535?utm_source=f5support&%3Butm_medium=RSS
- FEDORA-2019-c703d2304a vendor-advisory
- DSA-4689 vendor-advisory
- openSUSE-SU-2020:1699 vendor-advisory
- openSUSE-SU-2020:1701 vendor-advisory