CVE-2022-2795 — Processing large delegations may severely degrade resolver performance

Description

By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.

Affected products

Vendor	Product	Affected	Fixed
ISC	BIND9	Open Source Branches 9.0 through 9.16 9.0.0 through versions before 9.16.33, Open Source Branch 9.18 9.18.0 through versions before 9.18.7, Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions up to and including 9.11.37-S1, Supported Preview Branch 9.16-S 9.16.8-S1 through ver…	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	bind9	1:9.18.7-1	—
Debian 13	bind9	1:9.18.7-1	—
Debian 12	bind9	1:9.18.7-1	—
Debian 11	bind9	1:9.16.33-1~deb11u1	DSA-5235-1
Debian 10	bind9	1:9.11.5.P4+dfsg-5.1+deb10u8	DLA-3138-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 26.04 LTS	isc-dhcp	No fix yet	—
Ubuntu 25.10	isc-dhcp	No fix yet	—
Ubuntu 24.04 LTS	isc-dhcp	No fix yet	—
Ubuntu 22.04 LTS	bind9	1:9.18.1-1ubuntu1.2	USN-5626-1
Ubuntu 22.04 LTS	bind9-libs	No fix yet	—
Ubuntu 20.04 LTS	bind9	1:9.16.1-0ubuntu2.11	USN-5626-1
Ubuntu 20.04 LTS	bind9-libs	No fix yet	—

Show 3 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu 18.04 LTS	bind9	1:9.11.3+dfsg-1ubuntu1.18	USN-5626-1
Ubuntu Pro 16.04 LTS	bind9	1:9.10.3.dfsg.P4-8ubuntu1.19+esm3	USN-5626-2
Ubuntu Pro 14.04 LTS	bind9	1:9.9.5.dfsg-3ubuntu0.19+esm7	USN-5626-2

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 9	bind +9	32:9.16.23-11.el9	RHSA-2023:2261
RHEL 8	bind +16	32:9.11.36-8.el8	RHSA-2023:3002
RHEL 8	bind9.16 +8	32:9.16.23-0.14.el8	RHSA-2023:2792
RHEL 7	bind +15	32:9.11.4-26.P2.el7_9.13	RHSA-2023:0402

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 8.6 EUS	bind +16	32:9.11.36-3.el8_6.7	RHSA-2024:2720
RHEL 8.6 EUS	dhcp +5	12:4.3.6-47.el8_6.2	RHSA-2024:2720

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 9	bind +9	32:9.16.23-11.el9	ALSA-2023:2261
AlmaLinux 8	bind +16	32:9.11.36-8.el8	ALSA-2023:3002
AlmaLinux 8	bind9.16 +8	32:9.16.23-0.14.el8	ALSA-2023:2792

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP4	bind	9.16.6-150300.22.21.2	SUSE-SU-2022:3767-1, SUSE-SU-2022:3682-1
SLES 15 SP3	bind	9.16.6-150300.22.21.2	SUSE-SU-2022:3682-1
SLES 15 SP2	bind	9.16.6-150000.12.63.1	SUSE-SU-2022:3729-1
SLES 15 SP1	bind	9.16.6-150000.12.63.1	SUSE-SU-2022:3729-1
SLES 15	bind	9.16.6-150000.12.63.1	SUSE-SU-2022:3729-1

Show 19 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES 12 SP5	bind	9.11.22-3.43.1	SUSE-SU-2022:3499-1
SLES 12 SP4	bind	9.11.22-3.43.1	SUSE-SU-2022:3499-1
SLES 12 SP3	bind	9.9.9P1-63.37.1	SUSE-SU-2022:3500-1
SLES 12 SP2	bind	9.9.9P1-63.37.1	SUSE-SU-2022:3500-1
SLES for SAP 15 SP2	bind	9.16.6-150000.12.63.1	SUSE-SU-2022:3729-1
SLES for SAP 15 SP1	bind	9.16.6-150000.12.63.1	SUSE-SU-2022:3729-1
SLES for SAP 15	bind	9.16.6-150000.12.63.1	SUSE-SU-2022:3729-1
SLES for SAP 12 SP5	bind	9.11.22-3.43.1	SUSE-SU-2022:3499-1
SLES for SAP 12 SP4	bind	9.11.22-3.43.1	SUSE-SU-2022:3499-1
SLE HPC 15 SP2	bind	9.16.6-150000.12.63.1	SUSE-SU-2022:3729-1
SLE HPC 15 SP1	bind	9.16.6-150000.12.63.1	SUSE-SU-2022:3729-1
SLE HPC 15	bind	9.16.6-150000.12.63.1	SUSE-SU-2022:3729-1
SUSE OpenStack Cloud Crowbar 9	bind	9.11.22-3.43.1	SUSE-SU-2022:3499-1
SUSE OpenStack Cloud 9	bind	9.11.22-3.43.1	SUSE-SU-2022:3499-1
SUSE Manager Server 4.1	bind	9.16.6-150000.12.63.1	SUSE-SU-2022:3729-1
SUSE Manager Retail Branch Server 4.1	bind	9.16.6-150000.12.63.1	SUSE-SU-2022:3729-1
SUSE Manager Proxy 4.1	bind	9.16.6-150000.12.63.1	SUSE-SU-2022:3729-1
SUSE Enterprise Storage 7	bind	9.16.6-150000.12.63.1	SUSE-SU-2022:3729-1
SUSE Enterprise Storage 6	bind	9.16.6-150000.12.63.1	SUSE-SU-2022:3729-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	bind	9.18.7-1.1	openSUSE-SU-2024:12356-1
openSUSE Leap 15.4	bind	9.16.6-150000.12.63.1	SUSE-SU-2022:3767-1, SUSE-SU-2022:3729-1, SUSE-SU-2022:3682-1
openSUSE Leap 15.3	bind	9.16.6-150000.12.63.1	SUSE-SU-2022:3729-1, SUSE-SU-2022:3682-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	bind	9.18.7-r0	—
Alpine v3.23	bind	9.18.7-r0	—
Alpine v3.22	bind	9.18.7-r0	—
Alpine v3.21	bind	9.18.7-r0	—
Alpine v3.20	bind	9.18.7-r0	—

Show 7 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Alpine v3.19	bind	9.18.7-r0	—
Alpine v3.18	bind	9.18.7-r0	—
Alpine v3.17	bind	9.18.7-r0	—
Alpine v3.16	bind	9.16.33-r0	—
Alpine v3.15	bind	9.16.33-r0	—
Alpine v3.14	bind	9.16.33-r0	—
Alpine v3.13	bind	9.16.33-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	bind +16	32:9.16.38-1.amzn2023	ALAS2023-2023-161
Amazon Linux 2	bind +15	32:9.11.4-26.P2.amzn2.13	ALAS2-2023-2001

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 2 (CBL-Mariner)	bind	9.16.33-1	—
Azure Linux 2 (CBL-Mariner)	dhcp	4.4.3-2	—

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 9	bind +9	32:9.16.23-11.el9	ELSA-2023-2261
Oracle Linux 8	bind +16	32:9.11.36-8.el8	ELSA-2023-3002
Oracle Linux 8	bind9.16 +8	32:9.16.23-0.14.el8	ELSA-2023-2792
Oracle Linux 7	bind +15	32:9.11.4-26.P2.el7_9.13	ELSA-2023-0402

Advisories 34

ALSA-2023:2261 Moderate: bind security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2023:3002 Moderate: bind security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2023:2792 Moderate: bind9.16 security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2024:2720 Red Hat Security Advisory: bind and dhcp security update Red Hat Security Advisories (RHSA) · Sep 2, 2026
RHSA-2023:3002 Red Hat Security Advisory: bind security and bug fix update Red Hat Security Advisories (RHSA) · Sep 2, 2026
RHSA-2023:2792 Red Hat Security Advisory: bind9.16 security and bug fix update Red Hat Security Advisories (RHSA) · Sep 2, 2026
RHSA-2023:2261 Red Hat Security Advisory: bind security and bug fix update Red Hat Security Advisories (RHSA) · Sep 2, 2026
RHSA-2023:0402 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Sep 2, 2026
WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
USN-5626-2 bind9 vulnerabilities Ubuntu Security Notices (USN) · Jun 29, 2026
WID-SEC-2024-1226 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 11, 2026
USN-5626-1 bind9 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
DSA-5235-1 bind9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-3138-1 bind9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
SUSE-SU-2022:3682-1 Security update for bind SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:3499-1 Security update for bind SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:3500-1 Security update for bind SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:12356-1 bind-9.18.7-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:3729-1 Security update for bind SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:3767-1 Recommended update for bind SUSE / openSUSE Security Updates · Feb 4, 2026
WID-SEC-2022-1492 Internet Systems Consortium BIND: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Jan 6, 2026
WID-SEC-2023-1542 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2025
WID-SEC-2024-0064 Juniper Produkte: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 10, 2025
ICSA-25-105-08 ABB M2M Gateway CISA ICS & IT advisories · Apr 7, 2025
2NGA002579 ABB Arctic communication solution ARM600 Vulnerabilities ABB PSIRT · Apr 7, 2025
WID-SEC-2024-1307 Red Hat OpenShift Service Mesh Containers: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 5, 2025
WID-SEC-2023-0809 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 19, 2024
WID-SEC-2023-1737 Juniper Patchday Juli 2023 BSI CERT-Bund (WID) · Jul 12, 2023
ELSA-2023-2792 Moderate: bind9.16 security and bug fix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 24, 2023
ELSA-2023-3002 Moderate: bind security and bug fix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 24, 2023
ELSA-2023-2261 Moderate: bind security and bug fix update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 15, 2023
ALAS2023-2023-161 Important: bind security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 19, 2023
ALAS2-2023-2001 Important: bind security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Mar 21, 2023
ELSA-2023-0402 Moderate: bind security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jan 24, 2023

References

https://kb.isc.org/docs/cve-2022-2795
[oss-security] 20220921 ISC has disclosed six vulnerabilities in BIND (CVE-2022-2795, CVE-2022-2881, CVE-2022-2906, CVE-2022-3080, CVE-2022-38177, CVE-2022-38178) mailing-list
DSA-5235 vendor-advisory
FEDORA-2022-ef038365de vendor-advisory
FEDORA-2022-8268735e06 vendor-advisory
FEDORA-2022-b197d64471 vendor-advisory
[debian-lts-announce] 20221005 [SECURITY] [DLA 3138-1] bind9 security update mailing-list
GLSA-202210-25 vendor-advisory

CNA	v3.1	5.3
EUVD	v3.1	5.3