Description
A `named` instance configured to run as a DNSSEC-validating recursive resolver with the Aggressive Use of DNSSEC-Validated Cache (RFC 8198) option (`synth-from-dnssec`) enabled can be remotely terminated using a zone with a malformed NSEC record.
This issue affects BIND 9 versions 9.16.8-S1 through 9.16.41-S1 and 9.18.11-S1 through 9.18.15-S1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ISC | BIND 9 | 9.16.8-S1 – ≤ 9.16.41-S1, 9.18.11-S1 – ≤ 9.18.15-S1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | bind | 9.16.44-1 | — |
Advisories 1
- WID-SEC-2023-1533 Internet Systems Consortium BIND: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Jan 6, 2026