Description
A flaw in the networking code handling DNS-over-TLS queries may cause `named` to terminate unexpectedly due to an assertion failure. This happens when internal data structures are incorrectly reused under significant DNS-over-TLS query load.
This issue affects BIND 9 versions 9.18.0 through 9.18.18 and 9.18.11-S1 through 9.18.18-S1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ISC | BIND 9 | 9.18.0 – ≤ 9.18.18, 9.18.11-S1 – ≤ 9.18.18-S1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bind9 | 1:9.19.17-1 | — |
| Debian 13 | bind9 | 1:9.19.17-1 | — |
| Debian 12 | bind9 | 1:9.18.19-1~deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | bind9 | 1:9.18.18-0ubuntu2 | — |
| Ubuntu 22.04 LTS | bind9 | 1:9.18.12-0ubuntu0.22.04.3 | USN-6390-1 |
| Ubuntu 20.04 LTS | bind9 | 1:9.16.1-0ubuntu2.16 | USN-6390-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | bind | 9.18.19-1.1 | openSUSE-SU-2024:13249-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | bind | 9.18.19-r0 | — |
| Alpine v3.23 | bind | 9.18.19-r0 | — |
| Alpine v3.22 | bind | 9.18.19-r0 | — |
| Alpine v3.21 | bind | 9.18.19-r0 | — |
| Alpine v3.20 | bind | 9.18.19-r0 | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | bind | 9.18.19-r0 | — |
| Alpine v3.18 | bind | 9.18.19-r0 | — |
| Alpine v3.17 | bind | 9.18.19-r0 | — |
Advisories 6
- USN-6390-1 bind9 vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- openSUSE-SU-2024:13249-1 bind-9.18.19-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-2412 Internet Systems Consortium BIND: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 6, 2026
- NCSC-2024-0433 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Nov 12, 2024
- ICSA-24-319-08 Siemens SINEC INS CISA ICS & IT advisories · Nov 12, 2024
- SSA-915275 SSA-915275: Multiple Vulnerabilities in SINEC INS Before V1.0 SP2 Update 3 Siemens ProductCERT · Nov 12, 2024
References
- CVE-2023-4236 vendor-advisory
- http://www.openwall.com/lists/oss-security/2023/09/20/2
- https://www.debian.org/security/2023/dsa-5504
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPJLLTJCSDJJII7IIZPLTBQNWP7MZH7F/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U35OARLQCPMVCBBPHWBXY5M6XJLD2TZ5/
- https://security.netapp.com/advisory/ntap-20231013-0004/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSK5V4W4OHPM3JTJGWAQD6CZW7SFD75B/