# ISC BIND 9. Every CVE that names ISC BIND 9 among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Specific RPZ configurations and query patterns may result in an unexpected exit](https://agentprime.io/advisories/CVE-2026-97313.md) `CVE-2026-97313` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service - [Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization](https://agentprime.io/advisories/CVE-2026-96888.md) `CVE-2026-96888` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Memory corruption, Denial of service - [Concurrent GSS-TSIG messages corrupt memory](https://agentprime.io/advisories/CVE-2026-94300.md) `CVE-2026-94300` · CVE record: ISC BIND 9 · CVSS 8.1 High · Not analysed yet · Published 21 Oct 2026 · Tags: Race condition, Memory corruption - [Amplified resource exhaustion in inbound message processing](https://agentprime.io/advisories/CVE-2026-19630.md) `CVE-2026-19630` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service - [NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets](https://agentprime.io/advisories/CVE-2026-77119.md) `CVE-2026-77119` · CVE record: ISC BIND 9 · CVSS 5.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-346 - [Message parser retains every identical singleton RDATA, enabling wire-to-work amplification](https://agentprime.io/advisories/CVE-2026-75029.md) `CVE-2026-75029` · CVE record: ISC BIND 9 · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-405 - [Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching](https://agentprime.io/advisories/CVE-2026-19668.md) `CVE-2026-19668` · CVE record: ISC BIND 9 · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service - [Unauthenticated IXFR deltas are applied to the live zone before TSIG verification](https://agentprime.io/advisories/CVE-2026-19033.md) `CVE-2026-19033` · CVE record: ISC BIND 9 · CVSS 6.5 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-349 - [Validating resolver can abort while caching a mismatched NOQNAME proof](https://agentprime.io/advisories/CVE-2026-80274.md) `CVE-2026-80274` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service - [named aborts on a TKEY query when the user configuration has no global options statement](https://agentprime.io/advisories/CVE-2026-76163.md) `CVE-2026-76163` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service - [Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path](https://agentprime.io/advisories/CVE-2026-19666.md) `CVE-2026-19666` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: Memory corruption - [SVCB AliasMode additional-data error leaks qpcache references](https://agentprime.io/advisories/CVE-2026-81563.md) `CVE-2026-81563` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service - [Out-of-zone database nodes can become authoritative zone cuts](https://agentprime.io/advisories/CVE-2026-78301.md) `CVE-2026-78301` · CVE record: ISC BIND 9 · CVSS 5.8 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-349 - [Unauthenticated remote crash of named via a single DoH SIG(0) request](https://agentprime.io/advisories/CVE-2026-77692.md) `CVE-2026-77692` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: Memory corruption - [checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof](https://agentprime.io/advisories/CVE-2026-19941.md) `CVE-2026-19941` · CVE record: ISC BIND 9 · CVSS 5.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-345 - [qpcache NOQNAME proof use-after-free crashes recursive resolver](https://agentprime.io/advisories/CVE-2026-19662.md) `CVE-2026-19662` · CVE record: ISC BIND 9 · CVSS 5.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Memory corruption - [Remote assertion failure via 16-bit length truncation in \`dns_ncache_add()\`](https://agentprime.io/advisories/CVE-2026-19667.md) `CVE-2026-19667` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-197 - [Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees](https://agentprime.io/advisories/CVE-2026-81736.md) `CVE-2026-81736` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-1050 - [DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field](https://agentprime.io/advisories/CVE-2026-13321.md) `CVE-2026-13321` · CVE record: ISC BIND 9 · CVSS 8.6 High · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-346 - [Unexpected exit in certain situations with NSEC and NSEC3 both present](https://agentprime.io/advisories/CVE-2026-13204.md) `CVE-2026-13204` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service - [Record ordering based unexpected exit with CNAME or DNAME](https://agentprime.io/advisories/CVE-2026-12617.md) `CVE-2026-12617` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service - [Cache poisoning possible with label count discrepancy, RRSIG, and wildcards](https://agentprime.io/advisories/CVE-2026-11721.md) `CVE-2026-11721` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-1284 - [Potential memory usage beyond configured limits](https://agentprime.io/advisories/CVE-2026-11622.md) `CVE-2026-11622` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service - [Unnecessary validation of DNSSEC signed records](https://agentprime.io/advisories/CVE-2026-11605.md) `CVE-2026-11605` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-408 - [Potential wildcard CNAME RPZ policy bypass](https://agentprime.io/advisories/CVE-2026-11331.md) `CVE-2026-11331` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-790 - [Key Record using PRIVATEDNS algorithm may lead to unexpected exit](https://agentprime.io/advisories/CVE-2026-10822.md) `CVE-2026-10822` · CVE record: ISC BIND 9 · CVSS 6.5 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service, CWE-1284 - [Incorrect acceptance of NSEC3 records](https://agentprime.io/advisories/CVE-2026-10723.md) `CVE-2026-10723` · CVE record: ISC BIND 9 · CVSS 6.8 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Weak cryptography or TLS - [Unbounded resend loop in BIND 9 resolver](https://agentprime.io/advisories/CVE-2026-5950.md) `CVE-2026-5950` · CVE record: ISC BIND 9 · CVSS 5.3 Medium · Not analysed yet · Published 20 May 2026 · Tags: CWE-606 - [SIG(0) validation during query flood may lead to undefined behavior](https://agentprime.io/advisories/CVE-2026-5947.md) `CVE-2026-5947` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 20 May 2026 · Tags: Race condition, Memory corruption - [Invalid handling of CLASS != IN](https://agentprime.io/advisories/CVE-2026-5946.md) `CVE-2026-5946` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 20 May 2026 · Tags: Memory corruption, Denial of service, CWE-20, CWE-754 - [Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation](https://agentprime.io/advisories/CVE-2026-3593.md) `CVE-2026-3593` · CVE record: ISC BIND 9 · CVSS 7.4 High · Not analysed yet · Published 20 May 2026 · Tags: Memory corruption - [Amplification vulnerabilities via self-pointed glue records](https://agentprime.io/advisories/CVE-2026-3592.md) `CVE-2026-3592` · CVE record: ISC BIND 9 · CVSS 5.3 Medium · Not analysed yet · Published 20 May 2026 · Tags: CWE-408 - [BIND 9 server memory exhaustion during GSS-API TKEY negotiation](https://agentprime.io/advisories/CVE-2026-3039.md) `CVE-2026-3039` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 20 May 2026 · Tags: Denial of service, CWE-771 - [A stack use-after-return flaw in SIG(0) handling code may enable ACL bypass](https://agentprime.io/advisories/CVE-2026-3591.md) `CVE-2026-3591` · CVE record: ISC BIND 9 · CVSS 5.4 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: CWE-305, CWE-562 - [Authenticated query containing a TKEY record may cause named to terminate unexpectedly](https://agentprime.io/advisories/CVE-2026-3119.md) `CVE-2026-3119` · CVE record: ISC BIND 9 · CVSS 6.5 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: Denial of service - [Memory leak in code preparing DNSSEC proofs of non-existence](https://agentprime.io/advisories/CVE-2026-3104.md) `CVE-2026-3104` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 25 Mar 2026 · Tags: Denial of service - [Excessive NSEC3 iterations cause high CPU load during insecure delegation validation](https://agentprime.io/advisories/CVE-2026-1519.md) `CVE-2026-1519` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 25 Mar 2026 · Tags: Denial of service, CWE-606 - [Malformed BRID/HHIT records can cause named to terminate unexpectedly](https://agentprime.io/advisories/CVE-2025-13878.md) `CVE-2025-13878` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 21 Jan 2026 · Tags: Denial of service, CWE-1286 - [Cache poisoning due to weak PRNG](https://agentprime.io/advisories/CVE-2025-40780.md) `CVE-2025-40780` · CVE record: ISC BIND 9 · CVSS 8.6 High · Not analysed yet · Published 22 Oct 2025 · Tags: CWE-341 - [Cache poisoning attacks with unsolicited RRs](https://agentprime.io/advisories/CVE-2025-40778.md) `CVE-2025-40778` · CVE record: ISC BIND 9 · CVSS 8.6 High · Not analysed yet · Published 22 Oct 2025 · Tags: CWE-349 - [Resource exhaustion via malformed DNSKEY handling](https://agentprime.io/advisories/CVE-2025-8677.md) `CVE-2025-8677` · CVE record: ISC BIND 9 · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.11 · Not analysed yet · Published 22 Oct 2025 · Tags: CWE-405 - [A possible assertion failure when 'stale-answer-client-timeout' is set to '0'](https://agentprime.io/advisories/CVE-2025-40777.md) `CVE-2025-40777` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 16 Jul 2025 · Tags: Denial of service - [Birthday Attack against Resolvers supporting ECS](https://agentprime.io/advisories/CVE-2025-40776.md) `CVE-2025-40776` · CVE record: ISC BIND 9 · CVSS 8.6 High · Not analysed yet · Published 16 Jul 2025 · Tags: CWE-349 - [DNS message with invalid TSIG causes an assertion failure](https://agentprime.io/advisories/CVE-2025-40775.md) `CVE-2025-40775` · CVE record: ISC BIND 9 · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.15 · Not analysed yet · Published 21 May 2025 · Tags: CWE-232 - [DNS-over-HTTPS implementation suffers from multiple issues under heavy query load](https://agentprime.io/advisories/CVE-2024-12705.md) `CVE-2024-12705` · CVE record: ISC BIND 9 · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.19 · Not analysed yet · Published 29 Jan 2025 · Tags: Denial of service - [Many records in the additional section cause CPU exhaustion](https://agentprime.io/advisories/CVE-2024-11187.md) `CVE-2024-11187` · CVE record: ISC BIND 9 · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.16 · Not analysed yet · Published 29 Jan 2025 · Tags: CWE-405 - [Assertion failure when serving both stale cache data and authoritative zone content](https://agentprime.io/advisories/CVE-2024-4076.md) `CVE-2024-4076` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 23 Jul 2024 · Tags: Denial of service - [SIG(0) can be used to exhaust CPU resources](https://agentprime.io/advisories/CVE-2024-1975.md) `CVE-2024-1975` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 23 Jul 2024 · Tags: Denial of service - [BIND's database will be slow if a very large number of RRs exist at the same name](https://agentprime.io/advisories/CVE-2024-1737.md) `CVE-2024-1737` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 23 Jul 2024 · Tags: Denial of service - [A flood of DNS messages over TCP may make the server unstable](https://agentprime.io/advisories/CVE-2024-0760.md) `CVE-2024-0760` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 23 Jul 2024 · Tags: Denial of service - [Specific recursive query patterns may lead to an out-of-memory condition](https://agentprime.io/advisories/CVE-2023-6516.md) `CVE-2023-6516` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 13 Feb 2024 · Tags: Denial of service - [Cleaning an ECS-enabled cache may cause excessive CPU load](https://agentprime.io/advisories/CVE-2023-5680.md) `CVE-2023-5680` · CVE record: ISC BIND 9 · CVSS 5.3 Medium · Not analysed yet · Published 13 Feb 2024 - [Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution](https://agentprime.io/advisories/CVE-2023-5679.md) `CVE-2023-5679` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 13 Feb 2024 · Tags: Denial of service - [Querying RFC 1918 reverse zones may cause an assertion failure when "nxdomain-redirect" is enabled](https://agentprime.io/advisories/CVE-2023-5517.md) `CVE-2023-5517` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 13 Feb 2024 · Tags: Denial of service - [Parsing large DNS messages may cause excessive CPU load](https://agentprime.io/advisories/CVE-2023-4408.md) `CVE-2023-4408` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 13 Feb 2024 · Tags: Denial of service - [named may terminate unexpectedly under high DNS-over-TLS query load](https://agentprime.io/advisories/CVE-2023-4236.md) `CVE-2023-4236` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 20 Sept 2023 - [A stack exhaustion flaw in control channel code may cause named to terminate unexpectedly](https://agentprime.io/advisories/CVE-2023-3341.md) `CVE-2023-3341` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 20 Sept 2023 · Tags: CWE-1325 - [Exceeding the recursive-clients quota may cause named to terminate unexpectedly when stale-answer-client-timeout is set to 0](https://agentprime.io/advisories/CVE-2023-2911.md) `CVE-2023-2911` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 21 Jun 2023 - [Malformed NSEC records can cause named to terminate unexpectedly when synth-from-dnssec is enabled](https://agentprime.io/advisories/CVE-2023-2829.md) `CVE-2023-2829` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 21 Jun 2023 - [named's configured cache size limit can be significantly exceeded](https://agentprime.io/advisories/CVE-2023-2828.md) `CVE-2023-2828` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 21 Jun 2023 Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .