# cve.now: ISC

The newest entries naming ISC as an affected vendor (up to 200), of 134 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-97313](https://cve.now/CVE-2026-97313.md): Specific RPZ configurations and query patterns may result in an unexpected exit (CVSS 7.5)
- [CVE-2026-96888](https://cve.now/CVE-2026-96888.md): Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization (CVSS 7.5)
- [CVE-2026-94300](https://cve.now/CVE-2026-94300.md): Concurrent GSS-TSIG messages corrupt memory (CVSS 8.1)
- [CVE-2026-19630](https://cve.now/CVE-2026-19630.md): Amplified resource exhaustion in inbound message processing (CVSS 7.5)
- [CVE-2026-77119](https://cve.now/CVE-2026-77119.md): NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets (CVSS 5.9)
- [CVE-2026-75029](https://cve.now/CVE-2026-75029.md): Message parser retains every identical singleton RDATA, enabling wire-to-work amplification (CVSS 5.3)
- [CVE-2026-19668](https://cve.now/CVE-2026-19668.md): Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching (CVSS 5.3)
- [CVE-2026-19033](https://cve.now/CVE-2026-19033.md): Unauthenticated IXFR deltas are applied to the live zone before TSIG verification (CVSS 6.5)
- [CVE-2026-80274](https://cve.now/CVE-2026-80274.md): Validating resolver can abort while caching a mismatched NOQNAME proof (CVSS 7.5)
- [CVE-2026-76163](https://cve.now/CVE-2026-76163.md): named aborts on a TKEY query when the user configuration has no global options statement (CVSS 7.5)
- [CVE-2026-19666](https://cve.now/CVE-2026-19666.md): Use-after-free in query\_addnoqnameproof() via the DNS64 filter64 path (CVSS 7.5)
- [CVE-2026-81563](https://cve.now/CVE-2026-81563.md): SVCB AliasMode additional-data error leaks qpcache references (CVSS 7.5)
- [CVE-2026-78301](https://cve.now/CVE-2026-78301.md): Out-of-zone database nodes can become authoritative zone cuts (CVSS 5.8)
- [CVE-2026-77692](https://cve.now/CVE-2026-77692.md): Unauthenticated remote crash of named via a single DoH SIG(0) request (CVSS 7.5)
- [CVE-2026-19941](https://cve.now/CVE-2026-19941.md): checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof (CVSS 5.9)
- [CVE-2026-19662](https://cve.now/CVE-2026-19662.md): qpcache NOQNAME proof use-after-free crashes recursive resolver (CVSS 5.9)
- [CVE-2026-19667](https://cve.now/CVE-2026-19667.md): Remote assertion failure via 16-bit length truncation in \`dns\_ncache\_add()\` (CVSS 7.5)
- [CVE-2026-81736](https://cve.now/CVE-2026-81736.md): Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees (CVSS 7.5)
- [CVE-2026-13321](https://cve.now/CVE-2026-13321.md): DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVSS 8.6)
- [CVE-2026-13204](https://cve.now/CVE-2026-13204.md): Unexpected exit in certain situations with NSEC and NSEC3 both present (CVSS 7.5)
- [CVE-2026-12617](https://cve.now/CVE-2026-12617.md): Record ordering based unexpected exit with CNAME or DNAME (CVSS 7.5)
- [CVE-2026-11721](https://cve.now/CVE-2026-11721.md): Cache poisoning possible with label count discrepancy, RRSIG, and wildcards (CVSS 7.5)
- [CVE-2026-11622](https://cve.now/CVE-2026-11622.md): Potential memory usage beyond configured limits (CVSS 7.5)
- [CVE-2026-11605](https://cve.now/CVE-2026-11605.md): Unnecessary validation of DNSSEC signed records (CVSS 7.5)
- [CVE-2026-11331](https://cve.now/CVE-2026-11331.md): Potential wildcard CNAME RPZ policy bypass (CVSS 7.5)
- [CVE-2026-10822](https://cve.now/CVE-2026-10822.md): Key Record using PRIVATEDNS algorithm may lead to unexpected exit (CVSS 6.5)
- [CVE-2026-10723](https://cve.now/CVE-2026-10723.md): Incorrect acceptance of NSEC3 records (CVSS 6.8)
- [CVE-2026-5950](https://cve.now/CVE-2026-5950.md): Unbounded resend loop in BIND 9 resolver (CVSS 5.3)
- [CVE-2026-5947](https://cve.now/CVE-2026-5947.md): SIG(0) validation during query flood may lead to undefined behavior (CVSS 7.5)
- [CVE-2026-5946](https://cve.now/CVE-2026-5946.md): Invalid handling of CLASS != IN (CVSS 7.5)
- [CVE-2026-3593](https://cve.now/CVE-2026-3593.md): Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation (CVSS 7.4)
- [CVE-2026-3592](https://cve.now/CVE-2026-3592.md): Amplification vulnerabilities via self-pointed glue records (CVSS 5.3)
- [CVE-2026-3039](https://cve.now/CVE-2026-3039.md): BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVSS 7.5)
- [CVE-2026-3591](https://cve.now/CVE-2026-3591.md): A stack use-after-return flaw in SIG(0) handling code may enable ACL bypass (CVSS 5.4)
- [CVE-2026-3119](https://cve.now/CVE-2026-3119.md): Authenticated query containing a TKEY record may cause named to terminate unexpectedly (CVSS 6.5)
- [CVE-2026-3104](https://cve.now/CVE-2026-3104.md): Memory leak in code preparing DNSSEC proofs of non-existence (CVSS 7.5)
- [CVE-2026-1519](https://cve.now/CVE-2026-1519.md): Excessive NSEC3 iterations cause high CPU load during insecure delegation validation (CVSS 7.5)
- [CVE-2026-3608](https://cve.now/CVE-2026-3608.md): Stack overflow in Kea daemons (CVSS 7.5)
- [CVE-2025-13878](https://cve.now/CVE-2025-13878.md): Malformed BRID/HHIT records can cause named to terminate unexpectedly (CVSS 7.5)
- [CVE-2025-11232](https://cve.now/CVE-2025-11232.md): Invalid characters cause assert (CVSS 7.5)
- [CVE-2025-40780](https://cve.now/CVE-2025-40780.md): Cache poisoning due to weak PRNG (CVSS 8.6)
- [CVE-2025-40778](https://cve.now/CVE-2025-40778.md): Cache poisoning attacks with unsolicited RRs (CVSS 8.6)
- [CVE-2025-8677](https://cve.now/CVE-2025-8677.md): Resource exhaustion via malformed DNSKEY handling (CVSS 7.5)
- [CVE-2025-8696](https://cve.now/CVE-2025-8696.md): DoS attack against the Stork UI from an unauthenticated user (CVSS 7.5)
- [CVE-2025-40779](https://cve.now/CVE-2025-40779.md): Kea crash upon interaction between specific client options and subnet selection (CVSS 7.5)
- [CVE-2025-40777](https://cve.now/CVE-2025-40777.md): A possible assertion failure when 'stale-answer-client-timeout' is set to '0' (CVSS 7.5)
- [CVE-2025-40776](https://cve.now/CVE-2025-40776.md): Birthday Attack against Resolvers supporting ECS (CVSS 8.6)
- [CVE-2025-32803](https://cve.now/CVE-2025-32803.md): Insecure file permissions can result in confidential information leakage (CVSS 4.0)
- [CVE-2025-32802](https://cve.now/CVE-2025-32802.md): Insecure handling of file paths allows multiple local attacks (CVSS 6.1)
- [CVE-2025-32801](https://cve.now/CVE-2025-32801.md): Loading a malicious hook library can lead to local privilege escalation (CVSS 7.8)
- [CVE-2025-40775](https://cve.now/CVE-2025-40775.md): DNS message with invalid TSIG causes an assertion failure (CVSS 7.5)
- [CVE-2024-12705](https://cve.now/CVE-2024-12705.md): DNS-over-HTTPS implementation suffers from multiple issues under heavy query load (CVSS 7.5)
- [CVE-2024-11187](https://cve.now/CVE-2024-11187.md): Many records in the additional section cause CPU exhaustion (CVSS 7.5)
- [CVE-2024-4076](https://cve.now/CVE-2024-4076.md): Assertion failure when serving both stale cache data and authoritative zone content (CVSS 7.5)
- [CVE-2024-1975](https://cve.now/CVE-2024-1975.md): SIG(0) can be used to exhaust CPU resources (CVSS 7.5)
- [CVE-2024-1737](https://cve.now/CVE-2024-1737.md): BIND's database will be slow if a very large number of RRs exist at the same name (CVSS 7.5)
- [CVE-2024-0760](https://cve.now/CVE-2024-0760.md): A flood of DNS messages over TCP may make the server unstable (CVSS 7.5)
- [CVE-2024-28872](https://cve.now/CVE-2024-28872.md): Incorrect TLS certificate validation can lead to escalated privileges (CVSS 8.9)
- [CVE-2023-6516](https://cve.now/CVE-2023-6516.md): Specific recursive query patterns may lead to an out-of-memory condition (CVSS 7.5)
- [CVE-2023-5680](https://cve.now/CVE-2023-5680.md): Cleaning an ECS-enabled cache may cause excessive CPU load (CVSS 5.3)
- [CVE-2023-5679](https://cve.now/CVE-2023-5679.md): Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution (CVSS 7.5)
- [CVE-2023-5517](https://cve.now/CVE-2023-5517.md): Querying RFC 1918 reverse zones may cause an assertion failure when "nxdomain-redirect" is enabled (CVSS 7.5)
- [CVE-2023-4408](https://cve.now/CVE-2023-4408.md): Parsing large DNS messages may cause excessive CPU load (CVSS 7.5)
- [CVE-2023-4236](https://cve.now/CVE-2023-4236.md): named may terminate unexpectedly under high DNS-over-TLS query load (CVSS 7.5)
- [CVE-2023-3341](https://cve.now/CVE-2023-3341.md): A stack exhaustion flaw in control channel code may cause named to terminate unexpectedly (CVSS 7.5)
- [CVE-2023-2911](https://cve.now/CVE-2023-2911.md): Exceeding the recursive-clients quota may cause named to terminate unexpectedly when stale-answer-client-timeout is set to 0 (CVSS 7.5)
- [CVE-2023-2829](https://cve.now/CVE-2023-2829.md): Malformed NSEC records can cause named to terminate unexpectedly when synth-from-dnssec is enabled (CVSS 7.5)
- [CVE-2023-2828](https://cve.now/CVE-2023-2828.md): named's configured cache size limit can be significantly exceeded (CVSS 7.5)
- [CVE-2022-3924](https://cve.now/CVE-2022-3924.md): named configured to answer from stale cache may terminate unexpectedly at recursive-clients soft quota (CVSS 7.5)
- [CVE-2022-3736](https://cve.now/CVE-2022-3736.md): named configured to answer from stale cache may terminate unexpectedly while processing RRSIG queries (CVSS 7.5)
- [CVE-2022-3488](https://cve.now/CVE-2022-3488.md): named may terminate unexpectedly when processing ECS options in repeated responses to iterative queries (CVSS 7.5)
- [CVE-2022-3094](https://cve.now/CVE-2022-3094.md): An UPDATE message flood may cause named to exhaust all available memory (CVSS 7.5)
- [CVE-2022-2929](https://cve.now/CVE-2022-2929.md): DHCP memory leak (CVSS 6.5)
- [CVE-2022-2928](https://cve.now/CVE-2022-2928.md): An option refcount overflow exists in dhcpd (CVSS 6.5)
- [CVE-2022-3080](https://cve.now/CVE-2022-3080.md): BIND 9 resolvers configured to answer from stale cache with zero stale-answer-client-timeout may terminate unexpectedly (CVSS 7.5)
- [CVE-2022-38178](https://cve.now/CVE-2022-38178.md): Memory leaks in EdDSA DNSSEC verification code (CVSS 7.5)
- [CVE-2022-38177](https://cve.now/CVE-2022-38177.md): Memory leak in ECDSA DNSSEC verification code (CVSS 7.5)
- [CVE-2022-2906](https://cve.now/CVE-2022-2906.md): Memory leaks in code handling Diffie-Hellman key exchange via TKEY RRs (OpenSSL 3.0.0+ only) (CVSS 7.5)
- [CVE-2022-2881](https://cve.now/CVE-2022-2881.md): Buffer overread in statistics channel code (CVSS 5.5)
- [CVE-2022-2795](https://cve.now/CVE-2022-2795.md): Processing large delegations may severely degrade resolver performance (CVSS 5.3)
- [CVE-2022-1183](https://cve.now/CVE-2022-1183.md): Destroying a TLS session early causes assertion failure (CVSS 7.5)
- [CVE-2021-25220](https://cve.now/CVE-2021-25220.md): DNS forwarders - cache poisoning vulnerability (CVSS 6.8)
- [CVE-2022-0635](https://cve.now/CVE-2022-0635.md): Versions affected: BIND 9.18.0 When a vulnerable version of named receives a series of specific queries, the named process will eventually t (CVSS 7.5)
- [CVE-2022-0396](https://cve.now/CVE-2022-0396.md): DoS from specifically crafted TCP packets (CVSS 5.3)
- [CVE-2022-0667](https://cve.now/CVE-2022-0667.md): Assertion failure on delayed DS lookup (CVSS 7.5)
- [CVE-2021-25219](https://cve.now/CVE-2021-25219.md): Lame cache can be abused to severely degrade resolver performance (CVSS 5.3)
- [CVE-2021-25218](https://cve.now/CVE-2021-25218.md): A too-strict assertion check could be triggered when responses in BIND 9.16.19 and 9.17.16 require UDP fragmentation if RRL is in use (CVSS 7.5)
- [CVE-2021-25217](https://cve.now/CVE-2021-25217.md): A buffer overrun in lease file parsing code can be used to exploit a common vulnerability shared by dhcpd and dhclient (CVSS 7.4)
- [CVE-2021-25216](https://cve.now/CVE-2021-25216.md): A second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack (CVSS 8.1)
- [CVE-2021-25215](https://cve.now/CVE-2021-25215.md): An assertion check can fail while answering queries for DNAME records that require the DNAME to be processed to resolve itself (CVSS 7.5)
- [CVE-2021-25214](https://cve.now/CVE-2021-25214.md): A broken inbound incremental zone update (IXFR) can cause named to terminate unexpectedly (CVSS 6.5)
- [CVE-2020-8625](https://cve.now/CVE-2020-8625.md): A vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack (CVSS 8.1)
- [CVE-2020-8624](https://cve.now/CVE-2020-8624.md): update-policy rules of type "subdomain" are enforced incorrectly (CVSS 4.3)
- [CVE-2020-8623](https://cve.now/CVE-2020-8623.md): A flaw in native PKCS#11 code can lead to a remotely triggerable assertion failure in pk11.c (CVSS 7.5)
- [CVE-2020-8622](https://cve.now/CVE-2020-8622.md): A truncated TSIG response can lead to an assertion failure (CVSS 6.5)
- [CVE-2020-8621](https://cve.now/CVE-2020-8621.md): Attempting QNAME minimization after forwarding can lead to an assertion failure in resolver.c (CVSS 7.5)
- [CVE-2020-8620](https://cve.now/CVE-2020-8620.md): In BIND 9.15.6 -\> 9.16.5, 9.17.0 -\> 9.17.3, An attacker who can establish a TCP connection with the server and send data on that connection (CVSS 7.5)
- [CVE-2020-8619](https://cve.now/CVE-2020-8619.md): A buffer boundary check assertion in rdataset.c can fail incorrectly during zone transfer (CVSS 4.9)
- [CVE-2020-8618](https://cve.now/CVE-2020-8618.md): A buffer boundary check assertion in rdataset.c can fail incorrectly during zone transfer (CVSS 4.9)
- [CVE-2020-8617](https://cve.now/CVE-2020-8617.md): A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c (CVSS 7.5)
- [CVE-2020-8616](https://cve.now/CVE-2020-8616.md): BIND does not sufficiently limit the number of fetches performed when processing referrals (CVSS 8.6)
- [CVE-2019-6477](https://cve.now/CVE-2019-6477.md): TCP-pipelined queries can bypass tcp-clients limit (CVSS 7.5)
- [CVE-2019-6476](https://cve.now/CVE-2019-6476.md): An error in QNAME minimization code can cause BIND to exit with an assertion failure (CVSS 5.9)
- [CVE-2019-6475](https://cve.now/CVE-2019-6475.md): A flaw in mirror zone validity checking can allow zone data to be spoofed (CVSS 5.9)
- [CVE-2019-6474](https://cve.now/CVE-2019-6474.md): A packet containing a malformed DUID can cause the kea-dhcp6 server to terminate (CVSS 5.7)
- [CVE-2019-6473](https://cve.now/CVE-2019-6473.md): A packet containing a malformed DUID can cause the kea-dhcp6 server to terminate (CVSS 6.5)
- [CVE-2019-6472](https://cve.now/CVE-2019-6472.md): A packet containing a malformed DUID can cause the kea-dhcp6 server to terminate (CVSS 6.5)
- [CVE-2019-6471](https://cve.now/CVE-2019-6471.md): A race condition when discarding malformed packets can cause BIND to exit with an assertion failure (CVSS 5.9)
- [CVE-2019-6469](https://cve.now/CVE-2019-6469.md): BIND Supported Preview Edition can exit with an assertion failure if ECS is in use (CVSS 5.9)
- [CVE-2019-6468](https://cve.now/CVE-2019-6468.md): BIND Supported Preview Edition can exit with an assertion failure if nxdomain-redirect is used (CVSS 5.3)
- [CVE-2019-6467](https://cve.now/CVE-2019-6467.md): An error in the nxdomain redirect feature can cause BIND to exit with an INSIST assertion failure in query.c (CVSS 5.9)
- [CVE-2019-6465](https://cve.now/CVE-2019-6465.md): Zone transfer controls for writable DLZ zones were not effective (CVSS 5.3)
- [CVE-2018-5745](https://cve.now/CVE-2018-5745.md): An assertion failure can occur if a trust anchor rolls over to an unsupported key algorithm when using managed-keys (CVSS 4.9)
- [CVE-2018-5744](https://cve.now/CVE-2018-5744.md): A specially crafted packet can cause named to leak memory (CVSS 7.5)
- [CVE-2018-5743](https://cve.now/CVE-2018-5743.md): Limiting simultaneous TCP clients was ineffective (CVSS 7.5)
- [CVE-2018-5732](https://cve.now/CVE-2018-5732.md): A specially constructed response from a malicious server can cause a buffer overflow in dhclient (CVSS 7.5)
- [CVE-2018-5741](https://cve.now/CVE-2018-5741.md): Update policies krb5-subdomain and ms-subdomain do not enforce controls promised in their documentation (CVSS 6.5)
- [CVE-2018-5740](https://cve.now/CVE-2018-5740.md): A flaw in the "deny-answer-aliases" feature can cause an assertion failure in named (CVSS 7.5)
- [CVE-2018-5739](https://cve.now/CVE-2018-5739.md): Failure to release memory may exhaust system resources (CVSS 6.5)
- [CVE-2018-5738](https://cve.now/CVE-2018-5738.md): Some versions of BIND can improperly permit recursive query service to unauthorized clients (CVSS 5.3)
- [CVE-2018-5737](https://cve.now/CVE-2018-5737.md): BIND 9.12's serve-stale implementation can cause an assertion failure in rbtdb.c or other undesirable behavior, even if serve-stale is not enabled. (CVSS 5.9)
- [CVE-2018-5734](https://cve.now/CVE-2018-5734.md): A malformed request can trigger an assertion failure in badcache.c (CVSS 7.5)
- [CVE-2018-5733](https://cve.now/CVE-2018-5733.md): A malicious client can overflow a reference counter in ISC dhcpd (CVSS 5.9)
- [CVE-2017-3145](https://cve.now/CVE-2017-3145.md): Improper fetch cleanup sequencing in the resolver can cause named to crash (CVSS 7.5)
- [CVE-2017-3144](https://cve.now/CVE-2017-3144.md): Failure to properly clean up closed OMAPI connections can exhaust available sockets (CVSS 5.3)
- [CVE-2017-3143](https://cve.now/CVE-2017-3143.md): An error in TSIG authentication can permit unauthorized dynamic updates (CVSS 7.5)
- [CVE-2017-3142](https://cve.now/CVE-2017-3142.md): An error in TSIG authentication can permit unauthorized zone transfers (CVSS 5.3)
- [CVE-2017-3141](https://cve.now/CVE-2017-3141.md): Windows service and uninstall paths are not quoted when BIND is installed (CVSS 7.2)
- [CVE-2017-3140](https://cve.now/CVE-2017-3140.md): An error processing RPZ rules can cause named to loop endlessly after handling a query (CVSS 3.7)
- [CVE-2017-3138](https://cve.now/CVE-2017-3138.md): named exits with a REQUIRE assertion failure if it receives a null command string on its control channel (CVSS 6.5)
- [CVE-2017-3137](https://cve.now/CVE-2017-3137.md): A response packet can cause a resolver to terminate when processing an answer containing a CNAME or DNAME (CVSS 7.5)
- [CVE-2017-3136](https://cve.now/CVE-2017-3136.md): An error handling synthesized records could cause an assertion failure when using DNS64 with "break-dnssec yes;" (CVSS 5.9)
- [CVE-2017-3135](https://cve.now/CVE-2017-3135.md): Combination of DNS64 and RPZ Can Lead to Crash (CVSS 7.5)
- [CVE-2016-9778](https://cve.now/CVE-2016-9778.md): An error handling certain queries using the nxdomain-redirect feature could cause a REQUIRE assertion failure in db.c (CVSS 7.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/isc
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.