ISC BIND 9

• CVE-2026-97313 High 7.5 Specific RPZ configurations and query patterns may result in an unexpected exit 0.4%
• CVE-2026-96888 High 7.5 Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization 0.5%
• CVE-2026-94300 High 8.1 Concurrent GSS-TSIG messages corrupt memory 1.0%
• CVE-2026-19630 High 7.5 Amplified resource exhaustion in inbound message processing 0.4%
• CVE-2026-77119 Medium 5.9 NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets 0.2%
• CVE-2026-75029 Medium 5.3 Message parser retains every identical singleton RDATA, enabling wire-to-work amplification 0.5%
• CVE-2026-19668 Medium 5.3 Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching 0.5%
• CVE-2026-19033 Medium 6.5 Unauthenticated IXFR deltas are applied to the live zone before TSIG verification 0.2%
• CVE-2026-80274 High 7.5 Validating resolver can abort while caching a mismatched NOQNAME proof 0.6%
• CVE-2026-76163 High 7.5 named aborts on a TKEY query when the user configuration has no global options statement 0.6%
• CVE-2026-19666 High 7.5 Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path 0.6%
• CVE-2026-81563 High 7.5 SVCB AliasMode additional-data error leaks qpcache references 0.6%
• CVE-2026-78301 Medium 5.8 Out-of-zone database nodes can become authoritative zone cuts 0.2%
• CVE-2026-77692 High 7.5 Unauthenticated remote crash of named via a single DoH SIG(0) request 6.6%
• CVE-2026-19941 Medium 5.9 checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof 0.2%
• CVE-2026-19662 Medium 5.9 qpcache NOQNAME proof use-after-free crashes recursive resolver 0.5%
• CVE-2026-19667 High 7.5 Remote assertion failure via 16-bit length truncation in `dns_ncache_add()` 0.6%
• CVE-2026-81736 High 7.5 Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees 0.6%
• CVE-2026-13321 High 8.6 DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field 0.2%
• CVE-2026-13204 High 7.5 Unexpected exit in certain situations with NSEC and NSEC3 both present 0.5%
• CVE-2026-12617 High 7.5 Record ordering based unexpected exit with CNAME or DNAME 0.5%
• CVE-2026-11721 High 7.5 Cache poisoning possible with label count discrepancy, RRSIG, and wildcards 0.4%
• CVE-2026-11622 High 7.5 Potential memory usage beyond configured limits 0.5%
• CVE-2026-11605 High 7.5 Unnecessary validation of DNSSEC signed records 0.7%
• CVE-2026-11331 High 7.5 Potential wildcard CNAME RPZ policy bypass 0.4%
• CVE-2026-10822 Medium 6.5 Key Record using PRIVATEDNS algorithm may lead to unexpected exit 0.4%
• CVE-2026-10723 Medium 6.8 Incorrect acceptance of NSEC3 records 0.3%
• CVE-2026-5950 Medium 5.3 Unbounded resend loop in BIND 9 resolver 0.7%
• CVE-2026-5947 High 7.5 SIG(0) validation during query flood may lead to undefined behavior 1.4%
• CVE-2026-5946 High 7.5 Invalid handling of CLASS != IN 1.9%
• CVE-2026-3593 High 7.4 Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation 1.5%
• CVE-2026-3592 Medium 5.3 Amplification vulnerabilities via self-pointed glue records 0.4%
• CVE-2026-3039 High 7.5 BIND 9 server memory exhaustion during GSS-API TKEY negotiation 1.1%
• CVE-2026-3591 Medium 5.4 A stack use-after-return flaw in SIG(0) handling code may enable ACL bypass 0.4%
• CVE-2026-3119 Medium 6.5 Authenticated query containing a TKEY record may cause named to terminate unexpectedly 0.6%
• CVE-2026-3104 High 7.5 Memory leak in code preparing DNSSEC proofs of non-existence 0.7%
• CVE-2026-1519 High 7.5 Excessive NSEC3 iterations cause high CPU load during insecure delegation validation 1.7%
• CVE-2025-13878 High 7.5 Malformed BRID/HHIT records can cause named to terminate unexpectedly 9.4%
• CVE-2025-40780 High 8.6 Cache poisoning due to weak PRNG 0.5%
• CVE-2025-40778 High 8.6 Cache poisoning attacks with unsolicited RRs 0.7%
• CVE-2025-8677 High 7.5 Resource exhaustion via malformed DNSKEY handling 10.7%
• CVE-2025-40777 High 7.5 A possible assertion failure when 'stale-answer-client-timeout' is set to '0' 1.0%
• CVE-2025-40776 High 8.6 Birthday Attack against Resolvers supporting ECS 0.2%
• CVE-2025-40775 High 7.5 DNS message with invalid TSIG causes an assertion failure 15.3%
• CVE-2024-12705 High 7.5 DNS-over-HTTPS implementation suffers from multiple issues under heavy query load 18.6%
• CVE-2024-11187 High 7.5 Many records in the additional section cause CPU exhaustion 16.0%
• CVE-2024-4076 High 7.5 Assertion failure when serving both stale cache data and authoritative zone content 2.1%
• CVE-2024-1975 High 7.5 SIG(0) can be used to exhaust CPU resources 2.1%
• CVE-2024-1737 High 7.5 BIND's database will be slow if a very large number of RRs exist at the same name 2.1%
• CVE-2024-0760 High 7.5 A flood of DNS messages over TCP may make the server unstable 4.7%