CVE-2022-2795

Processing large delegations may severely degrade resolver performance

State: Published
Severity: 5.3 Medium
Published: Sep 21, 2022
Updated: Nov 29, 2024
Reserved: Aug 12, 2022

Description

By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	isc

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
BIND9ISC	Open Source Branches 9.0 through 9.16 9.0.0 through versions before 9.16.33Affected Open Source Branch 9.18 9.18.0 through versions before 9.18.7Affected Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions up to and including 9.11.37-S1Affected Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1Affected Development Branch 9.19 9.19.0 through versions before 9.19.5Affected

Product

Versions

BIND9ISC

Open Source Branches 9.0 through 9.16 9.0.0 through versions before 9.16.33Affected
Open Source Branch 9.18 9.18.0 through versions before 9.18.7Affected
Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions up to and including 9.11.37-S1Affected
Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1Affected
Development Branch 9.19 9.19.0 through versions before 9.19.5Affected

References

https://kb.isc.org/docs/cve-2022-2795
[oss-security] 20220921 ISC has disclosed six vulnerabilities in BIND (CVE-2022-2795, CVE-2022-2881, CVE-2022-2906, CVE-2022-3080, CVE-2022-38177, CVE-2022-38178)mailing-list
DSA-5235vendor-advisory
FEDORA-2022-ef038365devendor-advisory
FEDORA-2022-8268735e06vendor-advisory
FEDORA-2022-b197d64471vendor-advisory
[debian-lts-announce] 20221005 [SECURITY] [DLA 3138-1] bind9 security updatemailing-list
GLSA-202210-25vendor-advisory
https://security.netapp.com/advisory/ntap-20241129-0002/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.