ISC vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited ISC flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2015-5477 ISC BIND Data Processing ErrorsExploited since Oct 8, 2026 · CVSS 7.5

Latest high and critical flaws

• CVE-2026-97313 A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resultiHigh 7.5 · Oct 21, 2026
• CVE-2026-96888 A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirectHigh 7.5 · Oct 21, 2026
• CVE-2026-94300 Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`".High 8.1 · Oct 21, 2026
• CVE-2026-19630 In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND.High 7.5 · Oct 21, 2026
• CVE-2026-80274 If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 prooHigh 7.5 · Sep 16, 2026
• CVE-2026-76163 If BIND is loaded with a "`named.conf`" file that contains no global "`options`" block, an attacker can send a query of QTYPE TKEY which may cause an assertion High 7.5 · Sep 16, 2026
• CVE-2026-19666 On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process wiHigh 7.5 · Sep 16, 2026
• CVE-2026-81736 If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPHigh 7.5 · Sep 16, 2026
• CVE-2026-81563 A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resouHigh 7.5 · Sep 16, 2026
• CVE-2026-77692 An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transporHigh 7.5 · Sep 16, 2026
• CVE-2026-19667 If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entHigh 7.5 · Sep 16, 2026
• CVE-2026-13321 The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone.High 8.6 · Jul 22, 2026
• CVE-2026-13204 If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exiHigh 7.5 · Jul 22, 2026
• CVE-2026-12617 The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records.High 7.5 · Jul 22, 2026
• CVE-2026-11721 It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained.High 7.5 · Jul 22, 2026
• CVE-2026-11622 A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage.High 7.5 · Jul 22, 2026
• CVE-2026-11605 The issue is a resource exhaustion vulnerability associated with DNSSEC validation.High 7.5 · Jul 22, 2026
• CVE-2026-11331 An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error conditHigh 7.5 · Jul 22, 2026
• CVE-2026-5947 Undefined behavior may result due to a race condition leading to a use-after-free violation.High 7.5 · May 20, 2026
• CVE-2026-5946 Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, orHigh 7.5 · May 20, 2026
• CVE-2026-3593 A use-after-free vulnerability exists within the DNS-over-HTTPS implementation.High 7.4 · May 20, 2026
• CVE-2026-3039 BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processinHigh 7.5 · May 20, 2026
• CVE-2026-3104 A specially crafted domain can be used to cause a memory leak in a BIND resolver simply by querying this domain.High 7.5 · Mar 25, 2026
• CVE-2026-1519 If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU.High 7.5 · Mar 25, 2026
• CVE-2026-3608 Sending a maliciously crafted message to the kea-ctrl-agent, kea-dhcp-ddns, kea-dhcp4, or kea-dhcp6 daemons over any configured API socket or HA listener can caHigh 7.5 · Mar 25, 2026