https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T13:39:54.675115+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2024:1781 ALSA-2024:1781 — Important: bind9.16 security update 2026-10-02T13:39:54.735453+00:00

Affected: AlmaLinux:8: bind9.16, AlmaLinux:8: bind9.16-chroot, AlmaLinux:8: bind9.16-devel, AlmaLinux:8: bind9.16-dnssec-utils, AlmaLinux:8: bind9.16-doc, AlmaLinux:8: bind9.16-libs, AlmaLinux:8: bind9.16-license, AlmaLinux:8: bind9.16-utils, AlmaLinux:8: python3-bind9.16

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es):

* bind9: Parsing large DNS messages may cause excessive CPU load (CVE-2023-4408) * bind9: Querying RFC 1918 reverse zones may cause an assertion failure when “nxdomain-redirect” is enabled (CVE-2023-5517) * bind9: Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution (CVE-2023-5679) * bind9: Specific recursive query patterns may lead to an out-of-memory condition (CVE-2023-6516) * bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator (CVE-2023-50387) * bind9: Preparing an NSEC3 closest encloser proof can exhaust CPU resources (CVE-2023-50868)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2024-02883 bdu:2024-02883 2026-10-02T13:39:54.735550+00:00 bdu:2024-02883 https://cve.radiocsirt.org/vuln/bell-cve-2023-4408 BELL-CVE-2023-4408 2026-10-02T13:39:54.735568+00:00

Affected: Alpaquita:23: bind, Alpaquita:stream: bind

 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0122 certfr-2024-avi-0122 — De multiples vulnérabilités ont été découvertes dans <span class="textit">Bind</span>. Elles permettent à un attaquant… 2026-10-02T13:39:54.735588+00:00 certfr-2024-avi-0122 https://cve.radiocsirt.org/vuln/euvd-2026-222824 EUVD-2026-222824 2026-10-02T13:39:54.735604+00:00 EUVD-2026-222824 https://cve.radiocsirt.org/vuln/fkie_cve-2023-4408 fkie_cve-2023-4408 2026-10-02T13:39:54.735615+00:00

The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.

 https://cve.radiocsirt.org/vuln/ghsa-x57x-3c65-5f3j GHSA-x57x-3c65-5f3j 2026-10-02T13:39:54.735639+00:00

The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.

 https://cve.radiocsirt.org/vuln/gsd-2023-4408 gsd-2023-4408 2026-10-02T13:39:54.735655+00:00 gsd-2023-4408 https://cve.radiocsirt.org/vuln/icsa-24-319-08 ICSA-24-319-08 — Siemens SINEC INS 2026-10-02T13:39:54.735665+00:00

Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can be mislead by removing adding or reordering such empty entries as these are ignored by the OpenSSL implementation. We are currently unaware of any such applications. The AES-SIV algorithm allows for authentication of multiple associated data entries along with the encryption. To authenticate empty data the application has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with NULL pointer as the output buffer and 0 as the input buffer length. The AES-SIV implementation in OpenSSL just returns success for such a call instead of performing the associated data authentication operation. The empty data thus will not be authenticated. As this issue does not affect non-empty associated data authentication and we expect it to be rare for an application to use empty associated data entries this is qualified as Low severity issue. The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing code to run out of available stack memory, causing `named` to terminate unexpectedly. Since each incoming control cha…

 https://cve.radiocsirt.org/vuln/msrc_cve-2023-4408 msrc_CVE-2023-4408 — Parsing large DNS messages may cause excessive CPU load 2026-10-02T13:39:54.735855+00:00 msrc_CVE-2023-4408 https://cve.radiocsirt.org/vuln/oesa-2024-1323 OESA-2024-1323 — bind security update 2026-10-02T13:39:54.735871+00:00

Affected: openEuler:22.03-LTS: bind

Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System. This package includes the components to operate a DNS server. Security Fix(es): The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.(CVE-2023-4408) Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the &quot;KeyTrap&quot; issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.(CVE-2023-50387) A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when: - `nxdomain-redirect &lt;domain&gt;;` is configured, and - the resolver r…

 https://cve.radiocsirt.org/vuln/opensuse-su-2024:13687-1 openSUSE-SU-2024:13687-1 — bind-9.18.24-1.1 on GA media 2026-10-02T13:39:54.735909+00:00

bind-9.18.24-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2024:1647 RHSA-2024:1647 — Red Hat Security Advisory: bind9.16 security update 2026-10-02T13:39:54.735928+00:00

bind9: Parsing large DNS messages may cause excessive CPU load bind9: Querying RFC 1918 reverse zones may cause an assertion failure when “nxdomain-redirect” is enabled bind9: Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution bind9: Specific recursive query patterns may lead to an out-of-memory condition bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator bind9: Preparing an NSEC3 closest encloser proof can exhaust CPU resources

 https://cve.radiocsirt.org/vuln/suse-su-2024:0574-1 SUSE-SU-2024:0574-1 — Security update for bind 2026-10-02T13:39:54.735954+00:00

Security update for bind

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-4408 UBUNTU-CVE-2023-4408 2026-10-02T13:39:54.735970+00:00

Affected: Ubuntu:Pro:14.04:LTS: bind9, Ubuntu:Pro:16.04:LTS: bind9, Ubuntu:Pro:18.04:LTS: bind9, Ubuntu:20.04:LTS: bind9, Ubuntu:20.04:LTS: bind9-libs, Ubuntu:22.04:LTS: bind9, Ubuntu:22.04:LTS: bind9-libs, Ubuntu:24.04:LTS: isc-dhcp, Ubuntu:25.10: isc-dhcp, Ubuntu:26.04:LTS: isc-dhcp

The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0386 WID-SEC-W-2024-0386 — Internet Systems Consortium BIND: Mehrere Schwachstellen ermöglichen Denial of Service 2026-10-02T13:39:54.736003+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Internet Systems Consortium BIND ausnutzen, um einen Denial of Service Angriff durchzuführen.