Processing large delegations may severely degrade resolver performance
Published Sep 21, 2022
5.3
MEDIUMCVSS 3.1
EPSS 2.20%
Description
By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.
Affected products
-
- Version Development Branch 9.19 9.19.0 through versions before 9.19.5StatusaffectedConstraints-
- Version Open Source Branch 9.18 9.18.0 through versions before 9.18.7StatusaffectedConstraints-
- Version Open Source Branches 9.0 through 9.16 9.0.0 through versions before 9.16.33StatusaffectedConstraints-
- Version Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1StatusaffectedConstraints-
- Version Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions up to and including 9.11.37-S1StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ISC | BIND9 | n/a |
|
Configuration 1
- ≥ 9.0.0 · < 9.16.33
- ≥ 9.18.0 · < 9.18.7
- ≥ 9.19.0 · < 9.19.5
- 9.9.3
- 9.9.3
- 9.9.12
- 9.9.13
- 9.10.5
- 9.10.7
- 9.11.3
- 9.11.5
- 9.11.5
- 9.11.5
- 9.11.5
- 9.11.6
- 9.11.7
- 9.11.8
- 9.11.12
- 9.11.14-s1
- 9.11.19-s1
- 9.11.21
- 9.11.27
- 9.11.29
- 9.11.35
- 9.11.37
- 9.16.8
- 9.16.11
- 9.16.13
- 9.16.21
- 9.16.32
Configuration 2
- 10.0
- 11.0
Configuration 3
- 35
- 36
- 37
-
- Version 9.0.0StatusaffectedConstraints<=9.16.32
- Version 9.16.8StatusaffectedConstraints<9.16.32
- Version 9.19.0StatusaffectedConstraints<9.19.4
- Version 9.9.3StatusaffectedConstraints<9.11.37
- Version
Red Hat Enterprise Linux 7
bind-32:9.11.4-26.P2.el7_9.13
Fixed · RHSA-2023:0402
Red Hat Enterprise Linux 8
bind-32:9.11.36-8.el8
Fixed · RHSA-2023:3002
Red Hat Enterprise Linux 8
bind-32:9.11.36-8.el8
Fixed · RHSA-2023:3002
Red Hat Enterprise Linux 8
bind9.16-32:9.16.23-0.14.el8
Fixed · RHSA-2023:2792
Red Hat Enterprise Linux 8.6 Extended Update Support
bind-32:9.11.36-3.el8_6.7
Fixed · RHSA-2024:2720
Red Hat Enterprise Linux 8.6 Extended Update Support
dhcp-12:4.3.6-47.el8_6.2
Fixed · RHSA-2024:2720
Red Hat Enterprise Linux 9
bind-32:9.16.23-11.el9
Fixed · RHSA-2023:2261
Red Hat Enterprise Linux 6
bind
Out of support scope
Red Hat Enterprise Linux 9
dhcp
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 7 | bind-32:9.11.4-26.P2.el7_9.13 | Fixed | RHSA-2023:0402 |
| Red Hat Enterprise Linux 8 | bind-32:9.11.36-8.el8 | Fixed | RHSA-2023:3002 |
| Red Hat Enterprise Linux 8 | bind-32:9.11.36-8.el8 | Fixed | RHSA-2023:3002 |
| Red Hat Enterprise Linux 8 | bind9.16-32:9.16.23-0.14.el8 | Fixed | RHSA-2023:2792 |
| Red Hat Enterprise Linux 8.6 Extended Update Support | bind-32:9.11.36-3.el8_6.7 | Fixed | RHSA-2024:2720 |
| Red Hat Enterprise Linux 8.6 Extended Update Support | dhcp-12:4.3.6-47.el8_6.2 | Fixed | RHSA-2024:2720 |
| Red Hat Enterprise Linux 9 | bind-32:9.16.23-11.el9 | Fixed | RHSA-2023:2261 |
| Red Hat Enterprise Linux 6 | bind | Out of support scope | n/a |
| Red Hat Enterprise Linux 9 | dhcp | Not affected | n/a |
No package ranges for this CVE.
Remediation
Vendor solution
Upgrade to the patched release most closely related to your current version of BIND: BIND 9.16.33, BIND 9.18.7, BIND 9.19.5, or for BIND Supported Preview Edition (a special feature preview branch of BIND provided to eligible ISC support customers): BIND 9.16.33-S1.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
No CVSS v3.0 score for this CVE.
No CVSS v2.0 score for this CVE.
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
YesTechnical Impact
PartialDecision
n/aAssessed Apr 12, 2024 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (23 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 2.20% (0.02195) | 81.83th | v5 (v2026.06.15) |
| Jun 15, 2026 | 1.43% (0.01429) | 69.44th | v5 (v2026.06.15) |
| Nov 21, 2025 | 0.61% (0.00614) | 69.06th | v4 (v2025.03.14) |
| Nov 18, 2025 | 7.52% (0.07519) | 90.89th | v4 (v2025.03.14) |
| Mar 30, 2025 | 0.41% (0.00414) | 58.67th | v4 (v2025.03.14) |
| Mar 29, 2025 | 2.26% (0.02260) | 74.33th | v4 (v2025.03.14) |
| Mar 17, 2025 | 0.40% (0.00403) | 58.75th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.19% (0.00186) | 57.22th | v3 (v2023.03.01) |
| Mar 3, 2024 | 0.19% (0.00191) | 55.72th | v3 (v2023.03.01) |
| Dec 27, 2023 | 0.16% (0.00161) | 52.61th | v3 (v2023.03.01) |
| Nov 8, 2023 | 0.14% (0.00145) | 50.17th | v3 (v2023.03.01) |
| Oct 24, 2023 | 0.96% (0.00956) | 81.52th | v3 (v2023.03.01) |
| Sep 28, 2023 | 0.80% (0.00805) | 79.68th | v3 (v2023.03.01) |
| Jul 18, 2023 | 0.21% (0.00206) | 57.66th | v3 (v2023.03.01) |
| May 16, 2023 | 0.10% (0.00102) | 40.63th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.11% (0.00110) | 42.45th | v3 (v2023.03.01) |
| Mar 6, 2023 | 2.60% (0.02596) | 82.09th | v2 (v2022.01.01) |
| Oct 31, 2022 | 2.60% (0.02596) | 81.53th | v2 (v2022.01.01) |
| Oct 1, 2022 | 1.77% (0.01769) | 75.79th | v2 (v2022.01.01) |
| Sep 25, 2022 | 1.63% (0.01626) | 75.06th | v2 (v2022.01.01) |
| Sep 24, 2022 | 0.95% (0.00954) | 34.81th | v2 (v2022.01.01) |
| Sep 23, 2022 | 0.89% (0.00890) | 28.79th | v2 (v2022.01.01) |
| Sep 22, 2022 | 0.89% (0.00885) | 26.37th | v2 (v2022.01.01) |
References (13)
- http://www.openwall.com/lists/oss-security/2022/09/21/3 mailing-listMailing ListPatchThird Party Advisory
- https://access.redhat.com/security/cve/CVE-2022-2795 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2128584 Issue Tracking
- https://kb.isc.org/docs/cve-2022-2795 PatchVendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/10/msg00007.html mailing-listMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/ vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/ vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/ vendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-2795
- https://security.gentoo.org/glsa/202210-25 vendor-advisoryThird Party Advisory
- https://security.netapp.com/advisory/ntap-20241129-0002/
- https://www.cve.org/CVERecord?id=CVE-2022-2795
- https://www.debian.org/security/2022/dsa-5235 vendor-advisoryThird Party Advisory
Change history (0)
No recorded changes yet.