CVE-2022-3080 — BIND 9 resolvers configured to answer from stale cache with zero stale-answer-client-timeout may terminate unexpectedly

Back Back to CVE browser

HIGH

BIND 9 resolvers configured to answer from stale cache with zero stale-answer-client-timeout may terminate unexpectedly

Published Sep 21, 2022

7.5

HIGH

CVSS 3.1

EPSS 1.94%

Description

By sending specific queries to the resolver, an attacker can cause named to crash.

Affected products

Vendor ISC Product BIND9 Default
n/a
- Version
  Development Branch 9.19 9.19.0 through versions before 9.19.5
  Status
  affected
  Constraints
  -
- Version
  Open Source Branch 9.16 9.16.14 through versions before 9.16.33
  Status
  affected
  Constraints
  -
- Version
  Open Source Branch 9.18 9.18.0 through versions before 9.18.7
  Status
  affected
  Constraints
  -
- Version
  Supported Preview Branch 9.16-S 9.16.14-S1 through versions before 9.16.33-S1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

ISC

BIND9

n/a

Version	Status	Constraints
Development Branch 9.19 9.19.0 through versions before 9.19.5	affected	-
Open Source Branch 9.16 9.16.14 through versions before 9.16.33	affected	-
Open Source Branch 9.18 9.18.0 through versions before 9.18.7	affected	-
Supported Preview Branch 9.16-S 9.16.14-S1 through versions before 9.16.33-S1	affected	-

Vendor Fedora Project Product Fedora Default
n/a
- Version
  35
  Status
  affected
  Constraints
  -
- Version
  36
  Status
  affected
  Constraints
  -
- Version
  37
  Status
  affected
  Constraints
  -
Vendor Isc Product Bind Default
n/a
- Version
  9.16.14
  Status
  affected
  Constraints
  <9.16.33
- Version
  9.16.14
  Status
  affected
  Constraints
  -
- Version
  9.16.21
  Status
  affected
  Constraints
  -
- Version
  9.16.32
  Status
  affected
  Constraints
  -
- Version
  9.18.0
  Status
  affected
  Constraints
  <9.18.7
- Version
  9.19.0
  Status
  affected
  Constraints
  <9.19.5

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Fedora Project

Fedora

n/a

Version	Status	Constraints
35	affected	-
36	affected	-
37	affected	-

Isc

Bind

n/a

Version	Status	Constraints
9.16.14	affected	<9.16.33
9.16.14	affected	-
9.16.21	affected	-
9.16.32	affected	-
9.18.0	affected	<9.18.7
9.19.0	affected	<9.19.5

Red Hat Enterprise Linux 8

bind9.16-32:9.16.23-0.7.el8_6.1

Fixed · RHSA-2022:6781
Red Hat Enterprise Linux 9

bind-32:9.16.23-1.el9_0.1

Fixed · RHSA-2022:6763
Red Hat Enterprise Linux 6

bind

Not affected
Red Hat Enterprise Linux 7

bind

Not affected
Red Hat Enterprise Linux 8

bind

Not affected
Red Hat Enterprise Linux 9

dhcp

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 8	bind9.16-32:9.16.23-0.7.el8_6.1	Fixed	RHSA-2022:6781
Red Hat Enterprise Linux 9	bind-32:9.16.23-1.el9_0.1	Fixed	RHSA-2022:6763
Red Hat Enterprise Linux 6	bind	Not affected	n/a
Red Hat Enterprise Linux 7	bind	Not affected	n/a
Red Hat Enterprise Linux 8	bind	Not affected	n/a
Red Hat Enterprise Linux 9	dhcp	Not affected	n/a

Remediation

Vendor solution

Upgrade to the patched release most closely related to your current version of BIND: BIND 9.16.33, BIND 9.18.7, BIND 9.19.5, or for BIND Supported Preview Edition (a special feature preview branch of BIND provided to eligible ISC support customers): BIND 9.16.33-S1.

Red Hat statement

This issue affects versions 9.16.14 and higher of the Bind package. Therefore Red Hat Enterprise Linux 6 and 7 are not impacted.

Metrics

1.94% 0.01937

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.01937

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (20 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	1.94% (0.01937)	79.36th	v5 (v2026.06.15)
Jun 15, 2026	1.49% (0.01486)	70.57th	v5 (v2026.06.15)
Mar 17, 2025	0.09% (0.00090)	23.46th	v4 (v2025.03.14)
Dec 12, 2024	0.37% (0.00374)	73.60th	v3 (v2023.03.01)
Jun 22, 2024	0.37% (0.00374)	72.88th	v3 (v2023.03.01)
May 12, 2024	0.33% (0.00329)	70.80th	v3 (v2023.03.01)
Apr 28, 2024	0.28% (0.00281)	68.08th	v3 (v2023.03.01)
Apr 13, 2024	0.27% (0.00270)	67.43th	v3 (v2023.03.01)
Mar 3, 2024	0.28% (0.00277)	67.47th	v3 (v2023.03.01)
Dec 27, 2023	0.23% (0.00232)	61.31th	v3 (v2023.03.01)
Oct 24, 2023	0.21% (0.00206)	58.29th	v3 (v2023.03.01)
Sep 28, 2023	0.17% (0.00173)	54.07th	v3 (v2023.03.01)
Aug 22, 2023	0.13% (0.00133)	47.68th	v3 (v2023.03.01)
Mar 7, 2023	0.11% (0.00112)	42.82th	v3 (v2023.03.01)
Mar 6, 2023	1.77% (0.01769)	76.59th	v2 (v2022.01.01)
Oct 1, 2022	1.77% (0.01769)	75.79th	v2 (v2022.01.01)
Sep 25, 2022	1.63% (0.01626)	75.06th	v2 (v2022.01.01)
Sep 24, 2022	0.95% (0.00954)	34.81th	v2 (v2022.01.01)
Sep 23, 2022	0.89% (0.00890)	28.79th	v2 (v2022.01.01)
Sep 22, 2022	0.89% (0.00885)	26.37th	v2 (v2022.01.01)

Weaknesses (2)

CWE-20

Improper Input Validation

CWE-613

References (12)

http://www.openwall.com/lists/oss-security/2022/09/21/3
mailing-listMailing ListPatchThird Party Advisory
https://access.redhat.com/security/cve/CVE-2022-3080
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2128600
Issue Tracking
https://kb.isc.org/docs/cve-2022-3080
PatchVendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/
vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/
vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/
vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-3080
https://security.gentoo.org/glsa/202210-25
vendor-advisoryThird Party Advisory
https://security.netapp.com/advisory/ntap-20240621-0002/
https://www.cve.org/CVERecord?id=CVE-2022-3080
https://www.debian.org/security/2022/dsa-5235
vendor-advisoryThird Party Advisory

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2022/09/21/3		mailing-listMailing ListPatchThird Party Advisory
https://access.redhat.com/security/cve/CVE-2022-3080		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2128600		Issue Tracking
https://kb.isc.org/docs/cve-2022-3080		PatchVendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/		vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/		vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/		vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-3080
https://security.gentoo.org/glsa/202210-25		vendor-advisoryThird Party Advisory
https://security.netapp.com/advisory/ntap-20240621-0002/
https://www.cve.org/CVERecord?id=CVE-2022-3080
https://www.debian.org/security/2022/dsa-5235		vendor-advisoryThird Party Advisory