CVE-2016-2088

resolver.c in named in ISC BIND 9.10.x before 9.10.3-P4, when DNS cookies are enabled, allows...

6.8 MediumFix available

resolver.c in named in ISC BIND 9.10.x before 9.10.3-P4, when DNS cookies are enabled, allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed packet with more than one cookie option.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

22.7%Up 19.6 points since Feb 4, 2022

What each source reports

NVD Score used 6.8

Record: CVE-2016-2088
CVSS 3.0: 6.8 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness: CWE-20
Updated: 2026-11-02

CVE List No score

Record: CVE-2016-2088
Updated: 2026-11-02

EUVDEUVD-2016-3193 No score

Record: EUVD-2016-3193
Updated: 2026-11-03

GitHub AdvisoriesGHSA-8f3h-84p6-655j 6.8

resolver.c in named in ISC BIND 9.10.x before 9.10.3-P4, when DNS cookies are enabled, allows...

Record: GHSA-8f3h-84p6-655j
CVSS 3.0: 6.8 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
Weakness: CWE-20
Updated: 2026-11-02

OSV 6.8

Record: CVE-2016-2088
CVSS 3.0: 6.8 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
Updated: 2026-11-02

OSVMGASA-2016-0107 No score

Updated bind packages fix security vulnerability

In ISC BIND before 9.10.3-P4, an error parsing input received by the rndc control channel can cause an assertion failure in sexpr.c or alist.c (CVE-2016-1285).

In ISC BIND before 9.10.3-P4, a problem parsing resource record signatures for DNAME resource records can lead to an assertion failure in resolver.c or db.c (CVE-2016-1286).

In ISC BIND before 9.10.3-P4, A response containing multiple DNS cookies causes servers with cookie support enabled to exit with an assertion failure in resolver.c (CVE-2016-2088).

Record: MGASA-2016-0107
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10467-1 No score

bind-9.10.3P4-21.1 on GA media

These are all security issues fixed in the bind-9.10.3P4-21.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10467-1
Updated: 2026-11-02

Affected products

isc bind

Affected packages

Affected packages
Package	Affected	Fixed
`bind` Mageia:5	before 9.10.3.P4-1.mga5	9.10.3.P4-1.mga5
`bind` openSUSE:Tumbleweed	before 9.10.3P4-21.1	9.10.3P4-21.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-2088 is a medium vulnerability (CVSS 6.8) in Isc Bind, published March 9, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 22.7%, the 97th percentile. Fixed in bind 9.10.3.P4-1.mga5.

References

Show 46 moreShow less