{"id":"CVE-2016-2088","aliases":["EUVD-2016-3193","GHSA-8f3h-84p6-655j","MGASA-2016-0107","openSUSE-SU-2024:10467-1"],"status":"published","title":"resolver.c in named in ISC BIND 9.10.x before 9.10.3-P4, when DNS cookies are enabled, allows...","description":"resolver.c in named in ISC BIND 9.10.x before 9.10.3-P4, when DNS cookies are enabled, allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed packet with more than one cookie option.","severity":{"version":"3.0","score":6.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.22715,"percentile":0.97738,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20"],"published":"2016-03-09T23:00:00Z","modified":"2026-10-24T10:30:29Z","affected":[{"source":"osv","ecosystem":"Mageia:5","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.10.3.P4-1.mga5"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.10.3P4-21.1"}]}],"bundled":37}],"products":[{"vendor":"isc","product":"bind"}],"references":[{"url":"http://www.securitytracker.com/id/1035238","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/84290","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201610-07","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181036.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://kb.isc.org/article/AA-01380","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://kb.isc.org/article/AA-01351","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178831.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179904.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2088"},{"url":"https://github.com/advisories/GHSA-8f3h-84p6-655j"},{"url":"https://advisories.mageia.org/MGASA-2016-0107.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17935","tags":["report"]},{"url":"https://kb.isc.org/article/AA-01352","tags":["web"]},{"url":"https://kb.isc.org/article/AA-01353","tags":["web"]},{"url":"https://kb.isc.org/article/AA-01363","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-4022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-0414","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2464","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0591","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8864","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-2088","description":"resolver.c in named in ISC BIND 9.10.x before 9.10.3-P4, when DNS cookies are enabled, allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed packet with more than one cookie option.","status":"published","published":"2016-03-09T23:00:00Z","modified":"2024-08-05T23:17:50.701Z","updated_at":"2026-11-02T14:33:33.07583Z"}],"euvd":[{"id":"EUVD-2016-3193","description":"resolver.c in named in ISC BIND 9.10.x before 9.10.3-P4, when DNS cookies are enabled, allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed packet with more than one cookie option.","status":"published","published":"2016-03-09T23:00:00Z","modified":"2024-08-05T23:17:50Z","updated_at":"2026-11-03T02:22:54.667958Z"}],"ghsa":[{"id":"GHSA-8f3h-84p6-655j","title":"resolver.c in named in ISC BIND 9.10.x before 9.10.3-P4, when DNS cookies are enabled, allows...","description":"resolver.c in named in ISC BIND 9.10.x before 9.10.3-P4, when DNS cookies are enabled, allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed packet with more than one cookie option.","status":"published","published":"2022-05-17T02:37:54Z","modified":"2023-01-27T05:04:59Z","cvss":[{"version":"3.0","score":6.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:42:35.607674Z"}],"nvd":[{"id":"CVE-2016-2088","description":"resolver.c in named in ISC BIND 9.10.x before 9.10.3-P4, when DNS cookies are enabled, allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed packet with more than one cookie option.","status":"published","published":"2016-03-09T23:59:04.493Z","modified":"2026-06-17T00:43:24.967Z","cvss":[{"version":"3.0","score":6.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:22.479119Z"}],"osv":[{"id":"CVE-2016-2088","description":"resolver.c in named in ISC BIND 9.10.x before 9.10.3-P4, when DNS cookies are enabled, allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed packet with more than one cookie option.","status":"published","published":"2016-03-09T23:59:04.493Z","modified":"2026-10-24T10:30:29.703589935Z","cvss":[{"version":"3.0","score":6.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"MGASA-2016-0107","title":"Updated bind packages fix security vulnerability","description":"In ISC BIND before 9.10.3-P4, an error parsing input received by the rndc\ncontrol channel can cause an assertion failure in sexpr.c or alist.c\n(CVE-2016-1285).\n\nIn ISC BIND before 9.10.3-P4, a problem parsing resource record signatures\nfor DNAME resource records can lead to an assertion failure in resolver.c\nor db.c (CVE-2016-1286).\n\nIn ISC BIND before 9.10.3-P4, A response containing multiple DNS cookies\ncauses servers with cookie support enabled to exit with an assertion\nfailure in resolver.c (CVE-2016-2088).\n","status":"published","published":"2016-03-10T23:37:43Z","modified":"2026-04-16T06:25:04.762216327Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10467-1","title":"bind-9.10.3P4-21.1 on GA media","description":"These are all security issues fixed in the bind-9.10.3P4-21.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:40:15.60024Z","updated_at":"2026-11-02T16:58:34.487567Z"}]}}