{"id":"CVE-2022-2906","aliases":["ALPINE-CVE-2022-2906","BELL-CVE-2022-2906","DEBIAN-CVE-2022-2906","EUVD-2022-35134","GHSA-pqxc-54m5-8r8m","OESA-2022-1981","OESA-2022-1982","OESA-2022-1983","UBUNTU-CVE-2022-2906","USN-5626-1","openSUSE-SU-2024:12356-1"],"status":"published","title":"Memory leaks in code handling Diffie-Hellman key exchange via TKEY RRs (OpenSSL 3.0.0+ only)","description":"An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.02048,"percentile":0.8135,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-401"],"published":"2022-09-21T00:00:00Z","modified":"2026-11-03T08:03:51Z","fixes":[{"ecosystem":"Alpine:v3.13","package":"bind","fixed_in":["9.16.33-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"bind","fixed_in":["9.16.33-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"bind","fixed_in":["9.16.33-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"bind","fixed_in":["9.16.33-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"bind","fixed_in":["9.18.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"bind","fixed_in":["9.18.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"bind","fixed_in":["9.18.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"bind","fixed_in":["9.18.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"bind","fixed_in":["9.18.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"bind","fixed_in":["9.18.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"bind","fixed_in":["9.18.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"bind","fixed_in":["9.18.7-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"bind9","fixed_in":["1:9.18.7-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"bind9","fixed_in":["1:9.18.7-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"bind9","fixed_in":["1:9.18.7-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"bind9","fixed_in":["1:9.18.1-1ubuntu1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.13","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.18.0"},{"fixed":"9.16.33-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.18.0"},{"fixed":"9.16.33-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.18.0"},{"fixed":"9.16.33-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.18.0"},{"fixed":"9.16.33-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.18.0"},{"fixed":"9.18.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.18.0"},{"fixed":"9.18.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.18.0"},{"fixed":"9.18.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.18.0"},{"fixed":"9.18.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.18.0"},{"fixed":"9.18.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.18.0"},{"fixed":"9.18.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.18.0"},{"fixed":"9.18.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.18.0"},{"fixed":"9.18.7-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.18.7-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.18.7-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.18.7-1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.11.21-15.oe1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.11.21-14.oe1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.16.23-11.oe2203"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.18.1-1ubuntu1.2"}]}],"versions":["1:9.16.15-1ubuntu1","1:9.16.15-1ubuntu2","1:9.16.15-1ubuntu3","1:9.18.0-2ubuntu1","1:9.18.0-2ubuntu2","1:9.18.0-2ubuntu3","1:9.18.1-1ubuntu1","1:9.18.1-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.11.3+dfsg-1ubuntu1.18"}]}],"versions":["1:9.10.3.dfsg.P4-12.6ubuntu1","1:9.11.2.P1-1ubuntu2","1:9.11.2.P1-1ubuntu3","1:9.11.2.P1-1ubuntu4","1:9.11.2.P1-1ubuntu5","1:9.11.3+dfsg-1ubuntu1","1:9.11.3+dfsg-1ubuntu1.1","1:9.11.3+dfsg-1ubuntu1.2","1:9.11.3+dfsg-1ubuntu1.3","1:9.11.3+dfsg-1ubuntu1.5","1:9.11.3+dfsg-1ubuntu1.7","1:9.11.3+dfsg-1ubuntu1.8","1:9.11.3+dfsg-1ubuntu1.9","1:9.11.3+dfsg-1ubuntu1.10","1:9.11.3+dfsg-1ubuntu1.11","1:9.11.3+dfsg-1ubuntu1.12","1:9.11.3+dfsg-1ubuntu1.13","1:9.11.3+dfsg-1ubuntu1.14","1:9.11.3+dfsg-1ubuntu1.15","1:9.11.3+dfsg-1ubuntu1.16","1:9.11.3+dfsg-1ubuntu1.17"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.16.1-0ubuntu2.11"}]}],"versions":["1:9.11.5.P4+dfsg-5.1ubuntu2","1:9.11.5.P4+dfsg-5.1ubuntu3","1:9.11.5.P4+dfsg-5.1ubuntu4","1:9.11.5.P4+dfsg-5.1ubuntu5","1:9.11.14+dfsg-1ubuntu1","1:9.11.14+dfsg-3ubuntu1","1:9.16.0-1ubuntu3","1:9.16.0-1ubuntu4","1:9.16.0-1ubuntu5","1:9.16.1-0ubuntu1","1:9.16.1-0ubuntu2","1:9.16.1-0ubuntu2.1","1:9.16.1-0ubuntu2.2","1:9.16.1-0ubuntu2.3","1:9.16.1-0ubuntu2.4","1:9.16.1-0ubuntu2.6","1:9.16.1-0ubuntu2.7","1:9.16.1-0ubuntu2.8","1:9.16.1-0ubuntu2.9","1:9.16.1-0ubuntu2.10"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.18.1-1ubuntu1.2"}]}],"versions":["1:9.16.15-1ubuntu1","1:9.16.15-1ubuntu2","1:9.16.15-1ubuntu3","1:9.18.0-2ubuntu1","1:9.18.0-2ubuntu2","1:9.18.0-2ubuntu3","1:9.18.1-1ubuntu1","1:9.18.1-1ubuntu1.1"],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.18.7-1.1"}]}],"bundled":5}],"products":[{"vendor":"isc","product":"bind"},{"vendor":"isc","product":"bind9"}],"references":[{"url":"https://kb.isc.org/docs/cve-2022-2906","tags":["x_transferred","Patch","Vendor Advisory","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2022/09/21/3","tags":["mailing-list","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"https://security.gentoo.org/glsa/202210-25","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2906","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pqxc-54m5-8r8m"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-2906","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-2906","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-2906","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1981","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38177","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38178","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2795","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2881","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1982","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1983","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3080","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-2906","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5626-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2906","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-2795","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-2881","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-3080","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-38177","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-38178","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-38178","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-2906","title":"Memory leaks in code handling Diffie-Hellman key exchange via TKEY RRs (OpenSSL 3.0.0+ only)","description":"An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.","status":"published","published":"2022-09-21T10:15:27.446Z","modified":"2025-05-28T15:25:56.879Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:34:32.495407Z"}],"euvd":[{"id":"EUVD-2022-35134","description":"An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.","status":"published","published":"2022-09-21T10:15:27Z","modified":"2025-05-28T15:25:56Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:37.456975Z"}],"ghsa":[{"id":"GHSA-pqxc-54m5-8r8m","title":"An attacker can leverage this flaw to gradually erode available memory to the point where named...","description":"An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.","status":"published","published":"2022-09-22T00:00:32Z","modified":"2023-01-30T05:02:54Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:46:44.129156Z"}],"nvd":[{"id":"CVE-2022-2906","description":"An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.","status":"published","published":"2022-09-21T11:15:09.62Z","modified":"2026-06-17T04:42:48.44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:07:28.501364Z"}],"osv":[{"id":"ALPINE-CVE-2022-2906","description":"An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.","status":"published","published":"2022-09-21T11:15:09.62Z","modified":"2026-11-03T07:18:33.152911523Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:51:12.284675Z"},{"id":"BELL-CVE-2022-2906","title":"CVE-2022-2906 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:30.404665Z","modified":"2026-01-26T09:46:04.250983Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"CVE-2022-2906","description":"An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.","status":"published","published":"2022-09-21T11:15:09.62Z","modified":"2026-10-24T10:30:40.967501592Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:25.164673Z"},{"id":"DEBIAN-CVE-2022-2906","description":"An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.","status":"published","published":"2022-09-21T11:15:09.62Z","modified":"2026-11-03T08:03:51.990280161Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T08:23:57.167851Z"},{"id":"OESA-2022-1981","title":"bind security update","description":"BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly.\r\n\r\n\r\n\r\nSecurity Fix(es):\r\n\r\nBy spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.(CVE-2022-38177)\r\n\r\nBy spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.(CVE-2022-38178)\r\n\r\nBy flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver\u0026apos;s performance, effectively denying legitimate clients access to the DNS resolution service.(CVE-2022-2795)\r\n\r\nThe underlying bug might cause read past end of the buffer and either read memory it should not read, or crash the process.(CVE-2022-2881)\r\n\r\nAn attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.(CVE-2022-2906)","status":"published","published":"2022-10-14T11:05:17Z","modified":"2026-08-18T01:17:19.996044379Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"OESA-2022-1982","title":"bind security update","description":"BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly.\r\n\r\n\r\n\r\nSecurity Fix(es):\r\n\r\nBy spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.(CVE-2022-38177)\r\n\r\nBy spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.(CVE-2022-38178)\r\n\r\nBy flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver\u0026apos;s performance, effectively denying legitimate clients access to the DNS resolution service.(CVE-2022-2795)\r\n\r\nThe underlying bug might cause read past end of the buffer and either read memory it should not read, or crash the process.(CVE-2022-2881)\r\n\r\nAn attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.(CVE-2022-2906)","status":"published","published":"2022-10-14T11:05:17Z","modified":"2026-08-18T01:17:19.869655062Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"OESA-2022-1983","title":"bind security update","description":"BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly.\r\n\r\nSecurity Fix(es):\r\n\r\nBy sending specific queries to the resolver, an attacker can cause named to crash.(CVE-2022-3080)\r\n\r\nBy spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.(CVE-2022-38177)\r\n\r\nBy spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.(CVE-2022-38178)\r\n\r\nBy flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver\u0026apos;s performance, effectively denying legitimate clients access to the DNS resolution service.(CVE-2022-2795)\r\n\r\nThe underlying bug might cause read past end of the buffer and either read memory it should not read, or crash the process.(CVE-2022-2881)\r\n\r\nAn attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.(CVE-2022-2906)","status":"published","published":"2022-10-14T11:05:17Z","modified":"2026-08-18T01:17:19.978004175Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2022-2906","description":"An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.","status":"published","published":"2022-09-21T00:00:00Z","modified":"2026-04-22T13:21:39.09027Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:53.899276Z"},{"id":"openSUSE-SU-2024:12356-1","title":"bind-9.18.7-1.1 on GA media","description":"These are all security issues fixed in the bind-9.18.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:17:23.790612Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"USN-5626-1","title":"bind9 vulnerabilities","description":"Yehuda Afek, Anat Bremler-Barr, and Shani Stajnrod discovered that Bind\nincorrectly handled large delegations. A remote attacker could possibly use\nthis issue to reduce performance, leading to a denial of service.\n(CVE-2022-2795)\n\nIt was discovered that Bind incorrectly handled statistics requests. A\nremote attacker could possibly use this issue to obtain sensitive memory\ncontents, or cause a denial of service. This issue only affected Ubuntu\n22.04 LTS. (CVE-2022-2881)\n\nIt was discovered that Bind incorrectly handled memory when processing\ncertain Diffie-Hellman key exchanges. A remote attacker could use this\nissue to consume resources, leading to a denial of service. This issue only\naffected Ubuntu 22.04 LTS. (CVE-2022-2906)\n\nMaksym Odinintsev discovered that Bind incorrectly handled answers from\ncache when configured with a zero stale-answer-timeout. A remote attacker\ncould possibly use this issue to cause Bind to crash, resulting in a denial\nof service. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-3080)\n\nIt was discovered that Bind incorrectly handled memory when processing\nECDSA DNSSEC verification. A remote attacker could use this issue to\nconsume resources, leading to a denial of service. This issue only affected\nUbuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-38177)\n\nIt was discovered that Bind incorrectly handled memory when processing\nEDDSA DNSSEC verification. A remote attacker could use this issue to\nconsume resources, leading to a denial of service. (CVE-2022-38178)\n","status":"published","published":"2022-09-21T11:39:24Z","modified":"2026-04-27T16:32:21.270572139Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}