Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2018-5744

A specially crafted packet can cause named to leak memory

High7.5EPSS 3.4%
Published
Updated
Reserved
Assigned by
isc

Description

A failure to free memory can occur when processing messages having a specific combination of EDNS options. Versions affected are: BIND 9.10.7 -> 9.10.8-P1, 9.11.3 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions 9.10.7-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected.

Scores

CVSS scores of CVE-2018-5744, by who scored it
Scored byCVSSScoreVector
iscCNA (assigner)3.0High7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVDNVD · Modified3.1High7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (exploitation in 30 days)
3.4% · top 11% of all CVEs (4 Nov 2026)
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

  • By exploiting this condition, an attacker can potentially cause named's memory use to grow without bounds until all memory available to the process is exhausted. Typically a server process is limited as to the amount of memory it can use but if the named process is not limited by the operating system all free memory on the server could be exhausted.
  • CWE-772 (opens in a new tab)All about CWE-772 and its CVEs

Affected products

  • ISC · BIND 9

    • affected BIND 9.10.7 -> 9.10.8-P1, 9.11.3 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions 9.10.7-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected.

What to do

Solution: Upgrade to a version of BIND containing a fix for the memory leak. >= BIND 9.11.5-P4 >= BIND 9.12.3-P4

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2018-5744 badge
[![CVE-2018-5744](https://trackcve.app/badge/CVE-2018-5744.svg)](https://trackcve.app/cve/CVE-2018-5744)

Record last updated .