CVE-2022-2795
Processing large delegations may severely degrade resolver performance
- Published
- Updated
- Reserved
- Assigned by
- isc
Description
By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| iscCNA (assigner) | 3.1 | Medium5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| NVDNVD · Modified | 3.1 | Medium5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
- EPSS (exploitation in 30 days)
- 2.3% · top 17% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.
Weakness
- In BIND 9.0.0 -> 9.16.32, 9.18.0 -> 9.18.6, versions 9.9.3-S1 -> 9.11.37-S1, 9.16.8-S1 -> 9.16.32-S1 of the BIND Supported Preview Edition, and versions 9.19.0 -> 9.19.4 of the BIND 9.19 development branch, a flaw in resolver code can cause named to spend excessive amounts of time on processing large delegations.
Affected products
- affected Open Source Branches 9.0 through 9.16 9.0.0 through versions before 9.16.33
- affected Open Source Branch 9.18 9.18.0 through versions before 9.18.7
- affected Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions up to and including 9.11.37-S1
- affected Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1
- affected Development Branch 9.19 9.19.0 through versions before 9.19.5
What to do
Solution: Upgrade to the patched release most closely related to your current version of BIND: BIND 9.16.33, BIND 9.18.7, BIND 9.19.5, or for BIND Supported Preview Edition (a special feature preview branch of BIND provided to eligible ISC support customers): BIND 9.16.33-S1.
Workaround: No workarounds known.
Exploitation: We are not aware of any active exploits.
References (9)
- https://kb.isc.org/docs/cve-2022-2795 (opens in a new tab)x_transferred
- [oss-security] 20220921 ISC has disclosed six vulnerabilities in BIND (CVE-2022-2795, CVE-2022-2881, CVE-2022-2906, CVE-2022-3080, CVE-2022-38177, CVE-2022-38178) (opens in a new tab)mailing-listx_transferred
- DSA-5235 (opens in a new tab)vendor-advisoryx_transferred
- FEDORA-2022-ef038365de (opens in a new tab)vendor-advisoryx_transferred
- FEDORA-2022-8268735e06 (opens in a new tab)vendor-advisoryx_transferred
- FEDORA-2022-b197d64471 (opens in a new tab)vendor-advisoryx_transferred
- [debian-lts-announce] 20221005 [SECURITY] [DLA 3138-1] bind9 security update (opens in a new tab)mailing-listx_transferred
- GLSA-202210-25 (opens in a new tab)vendor-advisoryx_transferred
- https://security.netapp.com/advisory/ntap-20241129-0002/ (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-2795)Record last updated .