A stack exhaustion flaw in control channel code may cause named to terminate unexpectedly

Description

The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing code to run out of available stack memory, causing `named` to terminate unexpectedly. Since each incoming control channel message is fully parsed before its contents are authenticated, exploiting this flaw does not require the attacker to hold a valid RNDC key; only network access to the control channel's configured TCP port is necessary. This issue affects BIND 9 versions 9.2.0 through 9.16.43, 9.18.0 through 9.18.18, 9.19.0 through 9.19.16, 9.9.3-S1 through 9.16.43-S1, and 9.18.0-S1 through 9.18.18-S1.

Scores

EPSS (exploitation in 30 days)

2.9% · top 13% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• CWE-1325 Improperly Controlled Sequential Memory Allocation (opens in a new tab)All about CWE-1325 and its CVEs
• CWE-787 (opens in a new tab)All about CWE-787 and its CVEs

Affected products

• ISC · BIND 9

  • affected 9.2.0 – ≤ 9.16.43
  • affected 9.18.0 – ≤ 9.18.18
  • affected 9.19.0 – ≤ 9.19.16
  • affected 9.9.3-S1 – ≤ 9.16.43-S1
  • affected 9.18.0-S1 – ≤ 9.18.18-S1

What to do

Solution: Upgrade to the patched release most closely related to your current version of BIND 9: 9.16.44, 9.18.19, 9.19.17, 9.16.44-S1, or 9.18.19-S1.

Workaround: By default, `named` only allows control-channel connections over the loopback interface, making this attack impossible to carry out over the network. When enabling remote access to the control channel's configured TCP port, care should be taken to limit such access to trusted IP ranges on the network level, effectively preventing unauthorized parties from carrying out the attack described in this advisory.

Exploitation: We are not aware of any active exploits.

References (8)

• CVE-2023-3341 (opens in a new tab)vendor-advisoryx_transferred
• http://www.openwall.com/lists/oss-security/2023/09/20/2 (opens in a new tab)x_transferred
• https://www.debian.org/security/2023/dsa-5504 (opens in a new tab)x_transferred
• https://lists.fedoraproject.org/archives/list/[email protected]/message/IPJLLTJCSDJJII7IIZPLTBQNWP7MZH7F/ (opens in a new tab)x_transferred
• https://lists.fedoraproject.org/archives/list/[email protected]/message/U35OARLQCPMVCBBPHWBXY5M6XJLD2TZ5/ (opens in a new tab)x_transferred
• https://security.netapp.com/advisory/ntap-20231013-0003/ (opens in a new tab)x_transferred
• https://lists.fedoraproject.org/archives/list/[email protected]/message/VSK5V4W4OHPM3JTJGWAQD6CZW7SFD75B/ (opens in a new tab)x_transferred
• https://lists.debian.org/debian-lts-announce/2024/01/msg00021.html (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2023-3341](https://trackcve.app/badge/CVE-2023-3341.svg)](https://trackcve.app/cve/CVE-2023-3341)

Record last updated 2 Dec 2025, 20:15 UTC.