BIND 9 Software Vulnerability Matrix

Updated
  • Updated on Dec 1, 2025
  • Published on Aug 8, 2018
  • 11 minute(s) read
  • Darren Ankney
  • Greg Choules
  • Vicky Risk
 Prev Next

The BIND 9 Software Vulnerability Matrix (previously know as the "BIND 9 Security Vulnerability Matrix") is a tool to help DNS operators understand the current security risk for a given version of BIND. It has two parts:

  • The first part is a table listing all of the vulnerabilities covered by this page. The first column is a reference number for use in the tables in the second part. The second column is the CVE (Common Vulnerabilities and Exposure) number for the vulnerability, linked to its page on cve.mitre.org. The third column is a short description of the vulnerability, linked (where possible) to the article in this Knowledgebase on the vulnerability.
  • The second part is a table for each branch of BIND, listing all of the releases in that branch along the side and vulnerabilities along the top. If a vulnerability number is less than the lowest column heading, that branch does not have any versions with it. If a vulnerability number is greater than the highest column heading, that branch has not been tested and should be assumed to be vulnerable.

For example, if you use the top table to look up CVE-2024-0760 you will see that it cross references to #152. You can look for column #152 in the lower tables to see which versions are vulnerable. If you were still running BIND 9.18.27 you would know to upgrade.

We do not generally list alpha, beta or release candidate (RC) versions here and recommend that you use only released software in any environment in which security could be an issue. This page explains our version numbering system.

Vulnerability information for EOL (End of Life) versions of BIND 9 (9.0 through 9.16 and below) are included only for vulnerabilities discovered before - or in some cases shortly after - the EOL date. These versions are all known to be affected by some vulnerabilities discovered after their EOL date.

@(Warning)(Using obsolete versions of BIND)(We recommend that you not use obsolete versions of any ISC software; it was updated for a reason. Listings of vulnerabilities affecting obsolete versions of BIND have been split into articles grouped by branch: 9.0, 9.1, 9.2, 9.3, 9.4/9.4-ESV, 9.5, 9.6/9.6-ESV, 9.7, 9.8, 9.9, 9.9-S, 9.10, 9.10-S, 9.11, 9.11-S, 9.12, 9.13, 9.14, 9.15 and 9.16.)

Listing of Vulnerabilities affecting current branches of BIND

# CVE Number Short Description
163 2025-40780 Cache poisoning due to weak PRNG
162 2025-8677 Resource exhaustion via malformed DNSKEY handling
161 2025-40778 Cache poisoning attacks with unsolicited RRs
160 2025-40777 A possible assertion failure when using the 'stale-answer-client-timeout 0' option
159 2025-40776 Birthday Attack against Resolvers supporting ECS
158 2025-40775 DNS message with invalid TSIG causes an assertion failure
157 2024-12705 DNS-over-HTTPS implementation suffers from multiple issues under heavy query load
156 2024-11187 Many records in the additional section cause CPU exhaustion
155 2024-4076 Assertion failure when serving both stale cache data and authoritative zone content
154 2024-1975 SIG(0) can be used to exhaust CPU resources
153 2024-1737 BIND’s database will be slow if a very large number of RRs exist at the same name
152 2024-0760 A flood of DNS messages over TCP may make the server unstable
151 2023-50868 Preparing an NSEC3 closest encloser proof can exhaust CPU resources
150 2023-50387 KeyTrap - Extreme CPU consumption in DNSSEC validator
149 2023-6516 Specific recursive query patterns may lead to an out-of-memory condition
148 2023-5680 Cleaning an ECS-enabled cache may cause excessive CPU load
147 2023-5679 Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution
146 2023-5517 Querying RFC 1918 reverse zones may cause an assertion failure when "nxdomain-redirect" is enabled
145 2023-4408 Parsing large DNS messages may cause excessive CPU load
144 2023-4236 named may terminate unexpectedly under high DNS-over-TLS query load
143 2023-3341 A stack exhaustion flaw in control channel code may cause named to terminate unexpectedly
142 2023-2911 Exceeding the recursive-clients quota may cause named to terminate unexpectedly when stale-answer-client-timeout is set to 0
141 2023-2829 Malformed NSEC records can cause named to terminate unexpectedly when synth-from-dnssec is enabled
140 2023-2828 named's configured cache size limit can be significantly exceeded
139 2022-3924 named configured to answer from stale cache may terminate unexpectedly at recursive-clients soft quota
138 2022-3736 named configured to answer from stale cache may terminate unexpectedly while processing RRSIG queries
137 2022-3488 BIND Supported Preview Edition named may terminate unexpectedly when processing ECS options in repeated responses to iterative queries
136 2022-3094 An UPDATE message flood may cause named to exhaust all available memory
135 2022-38178 Memory leaks in EdDSA DNSSEC verification code
134 2022-38177 Memory leak in ECDSA DNSSEC verification code
133 2022-3080 BIND 9 resolvers configured to answer from stale cache with zero stale-answer-timeout may terminate unexpectedly
132 2022-2906 Memory leaks in code handling Diffie-Hellman key exchange via TKEY RRs (OpenSSL 3.0.0+ only)
131 2022-2881 Buffer overread in statistics channel code
130 2022-2795 Processing large delegations may severely degrade resolver performance
129 2022-1183 Destroying TLS session early triggers assertion failure
128 2022-0667 Assertion failure on delayed DS lookup
127 2022-0635 DNAME insist with synth-from-dnssec enabled
126 2022-0396 DoS from specifically crafted TCP packets
125 2021-25220 DNS forwarders - cache poisoning vulnerability

@(Info)(Why don't the reference numbers begin at 1?)(Our reference numbering started with BIND 8. We have since separated the information for BIND 8 and also obsolete branches of BIND 9. To reduce the possibility of confusion when referring to the individual pages we have chosen to maintain uniform numbering across all of them matching the historic numbering, including gaps where some reports affected only BIND 8. As major branches of BIND have reached EOL (End of Life), the lowest numbered vulnerability affecting our current versions has increased. Issues only affecting obsolete branches of BIND have been moved to a separate section later in this KB.)

Why are some versions of BIND crossed out?

This BIND Security Vulnerability Matrix includes some versions of BIND that were built and then withdrawn due to regressions discovered late in the release process or, in some instances, subsequent to public release.

BIND 9.20

BIND 9.20 is the newer stable branch of BIND.

ver/CVE 152 153 154 155 156 157 158 159 160 161 162 163
9.20.16
9.20.15
9.20.14
9.20.13 + + +
9.20.12 + + +
9.20.11 + + +
9.20.10 + + + +
9.20.9 + + + +
9.20.8 + + + + +
9.20.7 + + + + +
9.20.6 + + + + +
9.20.5 + + + + +
9.20.4 + + + + + + +
9.20.3 + + + + + + +
9.20.2 + + + + + + +
9.20.1 + + + + + + +
9.20.0 + + + + + + +

BIND 9.20 Supported Preview edition

If you'd like more information on our product support or about our BIND Subscription version, please visit https://www.isc.org/bind.

ver/CVE 152 153 154 155 156 157 158 159 160 161 162 163
9.20.16-S1
9.20.15-S1
9.20.14-S1
9.20.13-S1 + + +
9.20.12-S1 + + +
9.20.11-S1 + + +
9.20.10-S1 + + + + +

BIND 9.18

BIND 9.18 is the older stable branch of BIND.

ver/CVE 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163
9.18.42
9.18.41
9.18.40
9.18.39 + + +
9.18.38 + + +
9.18.37 + + +
9.18.36 + + +
9.18.35 + + +
9.18.34 + + +
9.18.33 + + +
9.18.32 + + + + +
9.18.31 + + + + +
9.18.30 + + + + +
9.18.29 + + + + +
9.18.28 + + + + +
9.18.27 + + + + + + + + +
9.18.26 + + + + + + + + +
9.18.25 + + + + + + + + +
9.18.24 + + + + + + + + +
9.18.23. + + + + + + + + +
9.18.22. + + + + + + + + + + +
9.18.21 + + + + + + + + + + + + + +
9.18.20 + + + + + + + + + + + + + +
9.18.19 + + + + + + + + + + + + + +
9.18.18 + + + + + + + + + + + + + + + +
9.18.17 + + + + + + + + + + + + + + + +
9.18.16 + + + + + + + + + + + + + + + +
9.18.15 + + + + + + + + + + + + + + + + + +
9.18.14 + + + + + + + + + + + + + + + + + +
9.18.13 + + + + + + + + + + + + + + + + + +
9.18.12 + + + + + + + + + + + + + + + + + +
9.18.11 + + + + + + + + + + + + + + + + + +
9.18.10 + + + + + + + + + + + + + + + + + + + + +
9.18.9 + + + + + + + + + + + + + + + + + + + + +
9.18.8 + + + + + + + + + + + + + + + + + + + + +
9.18.7 + + + + + + + + + + + + + + + + + + + + +
9.18.6 + + + + + + + + + + + + + + + + + + + + + + + + +
9.18.5 + + + + + + + + + + + + + + + + + + + + + + + + +
9.18.4 + + + + + + + + + + + + + + + + + + + + + + + + +
9.18.3 + + + + + + + + + + + + + + + + + + + + + + + + +
9.18.2 + + + + + + + + + + + + + + + + + + + + + + + + + +
9.18.1 + + + + + + + + + + + + + + + + + + + + + + + + + +
9.18.0 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

BIND 9.18 Supported Preview edition

If you'd like more information on our product support or about our BIND Subscription version, please visit https://www.isc.org/bind.

ver/CVE 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163
9.18.42-S1
9.18.41-S1
9.18.40-S1
9.18.39-S1 + + +
9.18.38-S1 + + +
9.18.37-S1 + + + +
9.18.36-S1 + + + +
9.18.35-S1 + + + +
9.18.34-S1 + + + +
9.18.33-S1 + + + +
9.18.32-S1 + + + + + +
9.18.31-S1 + + + + + +
9.18.30-S1 + + + + + +
9.18.29-S1 + + + + + +
9.18.28-S1 + + + + + +
9.18.27-S1 + + + + + + + + + +
9.18.26-S1 + + + + + + + + + +
9.18.25-S1 + + + + + + + + + +
9.18.24-S1 + + + + + + + + + +
9.18.23-S2 + + + + + + + + + +
9.18.23-S1 + + + + + + + + + +
9.18.22-S1 + + + + + + + + + + + +
9.18.21-S1 + + + + + + + + + + + + + + + +
9.18.20-S1 + + + + + + + + + + + + + + + +
9.18.19-S1 + + + + + + + + + + + + + + + +
9.18.18-S1 + + + + + + + + + + + + + + + + + +
9.18.17-S1 + + + + + + + + + + + + + + + + + +
9.18.16-S1 + + + + + + + + + + + + + + + + + +
9.18.15-S1 + + + + + + + + + + + + + + + + + + + + +
9.18.14-S1 + + + + + + + + + + + + + + + + + + + + +
9.18.13-S1 + + + + + + + + + + + + + + + + + + + + +
9.18.12-S1 + + + + + + + + + + + + + + + + + + + + +
9.18.11-S1 + + + + + + + + + + + + + + + + + + + + +
Related articles