ISC

Exploited now

CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.

• 7.5HighOct 8, 2026ISC BINDCVE-2015-5477ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.Added to KEV Oct 8, 2026Exploited99% likelyExploit codeExploit-DB · MetasploitDetection

Recent

• 7.5HighOct 21, 2026ISC BIND 9 Denial of serviceCVE-2026-97313A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.
• 7.5HighOct 21, 2026ISC BIND 9 Memory corruptionCVE-2026-96888A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
• 8.1HighOct 21, 2026ISC BIND 9 Memory corruptionCVE-2026-94300Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially
• 7.5HighOct 21, 2026ISC BIND 9CVE-2026-19630In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
• 7.5HighOct 8, 2026ISC BINDCVE-2015-5477ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.Exploited99% likelyExploit codeExploit-DB · MetasploitDetection
• 5.3MediumSep 16, 2026ISC BIND 9CVE-2026-75029In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other memory attack vectors. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20
• 5.3MediumSep 16, 2026ISC BIND 9CVE-2026-19668A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record. Default limits on "max-records-per-type" and "max-types-per-name" help mitigate the exposure. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
• 6.5MediumSep 16, 2026ISC BIND 9CVE-2026-19033For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as describ
• 5.8MediumSep 16, 2026ISC BIND 9CVE-2026-78301A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose authoritative status and return an out-of-zone delegation. On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker-supplied data, affecting names outside the configured zone. This situation persist
• 7.5HighJun 21, 2023Isc bind Memory corruptionCVE-2023-2911If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable yes;` and `stale-answer-client-timeout 0;`, a sequence of serve-stale-related lookups could cause `named` to loop and terminate unexpectedly due to a stack overflow. This issue affects BIND 9 versions 9.16.33 through 9.16.41, 9.18.7 through 9.18.15, 9.16.33-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.2.5% likely
• 7.5HighJun 21, 2023Isc bindCVE-2023-2829A `named` instance configured to run as a DNSSEC-validating recursive resolver with the Aggressive Use of DNSSEC-Validated Cache (RFC 8198) option (`synth-from-dnssec`) enabled can be remotely terminated using a zone with a malformed NSEC record. This issue affects BIND 9 versions 9.16.8-S1 through 9.16.41-S1 and 9.18.11-S1 through 9.18.15-S1.
• 7.5HighJun 21, 2023Isc bind Denial of serviceCVE-2023-2828Every `named` instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to authoritative servers. The size limit for that cache database can be configured using the `max-cache-size` statement in the configuration file; it defaults to 90% of the total amount of memory available on the host. When the size of the cache reaches 7/8 of the configured limit, a cache-cleaning algorithm starts to remove expired and/or least-re3.7% likely
• 5.0MediumApr 27, 2006Isc bind Denial of serviceCVE-2006-2073Unspecified vulnerability in ISC BIND allows remote attackers to cause a denial of service via a crafted DNS message with a "broken" TSIG, as demonstrated by the OUSPG PROTOS DNS test suite.8.1% likely

See every ISC entry on the dashboard.

Top products

• BIND 98 CVEs in the last year
• BIND1 CVE in the last year, 1 exploited

Advisories

Official advisories from the last 90 days that name this vendor's CVEs.

• CCCS (Canada) · Oct 21, 2026ISC BIND security advisory (AV26-1072)CVE-2026-19630CVE-2026-94300CVE-2026-96888CVE-2026-97313