Loading story…
CVE-2024-4076 is a denial-of-service vulnerability in BIND 9 in which a client query can trigger an assertion failure when the server simultaneously serves stale cached data and performs a lookup against local authoritative zone content. The resulting crash can terminate DNS service; Red Hat rates the issue as Important with a CVSS v3.1 score of 7.5, citing network exploitability, no required privileges or user interaction, and high availability impact.
Affected upstream versions are BIND 9.16.13–9.16.50, 9.18.0–9.18.27, and 9.19.0–9.19.24. Red Hat issued security errata for affected Red Hat Enterprise Linux 8 and 9 package streams and OpenShift Container Platform 4.13–4.16, and reports no qualifying standalone mitigation; organizations should apply the relevant updated BIND packages. The flaw is an instance of CWE-617: Reachable Assertion, where attacker-controlled input reaches an assertion condition and causes an availability-impacting process termination.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:5390 to fix CVE-2024-4076 in the RHEL 8 bind9.16 package stream.
Red Hat released RHSA-2024:5907 to address CVE-2024-4076 for RHEL 9.0 Update Services for SAP Solutions systems using bind and bind-dyndb-ldap.
Red Hat released RHSA-2024:5813 to fix CVE-2024-4076 in the RHEL 9.2 Extended Update Support bind package stream.
Red Hat released RHSA-2024:5525 to address CVE-2024-4076 for RHEL 8.8 Extended Update Support systems using bind9.16.
Red Hat released RHSA-2024:5418 for RHEL 8.6 Advanced Mission Critical Update Support, Telecommunications Update Service, and Update Services for SAP Solutions. It also released RHSA-2024:5231 for RHEL 9 bind and bind-dyndb-ldap packages.
CVE-2024-4076 was documented as a reachable-assertion flaw in BIND 9: queries that simultaneously serve stale cache data and perform local authoritative lookups can crash the DNS server. Affected upstream versions include 9.16.13–9.16.50, 9.18.0–9.18.27, and 9.19.0–9.19.24.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**ISC disclosed a high-severity denial-of-service vulnerability in BIND 9** tracked as **CVE-2025-13878**, where remote attackers can crash the `named` daemon by sending specially crafted DNS traffic that triggers improper handling of malformed **BRID** and **HHIT** record data structures. The issue is remotely exploitable (no authentication or user interaction required) and is scored **CVSS 3.1: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)**, making publicly exposed DNS infrastructure a primary risk. The flaw affects both **authoritative name servers and DNS resolvers**, enabling an attacker to force a service outage by causing `named` to terminate unexpectedly. Reported affected versions include **BIND 9.18.40–9.18.43**, **9.20.13–9.20.17**, and **9.21.12–9.21.16**, with fixes available in **9.18.44**, **9.20.18**, and **9.21.17** (and corresponding *SPE* preview builds). The vulnerability was reported by **Vlatko Kosturjak (Marlink Cyber)**, and ISC issued early notification ahead of public disclosure, urging administrators to verify deployed versions and apply patched releases to prevent remote crash/DoS conditions.
Jun 29, 2026
ISC disclosed **CVE-2026-3593**, a heap use-after-free flaw in BIND 9's DNS-over-HTTPS implementation that can be triggered remotely without authentication by flooding a DoH endpoint with crafted HTTP/2 `SETTINGS` frames while a response is being written. The bug occurs in `server_read_callback`, where data is read from `socket->h2->wbuf` after the associated `ns_client_t` memory has already been freed through `http_writecb` and `isc_nmhandle_detach`, creating a race condition in affected DoH deployments. Successful exploitation can crash the `named` process and cause denial of service, and ISC's issue report says freed heap data may also be copied into HTTP/2 response data and returned to the attacker over TLS, creating an information disclosure risk. The vulnerability affects BIND 9 **9.20.0 through 9.20.22**, **9.21.0 through 9.21.21**, and Supported Preview Edition **9.20.9 S1 through 9.20.22 S1** when DoH is enabled; non-DoH configurations are not affected. Fixes are available in **9.20.23**, **9.21.22**, and **9.20.23 S1**, and the issue is tracked as **CWE-416** with a **CVSS 7.4** score after an earlier code-execution claim was withdrawn.
Jul 10, 2026
ISC disclosed **`CVE-2026-5947`**, a remotely exploitable use-after-free flaw in the BIND 9 recursive resolver that can crash the `named` process during **SIG(0)** signature validation. The bug stems from a race condition between asynchronous signature verification and recursive query cancellation when the `recursive-clients` quota is exhausted, allowing a `resquery_t` object to be freed while callback code still dereferences it. ISC rated the issue **CVSS 7.5** and said the demonstrated impact is denial of service, while arbitrary code execution is considered unlikely. The vulnerability affects BIND **9.20.0 through 9.20.22**, **9.21.0 through 9.21.21**, and **9.20.9-S1 through 9.20.22-S1**; the **9.18.x ESV** branch is not affected because it does not use the asynchronous SIG(0) verification path. According to ISC, no authentication is required, and exploitation is possible if an attacker controls an authoritative server or forwarder that returns SIG(0)-signed responses under query-flood conditions. Fixes were released in **9.20.23**, **9.21.22**, and **9.20.23-S1**, replacing the raw pointer handling with reference-counted attachment and corresponding detach logic.
Jul 10, 2026