Read the docs
TI-2022-03599 Aliases CVE-2022-3924GHSA-29px-hvx8-j7xf

named configured to answer from stale cache may terminate unexpectedly at recursive-clients soft quota

Priority MEDIUM 55CWE-617Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-617.

Summary

This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value greater than zero. If the resolver receives many queries that require recursion, there will be a corresponding increase in the number of clients that are waiting for recursion to complete. If there are sufficient clients already waiting when a new client query is received so that it is necessary to SERVFAIL the longest waiting client (see BIND 9 ARM `recursive-clients` limit and soft quota), then it is possible for a race to occur between providing a stale answer to this older client and sending an early timeout SERVFAIL, which may cause an assertion failure. This issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.12-S1 through 9.16.36-S1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.15989 96th percentileScored 2026-11-07
Fix Fixed Red Hat: 2 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ISCBIND 99.16.12 – 9.16.36; 9.18.0 – 9.18.10; 9.19.0 – 9.19.8; 9.16.12-S1 – 9.16.36-S1—No fix listedCNA
  • BIND 9 VendorISC Affected 9.16.12 – 9.16.36; 9.18.0 – 9.18.10; 9.19.0 – 9.19.8; 9.16.12-S1 – 9.16.36-S1 Fixed in — No fix listed CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*9.16.12 to before 9.16.37; 9.18.0 to before 9.18.11; 9.19.0 to before 9.19.9VulnerableISC
cpe:2.3:a:isc:bind:9.16.12:s1:*:*:supported_preview:*:*:*9.16.12 s1VulnerableISC
cpe:2.3:a:isc:bind:9.16.13:s1:*:*:supported_preview:*:*:*9.16.13 s1VulnerableISC
cpe:2.3:a:isc:bind:9.16.14:s1:*:*:supported_preview:*:*:*9.16.14 s1VulnerableISC
cpe:2.3:a:isc:bind:9.16.21:s1:*:*:supported_preview:*:*:*9.16.21 s1VulnerableISC
cpe:2.3:a:isc:bind:9.16.32:s1:*:*:supported_preview:*:*:*9.16.32 s1VulnerableISC
cpe:2.3:a:isc:bind:9.16.36:s1:*:*:supported_preview:*:*:*9.16.36 s1VulnerableISC
  • cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:* Versions 9.16.12 to before 9.16.37; 9.18.0 to before 9.18.11; 9.19.0 to before 9.19.9 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.16.12:s1:*:*:supported_preview:*:*:* Versions 9.16.12 s1 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.16.13:s1:*:*:supported_preview:*:*:* Versions 9.16.13 s1 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.16.14:s1:*:*:supported_preview:*:*:* Versions 9.16.14 s1 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.16.21:s1:*:*:supported_preview:*:*:* Versions 9.16.21 s1 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.16.32:s1:*:*:supported_preview:*:*:* Versions 9.16.32 s1 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.16.36:s1:*:*:supported_preview:*:*:* Versions 9.16.36 s1 Vulnerable ·ISC

Remediation

Red Hat 2 advisories

  • RHSA-2023:2792 Released 2023-05-16 · Red Hat rating Moderate
    bind9.16 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) bind9.16-32:9.16.23-0.14.el8, bind9.16-chroot-32:9.16.23-0.14.el8, bind9.16-dnssec-utils-32:9.16.23-0.14.el8 +4
    • Red Hat Enterprise Linux CRB (v. 8) bind9.16-devel-32:9.16.23-0.14.el8, bind9.16-doc-32:9.16.23-0.14.el8, bind9.16-libs-32:9.16.23-0.14.el8
  • RHSA-2023:2261 Released 2023-05-09 · Red Hat rating Moderate
    bind security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) bind-32:9.16.23-11.el9, bind-chroot-32:9.16.23-11.el9, bind-dnssec-doc-32:9.16.23-11.el9 +5
    • Red Hat Enterprise Linux CRB (v. 9) bind-devel-32:9.16.23-11.el9, bind-doc-32:9.16.23-11.el9, bind-libs-32:9.16.23-11.el9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2023:2792
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:2261
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2023:2792
Red Hat Enterprise Linux CRB (v. 9)Fixed RHSA-2023:2261
Not affected: 4 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-3924
  2. 2026-10-03 Alias added: GHSA-29px-hvx8-j7xf

References

Advisory 1

  • TI-2015-04610 Assertion failure in ISC BIND named via TKEY queries KEVCVSS 3.1HIGH 7.5
  • TI-2023-27571 Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related… CVSS 3.1HIGH 7.5
  • TI-2021-07476 A second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack CVSS 3.1CRITICAL 9.8
  • TI-2023-27773 The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance… CVSS 3.1HIGH 7.5
  • TI-2020-06910 A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c CVSS 3.1HIGH 7.5
  • TI-2016-02320 buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x… CVSS 3.0HIGH 7.5
See all 192 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences