| Package | Affected versions | Patched versions |
|---|---|---|
| bind | ≥ 9.16.8, ≤ 9.16.41≥ 9.18.11, ≤ 9.18.15 |
A `named` instance configured to run as a DNSSEC-validating recursive resolver with the Aggressive Use of DNSSEC-Validated Cache (RFC 8198) option (`synth-from-dnssec`) enabled can be remotely terminated using a zone with a malformed NSEC record. This issue affects BIND 9 versions 9.16.8-S1 through 9.16.41-S1 and 9.18.11-S1 through 9.18.15-S1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free