CVE-2022-38178
Memory leaks in EdDSA DNSSEC verification code
At a glance Severity HIGH 7.5 EPSS EPSS 3.11 % · percentile 88 (2026-10-27) State PUBLISHED Published 2022-09-21 Updated 2025-05-28 Assigner isc NVD status Modified Description By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.
Scores Version Score Vector Scored by CVSS 3.1 HIGH 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H isc CVSS 3.1 HIGH 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H NVD · security-officer@isc.org (Secondary) CVSS 3.1 HIGH 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* ≥ 9.9.12 ≤ 9.9.13cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* ≥ 9.10.7 ≤ 9.10.8cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* ≥ 9.11.3 ≤ 9.16.32cpe:2.3:a:isc:bind:9.11.3:s1:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.11.3:s4:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.11.5:s3:*:*:*:*:*:*cpe:2.3:a:isc:bind:9.11.5:s3:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.11.5:s5:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.11.5:s6:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.11.6:s1:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.11.7:s1:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.11.8:s1:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.11.12:s1:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.11.14-s1:*:*:*:preview:*:*:*cpe:2.3:a:isc:bind:9.11.19-s1:*:*:*:preview:*:*:*cpe:2.3:a:isc:bind:9.11.21:s1:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.11.27:s1:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.11.29:s1:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.11.35:s1:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.11.37:s1:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.16.8:s1:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.16.11:s1:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.16.13:s1:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.16.21:s1:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.16.32:s1:*:*:supported_preview:*:*:*cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*Affected products Product Versions ISC · BIND9 affected Open Source Branch 9.9 9.9.12 through versions up to and including 9.9.13 ; affected Open Source Branch 9.10 9.10.7 through versions up to and including 9.10.8 ; affected Open Source Branches 9.11 through 9.16 9.11.3 through versions before 9.16.33 ; affected Open Source Branch 9.18 9.18.0 through versions before 9.18.7 ; affected Supported Preview Branch 9.11-S 9.11.4-S1 through versions up to and including 9.11.37-S1 ; affected Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1
References
Sources
