UpHeron
All vulnerabilities

Servers and applications

CVE-2017-3137

Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could lead to a situation in which named would exit with an assertion failure when processing a response in which records occurred in an unusual order. Affects BIND 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0-P3, 9.11.1b1->9.11.1rc1, and…

Severity
High 7.5
Published
16 Jan 2019
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
8.9% in the next 30 daysHigher than 95% of CVEs. EPSS by FIRST, 10 Nov 2026
Weakness
CWE-617
Attack
Over the network · No login needed · No user action needed
Attacker can
Take it down
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Sources
NVD

Description

Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could lead to a situation in which named would exit with an assertion failure when processing a response in which records occurred in an unusual order. Affects BIND 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0-P3, 9.11.1b1->9.11.1rc1, and 9.9.9-S8.

From NVD.

Affected software

SoftwareAffected versions
BIND 9Servers and applications · cpe:a:isc:bind
  • Version 9.11.1-rc1
  • Version 9.11.1-b1
  • Version 9.11.0-p3
  • Version 9.10.5-rc1
All 10 release lines
  • Version 9.9.9-p6
  • Version 9.9.9-s8
  • Version 9.9.10-beta1
  • Version 9.9.10-rc1
  • Version 9.10.4-p6
  • Version 9.10.5-b1
  • Version 9.10.5-rc1
  • Version 9.11.0-p3
  • Version 9.11.1-b1
  • Version 9.11.1-rc1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2017-3137
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2017-3137