All vulnerabilities

Servers and applications

CVE-2023-3341

The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing code to run out of available stack memory, causing `named` to terminate unexpectedly. Since each incoming control channel message is fully…

Severity
High 7.5
Published
20 Sept 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
9.16.44, 9.18.19, 9.19.17
Sources
NVD

Affected software

SoftwareAffected versions
BIND 9Servers and applications · cpe:a:isc:bind
  • From 9.19.0 before 9.19.17
  • Version 9.18.18-s1
  • Version 9.18.0-s1
  • From 9.18.0 before 9.18.19
All 34 release lines
  • From 9.2.0 before 9.16.44
  • Version 9.9.3-s1
  • Version 9.9.12-s1
  • Version 9.9.13-s1
  • Version 9.10.5-s1
  • Version 9.10.7-s1
  • Version 9.11.3-s1
  • Version 9.11.3-s4
  • Version 9.11.4-s1
  • Version 9.11.5-s3
  • Version 9.11.5-s5
  • Version 9.11.5-s6
  • Version 9.11.6-s1
  • Version 9.11.7-s1
  • Version 9.11.8-s1
  • Version 9.11.12-s1
  • Version 9.11.21-s1
  • Version 9.11.27-s1
  • Version 9.11.29-s1
  • Version 9.11.35-s1
  • Version 9.11.37-s1
  • Version 9.16.8-s1
  • Version 9.16.11-s1
  • Version 9.16.12-s1
  • Version 9.16.13-s1
  • Version 9.16.14-s1
  • Version 9.16.21-s1
  • Version 9.16.32-s1
  • Version 9.16.36-s1
  • Version 9.16.43-s1
  • From 9.18.0 before 9.18.19
  • Version 9.18.0-s1
  • Version 9.18.18-s1
  • From 9.19.0 before 9.19.17

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-3341
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-3341