CVE-2022-2906

Published: Sep 21, 2022Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.

Affected (2)

Products: Isc: Bind

Isc

1 product

Bind

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Isc Bind	From 9.18.0 to 9.18.7
Isc Bind	From 9.19.0 to 9.19.5

Related CWEs

CWE-401

Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

References (6)

http://www.openwall.com/lists/oss-security/2022/09/21/3

Source: security-officer@isc.org

Mailing ListPatchThird Party Advisory

https://kb.isc.org/docs/cve-2022-2906

Source: security-officer@isc.org

PatchVendor Advisory

https://security.gentoo.org/glsa/202210-25

Source: security-officer@isc.org

Third Party Advisory

http://www.openwall.com/lists/oss-security/2022/09/21/3

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatchThird Party Advisory

https://kb.isc.org/docs/cve-2022-2906

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://security.gentoo.org/glsa/202210-25

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.