CVE-2016-8864

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 38.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-11-02 · updated 2026-06-17
Weakness: CWE-617

Description

named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a DNAME record in the answer section of a response to a recursive query, related to db.c and resolver.c.

Affected products

Debian Linux: 8.0
ISC BIND: from 9.0.0 before 9.9.9; from 9.10.0 before 9.10.4; 9.9.9, 9.9.9-beta1, 9.9.9-beta2, 9.9.9-p1, 9.9.9-p2, 9.9.9-p3 (+14) — fixed in 9.10.4, 9.9.9
NetApp Data Ontap Edge: all versions
NetApp Solidfire: all versions
NetApp Steelstore Cloud Integrated Storage: all versions
RedHat Enterprise Linux Desktop: 5.0, 6.0, 7.0
RedHat Enterprise Linux Eus: 6.7, 7.2, 7.3, 7.4, 7.5, 7.6 (+1)
RedHat Enterprise Linux Server: 5.0, 6.0, 7.0
RedHat Enterprise Linux Server Aus: 6.2, 6.4, 6.5, 6.6, 7.2, 7.3 (+3)
RedHat Enterprise Linux Server Tus: 6.5, 6.6, 7.2, 7.3, 7.6, 7.7
RedHat Enterprise Linux Workstation: 5.0, 6.0, 7.0

How to fix

Upgrade to a fixed version: ISC BIND 9.10.4, 9.9.9. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2016-8864 or the next vulnerability affects your stack