CVE-2017-3137: A response packet can cause a resolver to terminate when processing an answer containing a CNAME or DNAME

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 9.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-01-16 · updated 2026-06-17
Weakness: CWE-617

Description

Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could lead to a situation in which named would exit with an assertion failure when processing a response in which records occurred in an unusual order. Affects BIND 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0-P3, 9.11.1b1->9.11.1rc1, and 9.9.9-S8.

Affected products

Debian Linux: 8.0
ISC BIND: 9.9.9-p6, 9.9.9-s8, 9.9.10-beta1, 9.9.10-rc1, 9.10.4-p6, 9.10.5-b1 (+4)
NetApp Data Ontap Edge: all versions
NetApp Element Software: all versions
NetApp Oncommand Balance: all versions
RedHat Enterprise Linux Desktop: 6.0, 7.0
RedHat Enterprise Linux Server: 6.0, 7.0
RedHat Enterprise Linux Server Aus: 6.2, 6.4, 6.5, 6.6, 7.2, 7.3 (+2)
RedHat Enterprise Linux Server Eus: 6.7, 7.2, 7.3, 7.4, 7.5, 7.6
RedHat Enterprise Linux Server Tus: 6.5, 6.6, 7.2, 7.3, 7.6
RedHat Enterprise Linux Workstation: 6.0, 7.0

References

Get alerted when CVE-2017-3137 or the next vulnerability affects your stack