CVE-2017-3145: Improper fetch cleanup sequencing in the resolver can cause named to crash

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 27.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-01-16 · updated 2026-06-17
Weakness: CWE-416

Description

BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named. Affects BIND 9.0.0 to 9.8.x, 9.9.0 to 9.9.11, 9.10.0 to 9.10.6, 9.11.0 to 9.11.2, 9.9.3-S1 to 9.9.11-S1, 9.10.5-S1 to 9.10.6-S1, 9.12.0a1 to 9.12.0rc1.

Affected products

Debian Linux: 7.0, 8.0, 9.0
ISC BIND: from 9.4.0 through 9.8.8; from 9.9.0 through 9.9.11; from 9.10.0 through 9.10.6; from 9.11.0 through 9.11.2; 9.9.3-s1, 9.9.11-s1, 9.10.5-s1, 9.10.6-s1, 9.12.0-alpha1, 9.12.0-b1 (+2)
Juniper Junos OS: 12.1x46-d76, 12.3x48-d70, 15.1x49-d140, 17.4r2, 18.1r2, 18.2r1
NetApp Data Ontap Edge: all versions
RedHat Enterprise Linux Desktop: 6.0, 7.0
RedHat Enterprise Linux Server: 6.0, 7.0
RedHat Enterprise Linux Server Aus: 6.4, 6.5, 6.6, 7.2, 7.3, 7.4 (+1)
RedHat Enterprise Linux Server Eus: 6.7, 7.3, 7.4, 7.5, 7.6
RedHat Enterprise Linux Server Tus: 6.6, 7.2, 7.3, 7.6
RedHat Enterprise Linux Workstation: 6.0, 7.0

References

Get alerted when CVE-2017-3145 or the next vulnerability affects your stack