CVE-2018-5734: A malformed request can trigger an assertion failure in badcache.c

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-01-16 · updated 2026-06-17
Weakness: CWE-617

Description

While handling a particular type of malformed packet BIND erroneously selects a SERVFAIL rcode instead of a FORMERR rcode. If the receiving view has the SERVFAIL cache feature enabled, this can trigger an assertion failure in badcache.c when the request doesn't contain all of the expected information. Affects BIND 9.10.5-S1 to 9.10.5-S4, 9.10.6-S1, 9.10.6-S2.

Affected products

ISC BIND: 9.10.5-s1, 9.10.5-s4, 9.10.6-s1, 9.10.6-s2
NetApp Data Ontap Edge: all versions
NetApp Solidfire Element Os Management Node: all versions

References

http://www.securityfocus.com/bid/103189
http://www.securitytracker.com/id/1040438
https://kb.isc.org/docs/aa-01562
https://security.netapp.com/advisory/ntap-20180926-0005/
http://www.securityfocus.com/bid/103189
http://www.securitytracker.com/id/1040438
https://kb.isc.org/docs/aa-01562
https://security.netapp.com/advisory/ntap-20180926-0005/

Get alerted when CVE-2018-5734 or the next vulnerability affects your stack