What’s Vulnerable › Vulnerabilities
CVE-2022-2795: Processing large delegations may severely degrade resolver performance
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 2.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2022-09-21 · updated 2026-09-01
Description
By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.
Affected products
- Debian Linux: 10.0, 11.0
- Fedoraproject Fedora: 35, 36, 37
- ISC BIND: from 9.0.0 before 9.16.33; from 9.18.0 before 9.18.7; from 9.19.0 before 9.19.5; 9.9.3-s1, 9.9.12-s1, 9.9.13-s1, 9.10.5-s1, 9.10.7-s1, 9.11.3-s1 (+19) — fixed in 9.16.33, 9.18.7, 9.19.5
How to fix
Upgrade to a fixed version: ISC BIND 9.16.33, 9.18.7, 9.19.5. Check the vendor advisory for mitigations.
References
- http://www.openwall.com/lists/oss-security/2022/09/21/3
- https://kb.isc.org/docs/cve-2022-2795
- https://lists.debian.org/debian-lts-announce/2022/10/msg00007.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/
- https://security.gentoo.org/glsa/202210-25
- https://www.debian.org/security/2022/dsa-5235
- http://www.openwall.com/lists/oss-security/2022/09/21/3
- https://kb.isc.org/docs/cve-2022-2795
- https://lists.debian.org/debian-lts-announce/2022/10/msg00007.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/
Get alerted when CVE-2022-2795 or the next vulnerability affects your stack