What’s Vulnerable › Vulnerabilities

CVE-2022-2906: Memory leaks in code handling Diffie-Hellman key exchange via TKEY RRs (OpenSSL 3.0.0+ only)

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-09-21 · updated 2026-06-17
• Weakness: CWE-401

Description

An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.

Affected products

• ISC BIND: from 9.18.0 before 9.18.7; from 9.19.0 before 9.19.5 — fixed in 9.18.7, 9.19.5

How to fix

Upgrade to a fixed version: ISC BIND 9.18.7, 9.19.5. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2022/09/21/3
• https://kb.isc.org/docs/cve-2022-2906
• https://security.gentoo.org/glsa/202210-25
• http://www.openwall.com/lists/oss-security/2022/09/21/3
• https://kb.isc.org/docs/cve-2022-2906
• https://security.gentoo.org/glsa/202210-25

Get alerted when CVE-2022-2906 or the next vulnerability affects your stack