CVE-2022-3736

bind: sending specific queries to the resolver may cause a DoS

Loading…

Severity

Moderate

Red Hat Product Security

7.5

CVSS 3.1

Review impact separately from score.

Published · January 25, 2023

Updated · November 21, 2025

Description

A flaw was found in Bind, where a resolver crash is possible. When stale cache and stale answers are enabled, the option stale-answer-client-timeout is set to a positive integer, and the resolver receives an RRSIG query.

Statement

The flaw exists in the implementation of the stale-answer-client-timeout option, which was first effectively introduced in bind 9.16.12.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

Setting stale-answer-client-timeout to 0 or to off/disabled will prevent BIND from crashing due to this issue.

CVSS / CWE

CVSS 3.1 · 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-20 · Improper Input Validation