CVE-2023-2829

HighCVSS 7.5/10Last modified Oct 24, 2026

Description

A `named` instance configured to run as a DNSSEC-validating recursive resolver with the Aggressive Use of DNSSEC-Validated Cache (RFC 8198) option (`synth-from-dnssec`) enabled can be remotely terminated using a zone with a malformed NSEC record. This issue affects BIND 9 versions 9.16.8-S1 through 9.16.41-S1 and 9.18.11-S1 through 9.18.15-S1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected software

VendorProductVersions
ISCBIND 9>= 9.16.8-S1, <= 9.16.41-S1; >= 9.18.11-S1, <= 9.18.15-S1

References

Timeline

Published
Jun 21, 2023
Last modified
Oct 24, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-282905.3Microsoft Remote Desktop app for Windows Information Disclosure VulnerabilityCVE-2023-282917.8Raw Image Extension Remote Code Execution VulnerabilityCVE-2023-282927.8Raw Image Extension Remote Code Execution VulnerabilityCVE-2023-282937.8Windows Kernel Elevation of Privilege VulnerabilityCVE-2023-282957.8Microsoft Publisher Remote Code Execution VulnerabilityCVE-2023-282967.8Visual Studio Remote Code Execution VulnerabilityCVE-2023-282978.8Windows Remote Procedure Call Service (RPCSS) Elevation of Privilege VulnerabilityCVE-2023-282985.5Windows Kernel Denial of Service VulnerabilityCVE-2023-282995.5Visual Studio Spoofing VulnerabilityCVE-2023-28308.8Cross-Site Request Forgery (CSRF) vulnerability in Trustindex.Io WP Testimonials plugin <= 1.4.2 versions.CVE-2023-283007.5Azure Service Connector Security Feature Bypass VulnerabilityCVE-2023-283013.7Microsoft Edge (Chromium-based) Tampering Vulnerability
CVE-2023-2829: High severity, CVSS 7.5 | Vulnix