HighFix available
bind9 — security advisory
An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.
- Products
- bind9
- Affected versions
- Not specified
- Fixed versions
- 1:9.18.7-1
- CVEs
- CVE-2022-2906
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 15:29 UTC · Revision 1
Source evidence
An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.
osv:DEBIAN-CVE-2022-2906
bind9
Fixed versions: 1:9.18.7-1
bind9
Fixed versions: 1:9.18.7-1
bind9
Fixed versions: 1:9.18.7-1
Complete source record
{
"id": "59578b008ed660f561eee935a09ecb96620954bbaac81de38ff7207d052ce04a",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2022-2906",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2022-2906",
"summary": "An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.",
"evidence": "osv:DEBIAN-CVE-2022-2906",
"products": [
{
"name": {
"value": "bind9",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:9.18.7-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "bind9",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:9.18.7-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "bind9",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:9.18.7-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "DEBIAN-CVE-2022-2906",
"aliases": [
"DEBIAN-CVE-2022-2906"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:9.18.7-1"
}
]
}
],
"package": {
"name": "bind9",
"purl": "pkg:deb/debian/bind9?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-2906.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:9.18.7-1"
}
]
}
],
"package": {
"name": "bind9",
"purl": "pkg:deb/debian/bind9?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-2906.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:9.18.7-1"
}
]
}
],
"package": {
"name": "bind9",
"purl": "pkg:deb/debian/bind9?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-2906.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-15T08:03:03.806256921Z",
"provider": "osv",
"upstream": [
"CVE-2022-2906"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2022-2906"
]
},
"related_cves": [
{
"value": "CVE-2022-2906",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 325002,
"published_at": "2022-09-21T11:15:09.62+00:00"
}