CVE-2017-3136: Debian Linux

Medium severity, CVSS 5.9. EPSS: 11.2% chance of exploitation in the next 30 days.

A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate. An attacker could deliberately construct a query, enabling denial-of-service against a server if it was configured to use the DNS64 feature and other preconditions were met. Affects BIND 9.8.0 -> 9.8.8-P1, 9.9.0 -> 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.0 -> 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0 -> 9.11.0-P3, 9.11.1b1->9.11.1rc1, 9.9.3-S1 -> 9.9.9-S8.

Affected products

• Debian Debian Linux: version 8.0 only
• ISC BIND: from 9.8.0, up to and including 9.8.8; from 9.9.0, up to and including 9.9.9; from 9.10.0, up to and including 9.10.4; version 9.8.0 only; version 9.9.0 only; version 9.9.3 only; …
• Netapp Data Ontap Edge: affected versions not specified
• Netapp Element Software: affected versions not specified
• Netapp Oncommand Balance: affected versions not specified
• Red Hat Enterprise Linux Desktop: version 6.0 only; version 7.0 only
• Red Hat Enterprise Linux Server: version 6.0 only; version 7.0 only
• Red Hat Enterprise Linux Server Aus: version 7.3 only; version 7.4 only; version 7.6 only
• Red Hat Enterprise Linux Server Eus: version 7.3 only; version 7.4 only; version 7.5 only; version 7.6 only
• Red Hat Enterprise Linux Server Tus: version 7.3 only; version 7.6 only
• Red Hat Enterprise Linux Workstation: version 6.0 only; version 7.0 only

Published 2019-01-16. Last modified 2026-06-17.