CVE-2023-2829: ISC BIND

High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days.

A `named` instance configured to run as a DNSSEC-validating recursive resolver with the Aggressive Use of DNSSEC-Validated Cache (RFC 8198) option (`synth-from-dnssec`) enabled can be remotely terminated using a zone with a malformed NSEC record. This issue affects BIND 9 versions 9.16.8-S1 through 9.16.41-S1 and 9.18.11-S1 through 9.18.15-S1.

Affected products

• ISC BIND: from 9.16.8, up to and including 9.16.41; from 9.18.11, up to and including 9.18.15
• Netapp Active Iq Unified Manager: affected versions not specified
• Netapp h300s Firmware: affected versions not specified
• Netapp h410c Firmware: affected versions not specified
• Netapp h410s Firmware: affected versions not specified
• Netapp h500s Firmware: affected versions not specified
• Netapp h700s Firmware: affected versions not specified

Published 2023-06-21. Last modified 2026-06-17.