Skip to content
Fencer Vulns
high 7.5

CVE-2023-3341 json

A stack exhaustion flaw in control channel code may cause named to terminate unexpectedly

published 2023-09-20 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-44009

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.9%
EPSS 2.9% chance of exploitation in 30 days, percentile 87%
public exploits
0
none known

Summary

The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing code to run out of available stack memory, causing `named` to terminate unexpectedly. Since each incoming control channel message is fully parsed before its contents are authenticated, exploiting this flaw does not require the attacker to hold a valid RNDC key; only network access to the control channel's configured TCP port is necessary. This issue affects BIND 9 versions 9.2.0 through 9.16.43, 9.18.0 through 9.18.18, 9.19.0 through 9.19.16, 9.9.3-S1 through 9.16.43-S1, and 9.18.0-S1 through 9.18.18-S1.

Patch / fix

  • isc bind 9.16.44, 9.18.19, 9.19.17
  • bind9 Debian 12 1:9.18.19-1~deb12u1
  • bind9 Debian 14, Debian 13 1:9.19.17-1

debian advisories DEBIAN-CVE-2023-3341

  • bind9 Ubuntu 20.04 LTS 1:9.16.1-0ubuntu2.16
  • bind9 Ubuntu 22.04 LTS 1:9.18.12-0ubuntu0.22.04.3
  • bind9 Ubuntu 24.04 LTS 1:9.18.18-0ubuntu2
  • bind9 Ubuntu Pro 14.04 LTS 1:9.9.5.dfsg-3ubuntu0.19+esm11
  • bind9 Ubuntu Pro 16.04 LTS 1:9.10.3.dfsg.P4-8ubuntu1.19+esm7
  • bind9 Ubuntu Pro 18.04 LTS 1:9.11.3+dfsg-1ubuntu1.19+esm2

ubuntu advisories UBUNTU-CVE-2023-3341

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • bind RHEL 7 32:9.11.4-26.P2.el7_9.15
  • bind-sdb RHEL 7 32:9.11.4-26.P2.el7_9.15
  • bind-libs RHEL 7 32:9.11.4-26.P2.el7_9.15
  • bind-utils RHEL 7 32:9.11.4-26.P2.el7_9.15
  • bind-chroot RHEL 7 32:9.11.4-26.P2.el7_9.15
  • bind-pkcs11 RHEL 7 32:9.11.4-26.P2.el7_9.15
  • bind-license RHEL 7 32:9.11.4-26.P2.el7_9.15
  • bind-libs-lite RHEL 7 32:9.11.4-26.P2.el7_9.15

red hat advisories RHSA-2025:0039RHSA-2023:5771RHSA-2023:5691RHSA-2023:5689RHSA-2023:5690RHSA-2023:5527

  • bind SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE High Performance Computing 15 SP3-LTSS +4 more 9.16.6-150300.22.41.1
  • bind SLE Module for Server Applications 15 SP5, SLE Module for Basesystem 15 SP5, openSUSE Leap 15.5 9.16.44-150500.8.12.2
  • bind SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES 15 SP2-LTSS +5 more 9.16.6-150000.12.71.1
  • bind SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 9.11.22-3.49.1
  • bind SLE Module for Server Applications 15 SP4, SLE Module for Basesystem 15 SP4, openSUSE Leap 15.4 9.16.44-150400.5.37.2

suse advisories SUSE-SU-2023:3934-1SUSE-SU-2023:3821-1SUSE-SU-2023:3805-1SUSE-SU-2023:3796-1SUSE-SU-2023:3737-1

  • bind openSUSE Tumbleweed 9.18.19-1.1

opensuse advisories openSUSE-SU-2024:13249-1

  • bind AlmaLinux 9 32:9.16.23-11.el9_2.2
  • bind-libs AlmaLinux 9 32:9.16.23-11.el9_2.2
  • bind-utils AlmaLinux 9 32:9.16.23-11.el9_2.2
  • bind-chroot AlmaLinux 9 32:9.16.23-11.el9_2.2
  • bind-license AlmaLinux 9 32:9.16.23-11.el9_2.2
  • python3-bind AlmaLinux 9 32:9.16.23-11.el9_2.2
  • bind-dnssec-utils AlmaLinux 9 32:9.16.23-11.el9_2.2
  • bind9.16 AlmaLinux 8 32:9.16.23-0.14.el8_8.2.alma.1

almalinux advisories ALSA-2023:5689ALSA-2023:5460ALSA-2023:5474

  • bind Rocky Linux 9 2:9.16.23-11.el9_2.2

rocky linux advisories RLSA-2023:5689

  • bind Alpine 3.16, Alpine 3.15 9.16.44-r0
  • bind Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 9.18.19-r0

alpine advisories ALPINE-CVE-2023-3341

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • bind CBL-Mariner 2.0, Azure Linux 3.0 9.16.44-1

azure linux advisories AZL-29943AZL-34562

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-3341 updated cvss 7.5

bind: stack exhaustion in control channel code may lead to DoS

  • Red Hat CodeReady Linux Builder EUS (v.8.6) bind9.16-libs 9.16.23-0.7.el8_6.3, python3-bind9.16 9.16.23-0.7.el8_6.3, bind9.16-dnssec-utils 9.16.23-0.7.el8_6.3
    fixed: vendor fix RHSA-2023:5771
  • Red Hat CodeReady Linux Builder EUS (v.9.0) bind-libs 9.16.23-1.el9_0.3
    fixed: vendor fix RHSA-2023:5690
  • Red Hat Enterprise Linux AppStream (v. 8) bind 9.11.36-8.el8_8.2, bind-sdb 9.11.36-8.el8_8.2, bind-libs 9.11.36-8.el8_8.2, bind-utils 9.11.36-8.el8_8.2, bind-chroot 9.11.36-8.el8_8.2, bind-pkcs11 9.11.36-8.el8_8.2, +13 more
    fixed: vendor fix RHSA-2023:5474
  • Red Hat Enterprise Linux AppStream (v. 9) bind 9.16.23-11.el9_2.2, bind-libs 9.16.23-11.el9_2.2, bind-utils 9.16.23-11.el9_2.2, bind-chroot 9.16.23-11.el9_2.2, bind-license 9.16.23-11.el9_2.2, python3-bind 9.16.23-11.el9_2.2, +1 more
    fixed: vendor fix RHSA-2023:5689
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) bind 9.11.13-6.el8_2.6, bind-sdb 9.11.13-6.el8_2.6, bind-libs 9.11.13-6.el8_2.6, bind-utils 9.11.13-6.el8_2.6, bind-chroot 9.11.13-6.el8_2.6, bind-pkcs11 9.11.13-6.el8_2.6, +6 more
    fixed: vendor fix RHSA-2023:5527
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) bind 9.11.26-4.el8_4.3, bind-sdb 9.11.26-4.el8_4.3, bind-libs 9.11.26-4.el8_4.3, bind-utils 9.11.26-4.el8_4.3, bind-chroot 9.11.26-4.el8_4.3, bind-pkcs11 9.11.26-4.el8_4.3, +6 more
    fixed: vendor fix RHSA-2023:5529
  • Red Hat Enterprise Linux AppStream E4S (v. 8.1) bind 9.11.4-26.P2.el8_1.8, bind-sdb 9.11.4-26.P2.el8_1.8, bind-libs 9.11.4-26.P2.el8_1.8, bind-utils 9.11.4-26.P2.el8_1.8, bind-chroot 9.11.4-26.P2.el8_1.8, bind-pkcs11 9.11.4-26.P2.el8_1.8, +6 more
    fixed: vendor fix RHSA-2023:5526
  • Red Hat Enterprise Linux AppStream E4S (v. 8.2) bind 9.11.13-6.el8_2.6, bind-sdb 9.11.13-6.el8_2.6, bind-libs 9.11.13-6.el8_2.6, bind-utils 9.11.13-6.el8_2.6, bind-chroot 9.11.13-6.el8_2.6, bind-pkcs11 9.11.13-6.el8_2.6, +6 more
    fixed: vendor fix RHSA-2023:5527
show 21 more
  • Red Hat Enterprise Linux AppStream E4S (v.8.4) bind 9.11.26-4.el8_4.3, bind-sdb 9.11.26-4.el8_4.3, bind-libs 9.11.26-4.el8_4.3, bind-utils 9.11.26-4.el8_4.3, bind-chroot 9.11.26-4.el8_4.3, bind-pkcs11 9.11.26-4.el8_4.3, +6 more
    fixed: vendor fix RHSA-2023:5529
  • Red Hat Enterprise Linux AppStream EUS (v.8.6) bind 9.11.36-3.el8_6.5, bind-sdb 9.11.36-3.el8_6.5, bind-libs 9.11.36-3.el8_6.5, bind-utils 9.11.36-3.el8_6.5, bind9.16 9.16.23-0.7.el8_6.3, bind-chroot 9.11.36-3.el8_6.5, +11 more
    fixed: vendor fix RHSA-2023:5473
  • Red Hat Enterprise Linux AppStream EUS (v.9.0) bind 9.16.23-1.el9_0.3, bind-libs 9.16.23-1.el9_0.3, bind-utils 9.16.23-1.el9_0.3, bind-chroot 9.16.23-1.el9_0.3, bind-license 9.16.23-1.el9_0.3, python3-bind 9.16.23-1.el9_0.3, +1 more
    fixed: vendor fix RHSA-2023:5690
  • Red Hat Enterprise Linux AppStream TUS (v. 8.2) bind 9.11.13-6.el8_2.6, bind-sdb 9.11.13-6.el8_2.6, bind-libs 9.11.13-6.el8_2.6, bind-utils 9.11.13-6.el8_2.6, bind-chroot 9.11.13-6.el8_2.6, bind-pkcs11 9.11.13-6.el8_2.6, +6 more
    fixed: vendor fix RHSA-2023:5527
  • Red Hat Enterprise Linux AppStream TUS (v.8.4) bind 9.11.26-4.el8_4.3, bind-sdb 9.11.26-4.el8_4.3, bind-libs 9.11.26-4.el8_4.3, bind-utils 9.11.26-4.el8_4.3, bind-chroot 9.11.26-4.el8_4.3, bind-pkcs11 9.11.26-4.el8_4.3, +6 more
    fixed: vendor fix RHSA-2023:5529
  • Red Hat Enterprise Linux BaseOS (v. 8) bind 9.11.36-8.el8_8.2, bind-export-libs 9.11.36-8.el8_8.2
    fixed: vendor fix RHSA-2023:5474
  • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) bind 9.11.13-6.el8_2.6, bind-export-libs 9.11.13-6.el8_2.6
    fixed: vendor fix RHSA-2023:5527
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4) bind 9.11.26-4.el8_4.3, bind-export-libs 9.11.26-4.el8_4.3
    fixed: vendor fix RHSA-2023:5529
  • Red Hat Enterprise Linux BaseOS E4S (v. 8.1) bind 9.11.4-26.P2.el8_1.8, bind-export-libs 9.11.4-26.P2.el8_1.8
    fixed: vendor fix RHSA-2023:5526
  • Red Hat Enterprise Linux BaseOS E4S (v. 8.2) bind 9.11.13-6.el8_2.6, bind-export-libs 9.11.13-6.el8_2.6
    fixed: vendor fix RHSA-2023:5527
  • Red Hat Enterprise Linux BaseOS E4S (v.8.4) bind 9.11.26-4.el8_4.3, bind-export-libs 9.11.26-4.el8_4.3
    fixed: vendor fix RHSA-2023:5529
  • Red Hat Enterprise Linux BaseOS EUS (v.8.6) bind 9.11.36-3.el8_6.5, bind-export-libs 9.11.36-3.el8_6.5
    fixed: vendor fix RHSA-2023:5473
  • Red Hat Enterprise Linux BaseOS TUS (v. 8.2) bind 9.11.13-6.el8_2.6, bind-export-libs 9.11.13-6.el8_2.6
    fixed: vendor fix RHSA-2023:5527
  • Red Hat Enterprise Linux BaseOS TUS (v.8.4) bind 9.11.26-4.el8_4.3, bind-export-libs 9.11.26-4.el8_4.3
    fixed: vendor fix RHSA-2023:5529
  • Red Hat Enterprise Linux Client (v. 7) bind 9.11.4-26.P2.el7_9.15, bind-libs 9.11.4-26.P2.el7_9.15, bind-utils 9.11.4-26.P2.el7_9.15, bind-license 9.11.4-26.P2.el7_9.15, bind-libs-lite 9.11.4-26.P2.el7_9.15, bind-export-libs 9.11.4-26.P2.el7_9.15 Red Hat Enterprise Linux Client Optional (v. 7) bind 9.11.4-26.P2.el7_9.15, bind-sdb 9.11.4-26.P2.el7_9.15, bind-chroot 9.11.4-26.P2.el7_9.15, bind-pkcs11 9.11.4-26.P2.el7_9.15, bind-sdb-chroot 9.11.4-26.P2.el7_9.15, bind-pkcs11-libs 9.11.4-26.P2.el7_9.15, +1 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) bind 9.11.4-26.P2.el7_9.15, bind-sdb 9.11.4-26.P2.el7_9.15, bind-chroot 9.11.4-26.P2.el7_9.15, bind-pkcs11 9.11.4-26.P2.el7_9.15, bind-sdb-chroot 9.11.4-26.P2.el7_9.15, bind-pkcs11-libs 9.11.4-26.P2.el7_9.15, +1 more
    fixed: vendor fix RHSA-2023:5691
  • Red Hat Enterprise Linux CRB (v. 8) bind9.16-libs 9.16.23-0.14.el8_8.2
    fixed: vendor fix RHSA-2023:5460
  • Red Hat Enterprise Linux CRB (v. 9) bind-libs 9.16.23-11.el9_2.2
    fixed: vendor fix RHSA-2023:5689
  • Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION) bind 9.8.2-0.68.rc1.el6_10.14, bind-dyndb-ldap 2.3-8.el6_10.1, bind-libs 9.8.2-0.68.rc1.el6_10.14, bind-utils 9.8.2-0.68.rc1.el6_10.14, bind-chroot 9.8.2-0.68.rc1.el6_10.14
    fixed: vendor fix RHSA-2025:0039
  • Red Hat Enterprise Linux Server (v. 7) bind 9.11.4-26.P2.el7_9.15, bind-libs 9.11.4-26.P2.el7_9.15, bind-utils 9.11.4-26.P2.el7_9.15, bind-chroot 9.11.4-26.P2.el7_9.15, bind-pkcs11 9.11.4-26.P2.el7_9.15, bind-license 9.11.4-26.P2.el7_9.15, +4 more
    fixed: vendor fix RHSA-2023:5691
  • Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION) bind-sdb 9.8.2-0.68.rc1.el6_10.14
    fixed: vendor fix RHSA-2025:0039
  • Red Hat Enterprise Linux Server Optional (v. 7) bind-sdb 9.11.4-26.P2.el7_9.15, bind-sdb-chroot 9.11.4-26.P2.el7_9.15 Red Hat Enterprise Linux Workstation (v. 7) bind 9.11.4-26.P2.el7_9.15, bind-libs 9.11.4-26.P2.el7_9.15, bind-utils 9.11.4-26.P2.el7_9.15, bind-chroot 9.11.4-26.P2.el7_9.15, bind-pkcs11 9.11.4-26.P2.el7_9.15, bind-license 9.11.4-26.P2.el7_9.15, +4 more Red Hat Enterprise Linux Workstation Optional (v. 7) bind-sdb 9.11.4-26.P2.el7_9.15, bind-sdb-chroot 9.11.4-26.P2.el7_9.15
    fixed: vendor fix RHSA-2023:5691

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-25-105-08 updated cvss 7.5

ABB M2M Gateway

  • ABB M2M Gateway >=4.1.2, <=5.0.3, >=5.0.1, <=5.0.3
    affected: mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
17 mo ago

Exploit prediction

2.93% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • ISC BIND 9

Classification

Weakness
  • CWE-1325 Improperly Controlled Sequential Memory Allocation
  • CWE-787 Out-of-bounds Write

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.