CVE-2016-1286: ISC BIND DNAME signature record assertion failure denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated remote denial of service against a core DNS service with a high CVSS score and very high EPSS percentile, though no KEV listing or confirmed in-the-wild exploitation is documented.

What it is

ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 mishandle a crafted signature record for a DNAME record, triggering an assertion failure in db.c and resolver.c that exits the named daemon. Because BIND is a widely deployed recursive and authoritative DNS server, a single malformed response can take a resolver offline, disrupting name resolution for all downstream clients.

Impact

A remote attacker can crash the named daemon, causing a denial of service for DNS resolution and any services relying on it. The flaw is availability-only; there is no stated path to code execution or data disclosure.

Attack surface

Reachable over the network with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The crafted DNAME signature record is delivered as DNS data, so any resolver or server that processes attacker-influenced responses is exposed.

Exploitation

Not listed in CISA KEV and no ransomware use is documented, but EPSS is 0.621 (99.1st percentile), indicating a high modeled likelihood of exploitation activity. References are vendor advisories and distribution errata only, with no public exploit tag.

What to do

• Upgrade to BIND 9.9.8-P4, 9.10.3-P4 or later, or apply the vendor patch for your distribution.
• Apply the referenced OS vendor errata (Red Hat, Debian, Ubuntu, SUSE/openSUSE, Fedora) if you cannot move to upstream BIND immediately.
• Restrict recursion and limit which clients can query the resolver to reduce exposure to crafted responses.
• Monitor named process restarts and assertion failures as an early indicator of attempted exploitation.

Detection

• Alert on named daemon exits or restarts with assertion failures referencing db.c or resolver.c.
• Monitor DNS logs for repeated malformed or anomalous DNAME and signature record handling.
• Track resolver availability gaps and correlate them with inbound DNS response traffic.
• Watch for unexpected process termination of named on recursive and authoritative servers.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.