Vulnerability record · CVE-2016-2776 · published 28 September 2016
CVE-2016-2776: ISC BIND named response construction flaw causes daemon exit
Oracle · Linux
ISC BIND's named daemon fails to properly construct responses in buffer.c, causing an assertion failure and daemon exit when it receives a crafted query. This is a remotely reachable denial-of-service flaw in a core DNS service, so a single malformed query can take a resolver or authoritative server offline.
Description
buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly construct responses, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityRemote unauthenticated denial of service against core DNS infrastructure with public exploit code and very high EPSS, though no KEV listing or confirmed in-the-wild use.
What it is
ISC BIND's named daemon fails to properly construct responses in buffer.c, causing an assertion failure and daemon exit when it receives a crafted query. This is a remotely reachable denial-of-service flaw in a core DNS service, so a single malformed query can take a resolver or authoritative server offline.
Impact
An unauthenticated remote attacker can crash the named process, interrupting DNS resolution or authoritative service for all clients that depend on it. The flaw causes only availability loss; there is no stated confidentiality or integrity impact.
Attack surface
Reachable over the network via a crafted DNS query to a BIND server, with no authentication and no user interaction required per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any exposed named instance running an affected version is a candidate target.
Exploitation
CISA KEV does not list this CVE, but EPSS is very high at 0.89482 (99.777th percentile), and a public Exploit-DB entry (40453) exists, indicating exploit code is available. No ransomware group is documented as using it.
What to do
- Upgrade BIND to 9.9.9-P3, 9.10.4-P3, 9.11.0rc3 or later, or apply the vendor patch for your distribution.
- If immediate patching is not possible, restrict DNS query access to trusted networks and disable recursion on servers that do not need it.
- Apply the relevant Red Hat, Oracle, HP, FreeBSD, Gentoo or NetApp advisory updates for bundled BIND packages.
- Monitor named process availability and configure automatic restart or failover for critical DNS services.
Detection
- Alert on named process exits, assertion failures or core dumps in system and BIND logs.
- Monitor for sudden loss of DNS service availability or repeated resolver restarts.
- Review DNS query logs for malformed or anomalous query patterns targeting the server.
- Track BIND version inventory to identify hosts still running affected releases.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2016-2776 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2016-2776), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
