CVE-2016-1286
Highnamed in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted signature record for a DNAME record, related to db.c and resolver.c.
Published Mar 9, 2016 · Updated Aug 7, 2026 · Also known as DEBIAN-CVE-2016-1286, UBUNTU-CVE-2016-1286
Key Facts
Patch immediately- CVE-2016-1286 is a high-severity vulnerability (CVSS 8.6 v3.1) affecting Bind (Isc), Linux Enterprise Debuginfo (Suse), Manager (Suse) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 62% probability of exploitation in the next 30 days.
- Fixed versions are available, including Bind 30:9.3.6-25.P1.el5_11.8, Bind 32:9.8.2-0.17.rc1.el6_4.8, Bind 32:9.8.2-0.37.rc1.45.amzn1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
8.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
EPSS (30-day exploit likelihood)
62%
Higher than 99.1% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2016-1286 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted signature record for a DNAME record, related to db.c and resolver.c.
Affected Products
417 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| BindIsc | 9.10.3, 9.10.3-beta1, 9.10.3-p1, 9.10.3-p2, 9.10.3-p3, 9.10.3-rc1, 9.9.8, 9.9.8-p2 | 9.9.8 |
| Linux Enterprise DebuginfoSuse | 11-sp2, 11-sp3, 11-sp4 | n/a |
| ManagerSuse | 2.1 | n/a |
| Manager ProxySuse | 2.1 | n/a |
| Openstack CloudSuse | 5 | n/a |
Patched Releases
Bind
30:9.3.6-25.P1.el5_11.8, 32:9.8.2-0.17.rc1.el6_4.8, 32:9.8.2-0.37.rc1.45.amzn1, 32:9.8.2-0.37.rc1.el6_7.7, 32:9.9.4-29.el7_2.3, 9.10.3P4-21.1, 9.9.6P1-0.25.1, 9.9.6P1-0.27.1, 9.9.6P1-2.19.1, 9.9.6P1-28.12.1, 9.9.6P1-33.1, 9.9.6P1-38.1, 9.9.8
bind-chroot
30:9.3.6-25.P1.el5_11.8, 32:9.8.2-0.37.rc1.45.amzn1, 32:9.8.2-0.37.rc1.el6_7.7, 32:9.9.4-29.el7_2.3
bind-chrootenv
9.10.3P4-21.1, 9.9.6P1-0.25.1, 9.9.6P1-0.27.1, 9.9.6P1-2.19.1, 9.9.6P1-28.12.1, 9.9.6P1-33.1, 9.9.6P1-38.1
bind-debuginfo
9.9.6P1-2.19.1
bind-debugsource
9.9.6P1-2.19.1
bind-devel
30:9.3.6-25.P1.el5_11.8, 32:9.8.2-0.37.rc1.45.amzn1, 32:9.8.2-0.37.rc1.el6_7.7, 32:9.9.4-29.el7_2.3, 9.10.3P4-21.1, 9.9.6P1-0.25.1, 9.9.6P1-2.19.1, 9.9.6P1-28.12.1, 9.9.6P1-33.1, 9.9.6P1-38.1
bind-devel-32bit
9.10.3P4-21.1, 9.9.6P1-0.25.1
bind-doc
9.10.3P4-21.1, 9.9.6P1-0.25.1, 9.9.6P1-0.27.1, 9.9.6P1-2.19.1, 9.9.6P1-28.12.1, 9.9.6P1-33.1, 9.9.6P1-38.1
bind-libbind-devel
30:9.3.6-25.P1.el5_11.8
bind-libs
30:9.3.6-25.P1.el5_11.8, 32:9.8.2-0.37.rc1.45.amzn1, 32:9.8.2-0.37.rc1.el6_7.7, 32:9.9.4-29.el7_2.3, 9.9.6P1-0.25.1, 9.9.6P1-0.27.1, 9.9.6P1-2.19.1, 9.9.6P1-28.12.1, 9.9.6P1-33.1, 9.9.6P1-38.1
bind-libs-32bit
9.9.6P1-0.25.1, 9.9.6P1-0.27.1, 9.9.6P1-2.19.1, 9.9.6P1-28.12.1, 9.9.6P1-33.1, 9.9.6P1-38.1
bind-libs-debuginfo
9.9.6P1-2.19.1
bind-libs-debuginfo-32bit
9.9.6P1-2.19.1
bind-libs-lite
32:9.9.4-29.el7_2.3
bind-libs-x86
9.9.6P1-0.25.1
bind-license
32:9.9.4-29.el7_2.3
bind-lite-devel
32:9.9.4-29.el7_2.3
bind-lwresd
9.10.3P4-21.1, 9.9.6P1-2.19.1, 9.9.6P1-33.1
bind-lwresd-debuginfo
9.9.6P1-2.19.1
bind-pkcs11
32:9.9.4-29.el7_2.3
bind-pkcs11-devel
32:9.9.4-29.el7_2.3
bind-pkcs11-libs
32:9.9.4-29.el7_2.3
bind-pkcs11-utils
32:9.9.4-29.el7_2.3
bind-sdb
30:9.3.6-25.P1.el5_11.8, 32:9.8.2-0.37.rc1.45.amzn1, 32:9.8.2-0.37.rc1.el6_7.7, 32:9.9.4-29.el7_2.3
bind-sdb-chroot
32:9.9.4-29.el7_2.3
Timeline
Publicly disclosed
Mar 9, 2016
Last updated
Aug 7, 2026
Weakness Type
- CWE-617 Reachable Assertion
References
- advisoryFEDORA-2016-364c0a9df4
- advisoryFEDORA-2016-161b73fc2c
- advisoryFEDORA-2016-b593e84223
- advisoryFEDORA-2016-5047abe4a9
- advisoryFEDORA-2016-75f31fbb0a
FAQ
Common Questions.
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted signature record for a DNAME record, related to db.c and resolver.c.
Affected: Bind (Isc) versions 9.10.3, 9.10.3-beta1, 9.10.3-p1, 9.10.3-p2, 9.10.3-p3, 9.10.3-rc1, 9.9.8, 9.9.8-p2; Linux Enterprise Debuginfo (Suse) versions 11-sp2, 11-sp3, 11-sp4; Manager (Suse) versions 2.1, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Bind 30:9.3.6-25.P1.el5_11.8, Bind 32:9.8.2-0.17.rc1.el6_4.8, Bind 32:9.8.2-0.37.rc1.45.amzn1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2016-1286 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo