CVE-2016-2775
MediumISC BIND 9.x before 9.9.9-P2, 9.10.x before 9.10.4-P2, and 9.11.x before 9.11.0b2, when lwresd or the named lwres option is enabled, allows remote attackers to cause a denial of service (daemon crash) via a long request that uses the lightweight resolver protocol.
Published Jul 19, 2016 · Updated Aug 7, 2026 · Also known as DEBIAN-CVE-2016-2775, DLA-645-1, DSA-3680-1, SUSE-SU-2017:0998-1, SUSE-SU-2017:0999-1, SUSE-SU-2017:1000-1, UBUNTU-CVE-2016-2775, USN-5747-1
Key Facts
Patch immediately- CVE-2016-2775 is a medium-severity vulnerability (CVSS 5.9 v3.1) affecting Bind (Isc), Fedora (Fedoraproject), Hp-Ux and 21 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 63% probability of exploitation in the next 30 days.
- Fixed versions are available, including Bind 32:9.8.2-0.37.rc1.47.amzn1, Bind 32:9.8.2-0.62.rc1.el6, Bind 32:9.9.4-50.el7_3.2.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (30-day exploit likelihood)
63%
Higher than 99.2% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2016-2775 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
ISC BIND 9.x before 9.9.9-P2, 9.10.x before 9.10.4-P2, and 9.11.x before 9.11.0b2, when lwresd or the named lwres option is enabled, allows remote attackers to cause a denial of service (daemon crash) via a long request that uses the lightweight resolver protocol.
Affected Products
215 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| BindIsc | 9.10.4, 9.10.4-beta1, 9.10.4-beta2, 9.10.4-beta3, 9.10.4-p1, 9.11.0, 9.11.0-alpha1, 9.11.0-alpha2 | 9.9.8 |
| FedoraFedoraproject | 23, 24 | n/a |
| Hp-UxHp | b.11.31 | n/a |
| Enterprise Linux DesktopRedhat | 6.0, 7.0 | n/a |
| Enterprise Linux EusRedhat | 7.2, 7.3, 7.4, 7.5, 7.6, 7.7 | n/a |
Patched Releases
Bind
32:9.8.2-0.37.rc1.47.amzn1, 32:9.8.2-0.62.rc1.el6, 32:9.9.4-50.el7_3.2, 9.16.20-1.4, 9.9.6P1-0.44.1, 9.9.9P1-28.34.1, 9.9.9P1-48.3.1, 9.9.9P1-59.1, 9.9.8
bind-chroot
32:9.8.2-0.37.rc1.47.amzn1
bind-chrootenv
9.9.6P1-0.44.1, 9.9.9P1-28.34.1, 9.9.9P1-48.3.1, 9.9.9P1-59.1
bind-devel
32:9.8.2-0.37.rc1.47.amzn1, 9.9.6P1-0.44.1, 9.9.9P1-28.34.1, 9.9.9P1-48.3.1, 9.9.9P1-59.1
bind-devel-32bit
9.9.6P1-0.44.1
bind-doc
9.16.20-1.4, 9.9.6P1-0.44.1, 9.9.9P1-28.34.1, 9.9.9P1-48.3.1, 9.9.9P1-59.1
bind-libs
32:9.8.2-0.37.rc1.47.amzn1, 9.9.6P1-0.44.1, 9.9.9P1-28.34.1, 9.9.9P1-48.3.1, 9.9.9P1-59.1
bind-libs-32bit
9.9.6P1-0.44.1, 9.9.9P1-28.34.1, 9.9.9P1-48.3.1, 9.9.9P1-59.1
bind-libs-x86
9.9.6P1-0.44.1
bind-lwresd
9.9.9P1-48.3.1
bind-sdb
32:9.8.2-0.37.rc1.47.amzn1
bind-utils
32:9.8.2-0.37.rc1.47.amzn1, 9.16.20-1.4, 9.9.6P1-0.44.1, 9.9.9P1-28.34.1, 9.9.9P1-48.3.1, 9.9.9P1-59.1
bind9
1:9.10.3.dfsg.P4-11, 1:9.10.3.dfsg.P4-8ubuntu1.19+esm5, 1:9.8.4.dfsg.P1-6+nmu2+deb7u11, 1:9.9.5.dfsg-3ubuntu0.19+esm9, 1:9.9.5.dfsg-9+deb8u7
bindutils
9.10.4-4.ph2, NA
python3-bind
9.16.20-1.4
rootio-bind9
1:9.10.3.dfsg.P4-11
Timeline
Publicly disclosed
Jul 19, 2016
Last updated
Aug 7, 2026
Weakness Type
- CWE-20 Improper Input Validation
References
- advisoryRHBA-2017:0651
- advisoryRHBA-2017:1767
- advisoryRHSA-2017:2533
- advisoryhttps://bugzilla.suse.com/1020983
- advisoryhttps://bugzilla.suse.com/1033466
FAQ
Common Questions.
ISC BIND 9.x before 9.9.9-P2, 9.10.x before 9.10.4-P2, and 9.11.x before 9.11.0b2, when lwresd or the named lwres option is enabled, allows remote attackers to cause a denial of service (daemon crash) via a long request that uses the lightweight resolver protocol.
Affected: Bind (Isc) versions 9.10.4, 9.10.4-beta1, 9.10.4-beta2, 9.10.4-beta3, 9.10.4-p1, 9.11.0, 9.11.0-alpha1, 9.11.0-alpha2; Fedora (Fedoraproject) versions 23, 24; Hp-Ux versions b.11.31, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Bind 32:9.8.2-0.37.rc1.47.amzn1, Bind 32:9.8.2-0.62.rc1.el6, Bind 32:9.9.4-50.el7_3.2.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2016-2775 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo