CVE-2016-2775

What it actually does

Remote unauthenticated attacker can crash the BIND named or lwresd daemon by sending a single oversized request over the lightweight resolver protocol when that feature is enabled.

Why it matters to the business

Unexpected DNS resolver outage that disrupts name resolution for dependent services until the daemon is restarted; the age of the issue and presence in widely used packaging ecosystems increases the chance of lingering exposure in production environments.

How an attack unfolds

An attacker locates a reachable BIND instance with lwres enabled, crafts a long lightweight-resolver request, and transmits it once; the daemon crashes, producing a denial of service that requires manual or automated restart to recover.

How to fix it

Upgrade affected packages to the listed fixed versions (hey (Chainguard) 0.1.4-r10 or hey (Wolfi) 0.1.4-r10) and verify that the lwres feature is disabled unless explicitly required.

How to confirm the fix worked

Confirm the running BIND version is at or above the fixed releases, test that lwres requests of excessive length no longer crash the daemon, and review configuration to ensure lwres is not unintentionally enabled.

Typical attack path

1. Scan for exposed BIND instances listening on the lightweight resolver port
2. Send a single oversized lwres request to trigger the crash
3. Confirm service outage via failed DNS queries or monitoring alerts
4. Repeat as needed until remediation occurs

How to detect it

Review daemon logs for unexpected crashes or segmentation faults around the time of lwres traffic, correlate with network flows on the lightweight resolver port, and inspect process restart events in system logs.

What your security team should do

• Immediately upgrade all instances of the affected packages to the stated fixed versions
• Audit configurations for any use of lwres or lwresd and disable where possible
• Add the vulnerability to patch-management tracking with a short remediation window given the high EPSS score
• Monitor for any new exploit code that may appear despite the issue's age