CVE-2022-2795

What it actually does

The flaw permits specially crafted DNS queries to trigger a crash or resource exhaustion in the BIND9 named process, resulting in denial of service.

Why it matters to the business

DNS resolution services may become unavailable, interrupting network-dependent operations for organizations using affected BIND9 versions; low urgency given modest EPSS and absence from KEV.

How an attack unfolds

An unauthenticated remote attacker sends malformed DNS queries to an exposed BIND9 server, exploiting the input-handling weakness to force a process crash without requiring authentication or prior access.

How to fix it

Upgrade org/isc-projects/bind9 (GIT) to the version containing commit 35e9c6e31dd742f501624a31c3326db1c7b460fe.

How to confirm the fix worked

Verify the running BIND9 binary or source matches the fixed commit 35e9c6e31dd742f501624a31c3326db1c7b460fe and test with known query patterns that previously triggered the crash.

Typical attack path

1. Scan for publicly reachable BIND9 instances
2. Send crafted DNS query packets
3. Observe server crash or unresponsiveness
4. Repeat queries to sustain outage

How to detect it

Review BIND9 process logs and system crash reports for unexpected named terminations; correlate with inbound DNS traffic spikes from untrusted sources.

What your security team should do

• Apply the fixed commit to all BIND9 deployments
• Restrict DNS query access to trusted networks where feasible
• Enable process monitoring and automated restarts for named