Description
By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.
Affected products
isc: bind; debian: debian linux; fedoraproject: fedora
References10
- kb.isc.org/docs/cve-2022-2795 PatchVendor Advisory
- kb.isc.org/docs/cve-2022-2795 PatchVendor Advisory
- www.openwall.com/lists/oss-security/2022/09/21/3 Mailing ListPatchThird Party Advisory
- www.openwall.com/lists/oss-security/2022/09/21/3 Mailing ListPatchThird Party Advisory
- lists.debian.org/debian-lts-announce/2022/10/msg00007.html Mailing ListThird Party Advisory
- lists.fedoraproject.org/archives/list/package-announce%40lists.…
- lists.fedoraproject.org/archives/list/package-announce%40lists.…
- lists.fedoraproject.org/archives/list/package-announce%40lists.…
- security.gentoo.org/glsa/202210-25 Third Party Advisory
- www.debian.org/security/2022/dsa-5235 Third Party Advisory
Metrics
- CVSS 3.1
-
5.3
MEDIUM
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - EPSS — exploit probability
- 2% percentile: 83 · as of 12 November 2026
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.