CVE-2016-6170

ISC BIND through 9.9.9-P1, 9.10.x through 9.10.4-P1, and 9.11.x through 9.11.0b1 allows primary DNS servers to cause a denial of service (secondary DNS server crash) via a large AXFR response, and possibly allows IXFR servers to cause a denial of service (IXFR client crash) via a large IXFR response and allows remote authenticated users to cause a denial of service (primary DNS server crash) via a large UPDATE message.

• CWE-20

• http://www.openwall.com/lists/oss-security/2016/07/06/3Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/91611Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1036241Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=1353563Issue Tracking, Patch, Third Party Advisory
• https://github.com/sischkg/xfer-limit/blob/master/README.mdExploit, Patch, Third Party Advisory
• https://kb.isc.org/article/AA-01390Vendor Advisory
• https://kb.isc.org/article/AA-01390/169/CVE-2016-6170Vendor Advisory
• https://lists.dns-oarc.net/pipermail/dns-operations/2016-July/015058.htmlMailing List, Third Party Advisory
• https://lists.dns-oarc.net/pipermail/dns-operations/2016-July/015073.htmlMailing List, Third Party Advisory
• https://lists.dns-oarc.net/pipermail/dns-operations/2016-July/015075.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/201610-07Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/07/06/3Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/91611Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1036241Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=1353563Issue Tracking, Patch, Third Party Advisory
• https://github.com/sischkg/xfer-limit/blob/master/README.mdExploit, Patch, Third Party Advisory
• https://kb.isc.org/article/AA-01390Vendor Advisory
• https://kb.isc.org/article/AA-01390/169/CVE-2016-6170Vendor Advisory
• https://lists.dns-oarc.net/pipermail/dns-operations/2016-July/015058.htmlMailing List, Third Party Advisory
• https://lists.dns-oarc.net/pipermail/dns-operations/2016-July/015073.htmlMailing List, Third Party Advisory
• https://lists.dns-oarc.net/pipermail/dns-operations/2016-July/015075.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/201610-07Third Party Advisory

Published

Jul 6, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-6162net/core/skbuff.c in the Linux kernel 4.7-rc6 allows local u…
• CVE-2016-6163The rsvg_pattern_fix_fallback function in rsvg-paint_server.…
• CVE-2016-6164Integer overflow in the mov_build_index function in libavfor…
• CVE-2016-6167Multiple untrusted search path vulnerabilities in Putty beta…7.8
• CVE-2016-6168Use-after-free vulnerability in Foxit Reader and PhantomPDF …
• CVE-2016-6169Heap-based buffer overflow in Foxit Reader and PhantomPDF 7.…
• CVE-2016-6171Knot DNS before 2.3.0 allows remote DNS servers to cause a d…8.6
• CVE-2016-6172PowerDNS (aka pdns) Authoritative Server before 4.0.1 allows…
• CVE-2016-6173NSD before 4.1.11 allows remote DNS master servers to cause …
• CVE-2016-6174applications/core/modules/front/system/content.php in Invisi…
• CVE-2016-6175Eval injection vulnerability in php-gettext 1.0.12 and earli…
• CVE-2016-6177The Huawei OceanStor 5800 V300R003C00 has an integer overflo…