CVE-2016-9778

An error in handling certain queries can cause an assertion failure when a server is using the nxdomain-redirect feature to cover a zone for which it is also providing authoritative service. A vulnerable server could be intentionally stopped by an attacker if it was using a configuration that met the criteria for the vulnerability and if the attacker could cause it to accept a query that possessed the required attributes. Please note: This vulnerability affects the "nxdomain-redirect" feature, which is one of two methods of handling NXDOMAIN redirection, and is only available in certain versions of BIND. Redirection using zones of type "redirect" is not affected by this vulnerability. Affects BIND 9.9.8-S1 -> 9.9.8-S3, 9.9.9-S1 -> 9.9.9-S6, 9.11.0-9.11.0-P1.

• CWE-388

• http://www.securityfocus.com/bid/95388Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1037582Third Party Advisory, VDB Entry
• https://kb.isc.org/article/AA-01442/Vendor Advisory
• https://security.gentoo.org/glsa/201708-01Third Party Advisory
• https://security.netapp.com/advisory/ntap-20180926-0005/Third Party Advisory
• http://www.securityfocus.com/bid/95388Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1037582Third Party Advisory, VDB Entry
• https://kb.isc.org/article/AA-01442/Vendor Advisory
• https://security.gentoo.org/glsa/201708-01Third Party Advisory
• https://security.netapp.com/advisory/ntap-20180926-0005/Third Party Advisory

Published

Jan 16, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-9772OpenAFS 1.6.19 and earlier allows remote attackers to obtain…
• CVE-2016-9773Heap-based buffer overflow in the IsPixelGray function in Ma…
• CVE-2016-9774The postinst script in the tomcat6 package before 6.0.45+dfs…
• CVE-2016-9775The postrm script in the tomcat6 package before 6.0.45+dfsg-…
• CVE-2016-9776QEMU (aka Quick Emulator) built with the ColdFire Fast Ether…5.5
• CVE-2016-9777KVM in the Linux kernel before 4.8.12, when I/O APIC is enab…7.8
• CVE-2016-9779Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-9780Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-9781Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-9782Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-9783Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-9784Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…