CVE-2018-5738

Change #4777 (introduced in October 2017) introduced an unforeseen issue in releases which were issued after that date, affecting which clients are permitted to make recursive queries to a BIND nameserver. The intended (and documented) behavior is that if an operator has not specified a value for the "allow-recursion" setting, it SHOULD default to one of the following: none, if "recursion no;" is set in named.conf; a value inherited from the "allow-query-cache" or "allow-query" settings IF "recursion yes;" (the default for that setting) AND match lists are explicitly set for "allow-query-cache" or "allow-query" (see the BIND9 Administrative Reference Manual section 6.2 for more details); or the intended default of "allow-recursion {localhost; localnets;};" if "recursion yes;" is in effect and no values are explicitly set for "allow-query-cache" or "allow-query". However, because of the regression introduced by change #4777, it is possible when "recursion yes;" is in effect and no match list values are provided for "allow-query-cache" or "allow-query" for the setting of "allow-recursion" to inherit a setting of all hosts from the "allow-query" setting default, improperly permitting recursion to all clients. Affects BIND 9.9.12, 9.10.7, 9.11.3, 9.12.0->9.12.1-P2, the development release 9.13.0, and also releases 9.9.12-S1, 9.10.7-S1, 9.11.3-S1, and 9.11.3-S2 from BIND 9 Supported Preview Edition.

• CWE-200

• http://www.securitytracker.com/id/1041115Third Party Advisory, VDB Entry
• https://kb.isc.org/docs/aa-01616Mitigation, Vendor Advisory
• https://security.gentoo.org/glsa/201903-13Third Party Advisory
• https://security.netapp.com/advisory/ntap-20190830-0002/
• https://usn.ubuntu.com/3683-1/Third Party Advisory
• http://www.securitytracker.com/id/1041115Third Party Advisory, VDB Entry
• https://kb.isc.org/docs/aa-01616Mitigation, Vendor Advisory
• https://security.gentoo.org/glsa/201903-13Third Party Advisory
• https://security.netapp.com/advisory/ntap-20190830-0002/
• https://usn.ubuntu.com/3683-1/Third Party Advisory

Published

Jan 16, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-5732Failure to properly bounds-check a buffer used for processin…7.5
• CVE-2018-5733A malicious client which is allowed to send very large amoun…7.5
• CVE-2018-5734While handling a particular type of malformed packet BIND er…7.5
• CVE-2018-5735The Debian backport of the fix for CVE-2017-3137 leads to as…7.5
• CVE-2018-5736An error in zone database reference counting can lead to an …
• CVE-2018-5737A problem with the implementation of the new serve-stale fea…5.9
• CVE-2018-5739An extension to hooks capabilities which debuted in Kea 1.4.…6.5
• CVE-2018-5740"deny-answer-aliases" is a little-used feature intended to h…7.5
• CVE-2018-5741To provide fine-grained controls over the ability to use Dyn…6.5
• CVE-2018-5742While backporting a feature for a newer branch of BIND9, Red…7.5
• CVE-2018-5743By design, BIND is intended to limit the number of TCP clien…7.5
• CVE-2018-5744A failure to free memory can occur when processing messages …7.5