CVE-2019-6470

There had existed in one of the ISC BIND libraries a bug in a function that was used by dhcpd when operating in DHCPv6 mode. There was also a bug in dhcpd relating to the use of this function per its documentation, but the bug in the library function prevented this from causing any harm. All releases of dhcpd from ISC contain copies of this, and other, BIND libraries in combinations that have been tested prior to release and are known to not present issues like this. Some third-party packagers of ISC software have modified the dhcpd source, BIND source, or version matchup in ways that create the crash potential. Based on reports available to ISC, the crash probability is large and no analysis has been done on how, or even if, the probability can be manipulated by an attacker. Affects: Builds of dhcpd versions prior to version 4.4.1 when using BIND versions 9.11.2 or later, or BIND versions with specific bug fixes backported to them. ISC does not have access to comprehensive version lists for all repackagings of dhcpd that are vulnerable. In particular, builds from other vendors may also be affected. Operators are advised to consult their vendor documentation.

• https://access.redhat.com/errata/RHSA-2019:2060Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:3525Third Party Advisory
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=896122Exploit, Mailing List, Third Party Advisory
• https://lists.opensuse.org/opensuse-security-announce/2019-10/msg00048.htmlMailing List, Third Party Advisory
• https://lists.opensuse.org/opensuse-security-announce/2019-10/msg00049.htmlMailing List, Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:2060Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:3525Third Party Advisory
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=896122Exploit, Mailing List, Third Party Advisory
• https://lists.opensuse.org/opensuse-security-announce/2019-10/msg00048.htmlMailing List, Third Party Advisory
• https://lists.opensuse.org/opensuse-security-announce/2019-10/msg00049.htmlMailing List, Third Party Advisory

Published

Nov 1, 2019

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-6462An issue was discovered in cairo 1.16.0. There is an infinit…6.5
• CVE-2019-6465Controls for zone transfers may not be properly applied to D…5.3
• CVE-2019-6466Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: T…
• CVE-2019-6467A programming error in the nxdomain-redirect feature can cau…7.5
• CVE-2019-6468In BIND Supported Preview Edition, an error in the nxdomain-…7.5
• CVE-2019-6469An error in the EDNS Client Subnet (ECS) feature for recursi…7.5
• CVE-2019-6471A race condition which may occur when discarding malformed p…5.9
• CVE-2019-6472A packet containing a malformed DUID can cause the Kea DHCPv…6.5
• CVE-2019-6473An invalid hostname option can trigger an assertion failure …6.5
• CVE-2019-6474A missing check on incoming client requests can be exploited…6.5
• CVE-2019-6475Mirror zones are a BIND feature allowing recursive servers t…7.5
• CVE-2019-6476A defect in code added to support QNAME minimization can cau…7.5