CVE-2019-6477: With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without ...

Description

With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelining enabled. A client using a TCP-pipelined connection to a server could consume more resources than the server has been provisioned to handle. When a TCP connection with a large number of pipelined queries is closed, the load on the server releasing these multiple resources can cause it to become unresponsive, even for queries that can be answered authoritatively or from cache. (This is most likely to be perceived as an intermittent server problem).

Metrics

CVSS 3.1

7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability

4.02%

89.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-400

Affected Software

Vendor	Product	Versions	Update
Isc	Bind	>= 9.11.7, <= 9.11.12	—
Isc	Bind	>= 9.14.1, <= 9.14.7	—
Isc	Bind	>= 9.15.0, <= 9.15.5	—
Isc	Bind	9.11.5	S6
Isc	Bind	9.11.6	P1
Isc	Bind	9.11.12	S1
Isc	Bind	9.12.4	P1
Fedoraproject	Fedora	30	—
Fedoraproject	Fedora	31	—

References

Timeline

Published: Nov 26, 2019
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2019-6477?

With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelining enabled. A client using a TCP-pipelined connection to a server could consume more resources than the server has been provisioned to handle. When a TCP connection with a large number of pipelined queries is closed, the load on the server releasing these multiple resources can cause it to become unresponsive, even for queries that can be answered authoritatively or from cache. (This is most likely to be perceived as an intermittent server problem).

How severe is CVE-2019-6477?

CVE-2019-6477 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 4.02% probability of exploitation in the next 30 days.

How do I fix CVE-2019-6477?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.