CVE-2023-4236

A flaw in the networking code handling DNS-over-TLS queries may cause `named` to terminate unexpectedly due to an assertion failure. This happens when internal data structures are incorrectly reused under significant DNS-over-TLS query load. This issue affects BIND 9 versions 9.18.0 through 9.18.18 and 9.18.11-S1 through 9.18.18-S1.

• CWE-617

• http://www.openwall.com/lists/oss-security/2023/09/20/2Mailing List, Third Party Advisory
• https://kb.isc.org/docs/cve-2023-4236Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPJLLTJCSDJJII7IIZPLTBQNWP7MZH7F/Mailing List
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U35OARLQCPMVCBBPHWBXY5M6XJLD2TZ5/Mailing List
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSK5V4W4OHPM3JTJGWAQD6CZW7SFD75B/Mailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20231013-0004/Third Party Advisory
• https://www.debian.org/security/2023/dsa-5504Third Party Advisory
• http://www.openwall.com/lists/oss-security/2023/09/20/2Mailing List, Third Party Advisory
• https://kb.isc.org/docs/cve-2023-4236Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPJLLTJCSDJJII7IIZPLTBQNWP7MZH7F/Mailing List
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U35OARLQCPMVCBBPHWBXY5M6XJLD2TZ5/Mailing List
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSK5V4W4OHPM3JTJGWAQD6CZW7SFD75B/Mailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20231013-0004/Third Party Advisory
• https://www.debian.org/security/2023/dsa-5504Third Party Advisory

Published

Sep 20, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-42344Alkacon OpenCms before 10.5.1 allows remote unauthenticated …7.3
• CVE-2023-42345A Cross Site Scripting vulnerability in Alkacon OpenCms befo…6.1
• CVE-2023-42346Alkacon OpenCms before 16 allows XXE when the <!DOCTYPE> ref…7.5
• CVE-2023-4235A flaw was found in ofono, an Open Source Telephony on Linux…8.1
• CVE-2023-42358An issue was discovered in O-RAN Software Community ric-plt-…7.7
• CVE-2023-42359SQL injection vulnerability in Exam Form Submission in PHP w…9.8
• CVE-2023-42361Local File Inclusion vulnerability in Midori-global Better P…7.8
• CVE-2023-42362An arbitrary file upload vulnerability in Teller Web App v.4…5.4
• CVE-2023-42363A use-after-free vulnerability was discovered in xasprintf f…5.5
• CVE-2023-42364A use-after-free vulnerability in BusyBox v.1.36.1 allows at…5.5
• CVE-2023-42365A use-after-free vulnerability was discovered in BusyBox v.1…5.5
• CVE-2023-42366A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in…5.5