{"api_version":"1","generated_at":"2026-07-23T22:22:02+00:00","cve":"CVE-2019-6476","urls":{"html":"https://cve.report/CVE-2019-6476","api":"https://cve.report/api/cve/CVE-2019-6476.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2019-6476","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-6476"},"summary":{"title":"CVE-2019-6476","description":"A defect in code added to support QNAME minimization can cause named to exit with an assertion failure if a forwarder returns a referral rather than resolving the query. This affects BIND versions 9.14.0 up to 9.14.6, and 9.15.0 up to 9.15.4.","state":"PUBLIC","assigner":"security-officer@isc.org","published_at":"2019-10-17 20:15:00","updated_at":"2023-11-07 03:13:00"},"problem_types":["CWE-617"],"metrics":[],"references":[{"url":"https://security.netapp.com/advisory/ntap-20191024-0004/","name":"https://security.netapp.com/advisory/ntap-20191024-0004/","refsource":"CONFIRM","tags":[],"title":"October 2019 ISC BIND Vulnerabilities in NetApp Products | NetApp Product Security","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://support.f5.com/csp/article/K42238532?utm_source=f5support&amp%3Butm_medium=RSS","name":"https://support.f5.com/csp/article/K42238532?utm_source=f5support&amp%3Butm_medium=RSS","refsource":"","tags":[],"title":"myF5","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://kb.isc.org/docs/cve-2019-6476","name":"https://kb.isc.org/docs/cve-2019-6476","refsource":"CONFIRM","tags":["Third Party Advisory"],"title":"CVE-2019-6476: An error in QNAME minimization code can cause BIND to exit with an assertion failure - Security Advisories","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://support.f5.com/csp/article/K42238532?utm_source=f5support&utm_medium=RSS","name":"https://support.f5.com/csp/article/K42238532?utm_source=f5support&utm_medium=RSS","refsource":"CONFIRM","tags":[],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-6476","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-6476","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2019","cve_id":"6476","vulnerable":"1","versionEndIncluding":"9.14.6","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"isc","cpe5":"bind","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"6476","vulnerable":"1","versionEndIncluding":"9.15.4","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"isc","cpe5":"bind","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2019-6476","qid":"500056","title":"Alpine Linux Security Update for bind"},{"cve":"CVE-2019-6476","qid":"503737","title":"Alpine Linux Security Update for bind"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security-officer@isc.org","DATE_PUBLIC":"2019-10-16T17:36:53.000Z","ID":"CVE-2019-6476","STATE":"PUBLIC","TITLE":"An error in QNAME minimization code can cause BIND to exit with an assertion failure"},"affects":{"vendor":{"vendor_data":[{"vendor_name":"ISC","product":{"product_data":[{"product_name":"BIND 9","version":{"version_data":[{"version_value":"9.14.0 up to 9.14.6"},{"version_value":"9.15.0 up to 9.15.4"}]}}]}}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A defect in code added to support QNAME minimization can cause named to exit with an assertion failure if a forwarder returns a referral rather than resolving the query. This affects BIND versions 9.14.0 up to 9.14.6, and 9.15.0 up to 9.15.4."}]},"generator":{"engine":"Vulnogram 0.0.8"},"impact":{"cvss":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"An attacker who manages to deliberately trigger this condition on a server which is performing recursion can cause named to exit, denying service to clients."}]}]},"references":{"reference_data":[{"name":"https://kb.isc.org/docs/cve-2019-6476","refsource":"CONFIRM","url":"https://kb.isc.org/docs/cve-2019-6476"},{"refsource":"CONFIRM","name":"https://security.netapp.com/advisory/ntap-20191024-0004/","url":"https://security.netapp.com/advisory/ntap-20191024-0004/"},{"refsource":"CONFIRM","name":"https://support.f5.com/csp/article/K42238532?utm_source=f5support&utm_medium=RSS","url":"https://support.f5.com/csp/article/K42238532?utm_source=f5support&utm_medium=RSS"}]},"solution":[{"lang":"eng","value":"Upgrade to the patched release most closely related to your current version of BIND:\n   +  BIND 9.14.7\n   +  BIND 9.15.5\n"}],"source":{"discovery":"USER"},"work_around":[{"lang":"eng","value":"ervers which have QNAME minimization turned on are potentially vulnerable to this defect if they are running an affected version of BIND. The vulnerability can be avoided by disabling QNAME minimization using \"qname-minimization disabled;\" in the global options section of named.conf (Note: the default value for the qname-minimization setting in the 9.14 and 9.15 branches is \"relaxed\". To make use of this workaround it must be explicitly disabled.)"}]},"nvd":{"publishedDate":"2019-10-17 20:15:00","lastModifiedDate":"2023-11-07 03:13:00","problem_types":["CWE-617"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL","baseScore":5},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*","versionStartIncluding":"9.15.0","versionEndIncluding":"9.15.4","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*","versionStartIncluding":"9.14.0","versionEndIncluding":"9.14.6","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2019","CveId":"6476","Ordinal":"144185","Title":"CVE-2019-6476","CVE":"CVE-2019-6476","Year":"2019"},"notes":[{"CveYear":"2019","CveId":"6476","Ordinal":"1","NoteData":"A defect in code added to support QNAME minimization can cause named to exit with an assertion failure if a forwarder returns a referral rather than resolving the query. This affects BIND versions 9.14.0 up to 9.14.6, and 9.15.0 up to 9.15.4.","Type":"Description","Title":null},{"CveYear":"2019","CveId":"6476","Ordinal":"2","NoteData":"2019-10-17","Type":"Other","Title":"Published"},{"CveYear":"2019","CveId":"6476","Ordinal":"3","NoteData":"2019-11-19","Type":"Other","Title":"Modified"}]}}}