BIND Package Vulnerability: TCP Stream Handling Issue Leading to Indefinite CLOSE_WAIT State

bind Updated 02 Oct 2025

Summary

23/03/2022

Disclosed on

N/A

Severity

Yes i

Fix available

Medium

Severity

5.3

CVSS Score

ALPINE-CVE-2022-0396: BIND 9.16.11 -> 9.16.26, 9.17.0 -> 9.18.0 and versions 9.16.11-S1 -> 9.16.26-S1 of the BIND Supported Preview Edition. Affects bind versions < 9.16.27-r0. Fixed in 9.16.27-r0. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

BIND (Berkeley Internet Name Domain) is a widely used DNS server software that provides a robust and flexible solution for managing domain name resolution. It is known for its reliability and extensive feature set, making it a popular choice for both small and large organizations. However, certain versions of BIND are vulnerable to a specific issue that can cause TCP connections to remain in a CLOSE_WAIT state indefinitely, potentially leading to resource exhaustion and service disruption.

Vulnerability Detail

The vulnerability identified as CVE-2022-0396 affects BIND versions 9.16.11 to 9.16.26, 9.17.0 to 9.18.0, and versions 9.16.11-S1 to 9.16.26-S1. It arises from the handling of specifically crafted TCP streams, which can cause connections to BIND to linger in a CLOSE_WAIT status even after the client has terminated the connection. This can lead to resource exhaustion on the server, resulting in degraded performance or service outages.

How To Fix

Minimum fixed version

9.16.27-r0

This is the first release that contains the fix.

sudo apk add --upgrade bind

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

As a temporary workaround, you may consider limiting the number of simultaneous connections to the BIND server or implementing connection timeout settings to mitigate the impact of lingering CLOSE_WAIT connections. However, the best solution is to apply the patch as soon as possible.

Conclusion

In summary, CVE-2022-0396 is a significant vulnerability affecting various versions of the BIND DNS server software, which can lead to resource exhaustion due to lingering TCP connections. It is crucial to update to the patched version 9.16.27-r0 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in your software.

See every vulnerability recorded for bind →