CVE-2022-2906
High
Published: 21 September 2022
Published
21 September 2022
Modified
28 May 2025
KEV Added
—
Patch
21 September 2022
CVSS Score v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score
0.0086
75.4th percentile
Risk Priority
16
60% EPSS · 20% KEV · 20% CVSS
Summary
CVE-2022-2906 is a high-severity Missing Release of Memory after Effective Lifetime (CWE-401) vulnerability in Isc Bind. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 24.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-35134
Vulnerability details
An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
isc
bind
9.18.0 — 9.18.7 · 9.19.0 — 9.19.5
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.