CVE-2018-5737 describes an assertion failure vulnerability in BIND 9.12, specifically versions 9.12.0 and 9.12.1, related to the serve-stale feature and its interaction with NSEC aggressive negative caching. This flaw can lead to operational problems such as recursion loops, excessive logging, or a denial of service, even when the serve-stale feature is nominally disabled. With a CVSS score of 7.5 (High), it presents a network-exploitable vulnerability with low attack complexity and high impact on availability. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or inclusion in CISA's KEV catalog, though it has received some community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
9.12.0CPE matchmatch criteria | cpe:2.3:a:isc:bind:9.12.0:*:*:*:*:*:*:* | ||
9.12.1CPE matchmatch criteria | cpe:2.3:a:isc:bind:9.12.1:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:netapp:data_ontap_edge:-:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.