CVE-2023-5680 - CVE House
Back to Database
Status published Medium CVE-2023-5680

Cleaning an ECS-enabled cache may cause excessive CPU load

Vulnerability Description

If a resolver cache has a very large number of ECS records stored for the same name, the process of cleaning the cache database node for this name can significantly impair query performance. This issue affects BIND 9 versions 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-5680

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • ISC would like to thank Yann Kerherve and Ask Bjørn Hansen for bringing this vulnerability to our attention.

References

More from ISC

View All →
CVE-2025-8696
DoS attack against the Stork UI from an unauthenticated user
High 7.5
CVE-2025-8677
Resource exhaustion via malformed DNSKEY handling
High 7.5
CVE-2025-40780
Cache poisoning due to weak PRNG
High 8.6
CVE-2025-40779
Kea crash upon interaction between specific client options and subnet selection
High 7.5
CVE-2025-40778
Cache poisoning attacks with unsolicited RRs
High 8.6

Affected Vendor

Affected Software

BIND 9
Vulnerable Versions:
9.11.3-S1, 9.16.8-S1, 9.18.11-S1

Timeline

Official Publish: February 13th, 2024
Last Modified: March 17th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.