ByteOS Network

Vulnerability Details :

CVE-2023-5680

Assigner-isc

Assigner Org ID-404fd4d2-a609-4245-b543-2c944a302a22

Published At-13 Feb, 2024 | 14:05

Updated At-17 Mar, 2025 | 15:04

Cleaning an ECS-enabled cache may cause excessive CPU load

If a resolver cache has a very large number of ECS records stored for the same name, the process of cleaning the cache database node for this name can significantly impair query performance. This issue affects BIND 9 versions 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:isc

Assigner Org ID:404fd4d2-a609-4245-b543-2c944a302a22

Published At:13 Feb, 2024 | 14:05

Updated At:17 Mar, 2025 | 15:04

▼CVE Numbering Authority (CNA)

Cleaning an ECS-enabled cache may cause excessive CPU load

Affected Products

Vendor

Internet Systems Consortium, Inc.

Product

BIND 9

Default Status

unaffected

Versions

Affected

From 9.11.3-S1 through 9.11.37-S1 (custom)
From 9.16.8-S1 through 9.16.45-S1 (custom)
From 9.18.11-S1 through 9.18.21-S1 (custom)

Metrics

Version	Base score	Base severity	Vector
3.1	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Version: 3.1

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Impacts

CAPEC ID	Description
N/A	By sending specific queries to a resolver, an attacker can degrade `named`'s query-handling performance. In the worst-case scenario, a resolver can become entirely unresponsive.

CAPEC ID: N/A

Description: By sending specific queries to a resolver, an attacker can degrade `named`'s query-handling performance. In the worst-case scenario, a resolver can become entirely unresponsive.

Solutions

Upgrade to the patched release most closely related to your current version of BIND 9: 9.16.48-S1 or 9.18.24-S1.

Workarounds

There is no workaround for this issue other than disabling the ECS feature entirely.

Exploits

We are not aware of any active exploits.

Credits

ISC would like to thank Yann Kerherve and Ask Bjørn Hansen for bringing this vulnerability to our attention.

References

Hyperlink	Resource
https://kb.isc.org/docs/cve-2023-5680	vendor-advisory
https://security.netapp.com/advisory/ntap-20240503-0005/	N/A

Hyperlink: https://kb.isc.org/docs/cve-2023-5680

Resource:

vendor-advisory

Hyperlink: https://security.netapp.com/advisory/ntap-20240503-0005/

Resource: N/A

▼Authorized Data Publishers (ADP)

1. CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-noinfo	CWE-noinfo Not enough information

Type: CWE

CWE ID: CWE-noinfo

Description: CWE-noinfo Not enough information

Metrics Other Info

2. CVE Program Container

References

Hyperlink	Resource
https://kb.isc.org/docs/cve-2023-5680	vendor-advisory x_transferred
https://security.netapp.com/advisory/ntap-20240503-0005/	x_transferred

Hyperlink: https://kb.isc.org/docs/cve-2023-5680

Resource:

vendor-advisory

x_transferred

Hyperlink: https://security.netapp.com/advisory/ntap-20240503-0005/

Resource:

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:security-officer@isc.org

Published At:13 Feb, 2024 | 14:15

Updated At:22 Oct, 2024 | 13:53

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Type: Primary

Version: 3.1

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CPE Matches

Internet Systems Consortium, Inc.

>>bind>>9.11.3

cpe:2.3:a:isc:bind:9.11.3:s1:*:*:supported_preview:*:*:*

Internet Systems Consortium, Inc.

>>bind>>9.11.3

cpe:2.3:a:isc:bind:9.11.3:s4:*:*:supported_preview:*:*:*

Internet Systems Consortium, Inc.

>>bind>>9.11.4

cpe:2.3:a:isc:bind:9.11.4:s1:*:*:supported_preview:*:*:*

Internet Systems Consortium, Inc.

>>bind>>9.11.5

cpe:2.3:a:isc:bind:9.11.5:s3:*:*:supported_preview:*:*:*

Internet Systems Consortium, Inc.

>>bind>>9.11.5

cpe:2.3:a:isc:bind:9.11.5:s5:*:*:supported_preview:*:*:*

Internet Systems Consortium, Inc.

>>bind>>9.11.5

cpe:2.3:a:isc:bind:9.11.5:s6:*:*:supported_preview:*:*:*

Internet Systems Consortium, Inc.

>>bind>>9.11.6

cpe:2.3:a:isc:bind:9.11.6:s1:*:*:supported_preview:*:*:*

Internet Systems Consortium, Inc.

>>bind>>9.11.7

cpe:2.3:a:isc:bind:9.11.7:s1:*:*:supported_preview:*:*:*

Internet Systems Consortium, Inc.

>>bind>>9.11.8

cpe:2.3:a:isc:bind:9.11.8:s1:*:*:supported_preview:*:*:*

Internet Systems Consortium, Inc.

>>bind>>9.11.12

cpe:2.3:a:isc:bind:9.11.12:s1:*:*:supported_preview:*:*:*

Internet Systems Consortium, Inc.

>>bind>>9.11.21

cpe:2.3:a:isc:bind:9.11.21:s1:*:*:supported_preview:*:*:*

Internet Systems Consortium, Inc.

>>bind>>9.11.27

cpe:2.3:a:isc:bind:9.11.27:s1:*:*:supported_preview:*:*:*

Internet Systems Consortium, Inc.

>>bind>>9.11.29

cpe:2.3:a:isc:bind:9.11.29:s1:*:*:supported_preview:*:*:*

Internet Systems Consortium, Inc.

>>bind>>9.11.35

cpe:2.3:a:isc:bind:9.11.35:s1:*:*:supported_preview:*:*:*

Internet Systems Consortium, Inc.

>>bind>>9.11.37

cpe:2.3:a:isc:bind:9.11.37:s1:*:*:supported_preview:*:*:*

Internet Systems Consortium, Inc.

>>bind>>9.16.8

cpe:2.3:a:isc:bind:9.16.8:s1:*:*:supported_preview:*:*:*

Internet Systems Consortium, Inc.

>>bind>>9.16.11

cpe:2.3:a:isc:bind:9.16.11:s1:*:*:supported_preview:*:*:*

Internet Systems Consortium, Inc.

>>bind>>9.16.12

cpe:2.3:a:isc:bind:9.16.12:s1:*:*:supported_preview:*:*:*

Internet Systems Consortium, Inc.

>>bind>>9.16.13

cpe:2.3:a:isc:bind:9.16.13:s1:*:*:supported_preview:*:*:*

Internet Systems Consortium, Inc.

>>bind>>9.16.14

cpe:2.3:a:isc:bind:9.16.14:s1:*:*:supported_preview:*:*:*

Internet Systems Consortium, Inc.

>>bind>>9.16.21

cpe:2.3:a:isc:bind:9.16.21:s1:*:*:supported_preview:*:*:*

Internet Systems Consortium, Inc.

>>bind>>9.16.32

cpe:2.3:a:isc:bind:9.16.32:s1:*:*:supported_preview:*:*:*

Internet Systems Consortium, Inc.

>>bind>>9.16.36

cpe:2.3:a:isc:bind:9.16.36:s1:*:*:supported_preview:*:*:*

Internet Systems Consortium, Inc.

>>bind>>9.16.43

cpe:2.3:a:isc:bind:9.16.43:s1:*:*:supported_preview:*:*:*

Internet Systems Consortium, Inc.

>>bind>>9.18.11

cpe:2.3:a:isc:bind:9.18.11:s1:*:*:supported_preview:*:*:*

Internet Systems Consortium, Inc.

>>bind>>9.18.18

cpe:2.3:a:isc:bind:9.18.18:s1:*:*:supported_preview:*:*:*

Internet Systems Consortium, Inc.

>>bind>>9.18.21

cpe:2.3:a:isc:bind:9.18.21:s1:*:*:supported_preview:*:*:*

NetApp, Inc.

>>active_iq_unified_manager>>-

cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://kb.isc.org/docs/cve-2023-5680	security-officer@isc.org	Vendor Advisory
https://security.netapp.com/advisory/ntap-20240503-0005/	security-officer@isc.org	Third Party Advisory

Hyperlink: https://kb.isc.org/docs/cve-2023-5680

Source: security-officer@isc.org

Resource:

Vendor Advisory

Hyperlink: https://security.netapp.com/advisory/ntap-20240503-0005/

Source: security-officer@isc.org

Resource:

Third Party Advisory

Similar CVEs

55Records found

CVE-2020-14562

Matching Score-8

Assigner-Oracle

View Details

Matching Score-8

Assigner-Oracle

CVSS Score-5.3||MEDIUM

EPSS-0.59% / 69.50%

7 Day CHG~0.00%

Published-15 Jul, 2020 | 17:34

Updated-27 Sep, 2024 | 18:40

Vulnerability in the Java SE product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Java SE: 11.0.7 and 14.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Vendor-openSUSE Oracle Corporation NetApp, Inc.Canonical Ltd.Debian GNU/Linux Fedora Project

Product-ubuntu_linux debian_linux e-series_santricity_unified_manager e-series_santricity_os_controller e-series_santricity_storage_manager fedora jdk e-series_santricity_web_services_proxy leap Java

CVE-2025-26516

Matching Score-8

Assigner-NetApp, Inc.

View Details

Matching Score-8

Assigner-NetApp, Inc.

CVSS Score-5.3||MEDIUM

EPSS-0.14% / 33.13%

7 Day CHG+0.01%

Published-19 Sep, 2025 | 18:51

Updated-23 Sep, 2025 | 14:31

CVE-2025-26516 Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)

StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are susceptible to a Denial of Service vulnerability. Successful exploit could allow an unauthenticated attacker to cause a Denial of Service on the Admin node.

Vendor-NetApp, Inc.

Product-storagegrid StorageGRID

CWE ID-CWE-405

Asymmetric Resource Consumption (Amplification)

CVE-2021-35578

Matching Score-8

Assigner-Oracle

View Details

Matching Score-8

Assigner-Oracle

CVSS Score-5.3||MEDIUM

EPSS-0.14% / 34.37%

7 Day CHG~0.00%

Published-20 Oct, 2021 | 10:50

Updated-22 Aug, 2024 | 14:44

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Vendor-Debian GNU/Linux NetApp, Inc.Oracle Corporation Fedora Project

Product-openjdk debian_linux graalvm snapmanager hci_management_node e-series_santricity_os_controller active_iq_unified_manager e-series_santricity_storage_manager fedora e-series_santricity_web_services oncommand_workflow_automation solidfire santricity_unified_manager oncommand_insight Java SE JDK and JRE graalvm_enterprise_edition java_se

CVE-2021-35561

Matching Score-8

Assigner-Oracle

View Details

Matching Score-8

Assigner-Oracle

CVSS Score-5.3||MEDIUM

EPSS-0.18% / 38.84%

7 Day CHG~0.00%

Published-20 Oct, 2021 | 10:50

Updated-25 Sep, 2024 | 19:35

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Vendor-Debian GNU/Linux NetApp, Inc.Oracle Corporation Fedora Project

CVE-2022-21426

Matching Score-8

Assigner-Oracle

View Details

Matching Score-8

Assigner-Oracle

CVSS Score-5.3||MEDIUM

EPSS-0.06% / 19.51%

7 Day CHG~0.00%

Published-19 Apr, 2022 | 20:37

Updated-24 Sep, 2024 | 20:12

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Vendor-azul Debian GNU/Linux NetApp, Inc.Oracle Corporation

Product-solidfire_\&_hci_management_node active_iq_unified_manager jdk cloud_insights_acquisition_unit santricity_unified_manager debian_linux graalvm zulu jre e-series_santricity_os_controller 7-mode_transition_tool e-series_santricity_storage_manager e-series_santricity_web_services cloud_secure_agent solidfire\,_enterprise_sds_\&_hci_storage_node hci_compute_node_firmware oncommand_insight Java SE JDK and JRE

CVE-2023-5680

Credits

Cleaning an ECS-enabled cache may cause excessive CPU load

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs