CVE-2023-2911

2023-06-2117:15:47

Google

osv.dev

bind 9

recursive-clients quota

vulnerability

stack overflow

software

cve-2023-2911

0.001 Low

EPSS

Percentile

30.8%

JSON

If the recursive-clients quota is reached on a BIND 9 resolver configured with both stale-answer-enable yes; and stale-answer-client-timeout 0;, a sequence of serve-stale-related lookups could cause named to loop and terminate unexpectedly due to a stack overflow.
This issue affects BIND 9 versions 9.16.33 through 9.16.41, 9.18.7 through 9.18.15, 9.16.33-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.

CPENameOperatorVersion
bindeq9.11.1-r1
bindeq9.14.1-r1
bindeq9.10.0_p2-r1
bindeq9.10.2_p3-r1
bindeq9.10.3_p3-r1
bindeq9.8.0-r1
bindeq9.16.15-r1
bindeq9.10.2-r1
bindeq9.9.3_p2-r1
bindeq9.12.3-r1

Name	Operator	Version
bind	eq	9.11.1-r1
bind	eq	9.14.1-r1
bind	eq	9.10.0_p2-r1
bind	eq	9.10.2_p3-r1
bind	eq	9.10.3_p3-r1
bind	eq	9.8.0-r1
bind	eq	9.16.15-r1
bind	eq	9.10.2-r1
bind	eq	9.9.3_p2-r1
bind	eq	9.12.3-r1