CVE-2023-2828 named's configured cache size limit can be significantly exceeded

What is CVE-2023-2828?

CVE-2023-2828 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 21 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Every `named` instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to authoritative servers. The size limit for that cache database can be configured using the `max-cache-size` statement in the configuration file; it defaults to 90% of the total amount of memory available on the host. When the size of the cache reaches 7/8 of the configured limit, a cache-cleaning algorithm starts to remove expired and/or least-recently used RRsets from the cache, to keep memory use below the configured limit.

It has been discovered that the effectiveness of the cache-cleaning algorithm used in `named` can be severely diminished by querying the resolver for specific RRsets in a certain order, effectively allowing the configured `max-cache-size` limit to be significantly exceeded. This issue affects BIND 9 versions 9.11.0 through 9.16.41, 9.18.0 through 9.18.15, 9.19.0 through 9.19.13, 9.11.3-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.

Weakness: CWE-770

Which versions are affected by CVE-2023-2828?

It affects 9 products.

Products include Debian Debian Linux, Fedoraproject Fedora, Isc Bind, Netapp Active Iq Unified Manager, Netapp H300s Firmware, Netapp H410c Firmware and 3 more.

How do I fix CVE-2023-2828?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-2828 being exploited?

There is no known exploitation of CVE-2023-2828 in the wild and no public exploit code.

Other vulnerabilities in Debian Debian Linux

• CVE-2015-3306 ProFTPD Improper Access Control Exploited Critical 10.0
• CVE-2025-49113 RoundCube Webmail Deserialization of Untrusted Data Exploited Critical 9.9
• CVE-2026-24061 GNU InetUtils Argument Injection Exploited Critical 9.8
• CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions Exploited Critical 9.8
• CVE-2024-9680 Mozilla Firefox Use-After-Free Exploited Critical 9.8

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALSA-2023:4099, ALSA-2023:4100, ALSA-2023:4102, AZL-27203, AZL-27238, CLSA-2023-1688677755 and 28 more.