title: Cleaning an ECS-enabled cache may cause excessive CPU load
description: If a resolver cache has a very large number of ECS records stored for the same name, the process of cleaning the cache database node for this name can significantly impair query performance.
This issue affects BIND 9 versions 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.
affected:
{
vendor: ISC
product: BIND 9
versions:
version: 9.11.3-S1, lessThanOrEqual: 9.11.37-S1, status: affected, versionType: custom
version: 9.16.8-S1, lessThanOrEqual: 9.16.45-S1, status: affected, versionType: custom
version: 9.18.11-S1, lessThanOrEqual: 9.18.21-S1, status: affected, versionType: custom
defaultStatus: unaffected
}
metrics:
cvssV3_1: [
version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
baseScore: 5.3
baseSeverity: MEDIUM
]
exploits: We are not aware of any active exploits.
solutions: Upgrade to the patched release most closely related to your current version of BIND 9: 9.16.48-S1 or 9.18.24-S1.
workarounds: There is no workaround for this issue other than disabling the ECS feature entirely.