CLSA-2026-1786523775
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1786523775.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1786523775
- Upstream
- Published
- 2026-08-13T12:38:43Z
- Modified
- 2026-10-26T09:31:42Z
- Summary
- bind: Fix of 2 CVEs
- Details
-
- CVE-2023-6516: bound the memory used to queue RBTDB tree-pruning events, so that recursive query patterns which continuously trigger cache-database maintenance can no longer exceed max-cache-size and exhaust host memory (DoS)
- CVE-2023-6516 follow-up: make the tree-pruning queue per-node-lock bucketed and process it in quanta, so that the queue introduced above does not starve cache cleanup under load and let cache memory grow without bound
- CVE-2023-6516 follow-up: handle a node being re-queued for tree pruning gracefully instead of asserting, and do not append a parent to a pruning list it is already on, avoiding an assertion failure (DoS) and pruning-list corruption reachable through normal cache activity
- CVE-2023-6516 follow-up: adopt the pruning design upstream settled on in 9.16.49 - run tree pruning on a dedicated task with an unlimited quantum instead of sharing the quantum-1 cache database task, clean every eligible ancestor in a single pass, and re-create both tasks when the cache is flushed so that pruning keeps working after "rndc flush"
- References