CVE-2024-12705highCWE-770

CVE-2024-12705: high-severity vulnerability in ISC BIND 9

DNS-over-HTTPS implementation suffers from multiple issues under heavy query load

Published · Updated

Follow this CVE+ Monitor BIND+ Monitor bind9

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

26Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 18%
In short

A DNS resolver using DNS-over-HTTPS (DoH) can be overwhelmed by attackers sending large amounts of crafted HTTP/2 traffic, causing the resolver to run out of CPU and memory resources. This makes the DNS service unavailable to legitimate users.

Technical detail

The vulnerability exists in BIND 9's DoH implementation, allowing unauthenticated remote attackers to exhaust server resources through HTTP/2 traffic flooding with valid or invalid DNS queries. The attack requires no authentication and impacts resource availability, affecting BIND versions 9.18.0-9.18.32, 9.20.0-9.20.4, 9.21.0-9.21.3, and 9.18.11-S1 through 9.18.32-S1.

Summary generated and translated by AI from the official description.
Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic. This issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
ISC · BIND 9
Related CVEs — ISC BIND 9

In the same product, most dangerous first.

CVE-2018-5740HIGHA flaw in the "deny-answer-aliases" feature can cause an assertion failure in namedEPSS 60.2%CVE-2022-3736HIGHnamed configured to answer from stale cache may terminate unexpectedly while processing RRSIG queriesEPSS 48.4%CVE-2017-3145HIGHImproper fetch cleanup sequencing in the resolver can cause named to crashEPSS 27.7%CVE-2022-3488HIGHnamed may terminate unexpectedly when processing ECS options in repeated responses to iterative queriesEPSS 19.0%CVE-2017-3143HIGHAn error in TSIG authentication can permit unauthorized dynamic updatesEPSS 18.2%CVE-2017-3135HIGHCombination of DNS64 and RPZ Can Lead to CrashEPSS 17.1%