CVE-2024-0760

What it actually does

A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may recover after the attack ceases. Use of ACLs will not mitigate the attack.

Why it matters to the business

Temporary disruption of DNS resolution services that can interrupt network-dependent operations until the attack stops; low EPSS with no change over 30 days and no KEV listing reduces urgency but high CVSS reflects availability risk.

How an attack unfolds

An unauthenticated remote attacker establishes TCP connections to a vulnerable DNS server and floods it with DNS messages, inducing instability for the duration of the attack; no known threat actors or ransomware use reported.

How to fix it

Upgrade affected BIND 9 installations to versions beyond 9.18.27, 9.19.24 or 9.18.27-S1; for zitadel/zitadel (GIT) apply commit 0ab0c645ef914298c343fa39cccb1290aba48bf6.

How to confirm the fix worked

Confirm the running version is newer than the listed vulnerable ranges and test server stability under simulated high-volume TCP DNS message loads.

Typical attack path

1. Identify an exposed vulnerable DNS server
2. Open multiple TCP connections
3. Send a high volume of DNS messages
4. Sustain the flood to maintain server instability

How to detect it

Review DNS server logs for sudden spikes in TCP connections or message volume from individual clients; correlate with periods of reported instability.

• Excessive DNS messages over TCP from a single client IP
• Server process entering unstable state during high TCP DNS load

What your security team should do

• Apply the indicated version or commit upgrade across all instances
• Monitor DNS TCP traffic volumes for anomalous spikes
• Document recovery procedures for post-attack server restarts