CVE-2024-12705
High · 7.5CVSS
7.5
EPSS
18.4%
Published
Jan 29, 2025
CISA due date
—
The record
Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic. This issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:9 | bind9.18 | 0 | 32:9.18.29-1.el9_5.1 |
| AlmaLinux:9 | bind9.18-chroot | 0 | 32:9.18.29-1.el9_5.1 |
| AlmaLinux:9 | bind9.18-devel | 0 | 32:9.18.29-1.el9_5.1 |
| AlmaLinux:9 | bind9.18-dnssec-utils | 0 | 32:9.18.29-1.el9_5.1 |
| AlmaLinux:9 | bind9.18-doc | 0 | 32:9.18.29-1.el9_5.1 |
| AlmaLinux:9 | bind9.18-libs | 0 | 32:9.18.29-1.el9_5.1 |
| AlmaLinux:9 | bind9.18-utils | 0 | 32:9.18.29-1.el9_5.1 |
| Alpine:v3.18 | bind | 0 | 9.18.33-r0 |
| Alpine:v3.19 | bind | 0 | 9.18.33-r0 |
| Alpine:v3.20 | bind | 0 | 9.18.33-r0 |
| Alpine:v3.21 | bind | 0 | 9.18.33-r0 |
| Alpine:v3.22 | bind | 0 | 9.18.33-r0 |
| Chainguard | bind | 0 | 0 |
| Chainguard | bind-dev | 0 | 0 |
| Chainguard | bind-dnssec-root | 0 | 0 |
| Chainguard | bind-dnssec-tools | 0 | 0 |
| Chainguard | bind-doc | 0 | 0 |
| Chainguard | bind-libs | 0 | 0 |
| Chainguard | bind-plugins | 0 | 0 |
| Chainguard | bind-tools | 0 | 0 |
| Debian:11 | bind9 | 0 | No fix |
| Debian:12 | bind9 | 0 | 1:9.18.33-1~deb12u2 |
| Debian:13 | bind9 | 0 | No fix |
| Mageia:9 | bind | 0 | 9.18.33-1.mga9 |
| Rocky Linux:9 | bind9.18 | 0 | 2:9.18.29-1.el9_5.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | bind | 0 | 9.18.33-150600.3.6.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | bind | 0 | 9.20.9-150700.3.3.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP6 | bind | 0 | 9.18.33-150600.3.6.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP7 | bind | 0 | 9.20.9-150700.3.3.1 |
| Wolfi | bind | 0 | 0 |
| Wolfi | bind-dev | 0 | 0 |
| Wolfi | bind-dnssec-root | 0 | 0 |
| Wolfi | bind-dnssec-tools | 0 | 0 |
| Wolfi | bind-doc | 0 | 0 |
| Wolfi | bind-libs | 0 | 0 |
| Wolfi | bind-plugins | 0 | 0 |
| Wolfi | bind-tools | 0 | 0 |
| openSUSE:Leap 15.6 | bind | 0 | 9.18.33-150600.3.6.1 |
| openSUSE:Tumbleweed | bind | 0 | 9.20.5-1.1 |
Related vulnerabilities
- CVE-2024-11187 It is possible to construct a zone such that some queries to it will generate responses… Also affects bind9.18
- CVE-2025-40775 When an incoming DNS protocol message includes a Transaction Signature (TSIG), BIND… Also affects bind
- CVE-2024-4076 Client queries that trigger serving stale data and that also require lookups in local… Also affects bind
- CVE-2024-1737 Resolver caches and authoritative zone databases that hold significant numbers of RRs for… Also affects bind
- CVE-2024-0760 A malicious client can send many DNS messages over TCP, potentially causing the server to… Also affects bind
- CVE-2024-1975 If a server hosts a zone containing a "KEY" Resource Record, or a resolver… Also affects bind
- CVE-2023-50868 The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance… Also affects bind
- CVE-2022-2795 By flooding the target resolver with queries exploiting this flaw an attacker can… Also affects bind