{"id":"CVE-2024-12705","aliases":["ALPINE-CVE-2024-12705","ALSA-2025:1670","AZL-56105","BELL-CVE-2024-12705","DEBIAN-CVE-2024-12705","DSA-5854-1","EUVD-2024-51062","GHSA-gf34-2fpp-vmc4","MGASA-2025-0036","OESA-2025-1105","OESA-2025-1106","RHSA-2025:1670","RLSA-2025:1670","SUSE-SU-2025:01787-1","SUSE-SU-2025:0355-1","UBUNTU-CVE-2024-12705","USN-7241-1","openSUSE-SU-2025:14719-1"],"status":"published","title":"DNS-over-HTTPS implementation suffers from multiple issues under heavy query load","description":"Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.18566,"percentile":0.97275,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2025-01-29T00:00:00Z","modified":"2026-11-02T12:00:24Z","fixes":[{"ecosystem":"Alpine:v3.18","package":"bind","fixed_in":["9.18.33-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"bind","fixed_in":["9.18.33-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"bind","fixed_in":["9.18.33-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"bind","fixed_in":["9.18.33-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"bind","fixed_in":["9.18.33-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"bind","fixed_in":["9.18.33-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"bind","fixed_in":["9.18.33-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"bind","fixed_in":["9.20.5-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"bind","fixed_in":["9.18.33-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"bind","fixed_in":["9.18.33-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"bind9","fixed_in":["1:9.18.33-1~deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"bind9","fixed_in":["1:9.20.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"bind9","fixed_in":["1:9.20.5-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"bind9","fixed_in":["1:9.18.30-0ubuntu0.20.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"bind9","fixed_in":["1:9.18.30-0ubuntu0.22.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"bind9","fixed_in":["1:9.18.30-0ubuntu0.24.04.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.18","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.18.33-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.18.33-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.18.33-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.18.33-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.18.33-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.18.33-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.18.33-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bind9.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.29-1.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bind9.18-chroot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.29-1.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bind9.18-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.29-1.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bind9.18-dnssec-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.29-1.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bind9.18-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.29-1.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bind9.18-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.29-1.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bind9.18-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.29-1.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:3","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20.5-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.18.31-r0"},{"fixed":"9.18.33-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.18.32-r0"},{"fixed":"9.18.33-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.18.33-1~deb12u2"}]}],"versions":["1:9.18.12-1","1:9.18.13-1","1:9.18.16-1","1:9.18.16-1~deb12u1","1:9.18.16-1~deb12u1~bpo11+1","1:9.18.19-1~deb12u1","1:9.18.19-1~deb12u1~bpo11+1","1:9.18.24-1","1:9.18.24-1~bpo11+1","1:9.18.28-1~deb12u1","1:9.18.28-1~deb12u2"]},{"source":"osv","ecosystem":"Debian:13","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.20.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.20.5-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.18.33-1~deb12u2"}]}],"versions":["1:9.18.12-1","1:9.18.13-1","1:9.18.16-1","1:9.18.16-1~deb12u1","1:9.18.16-1~deb12u1~bpo11+1","1:9.18.19-1~deb12u1","1:9.18.19-1~deb12u1~bpo11+1","1:9.18.24-1","1:9.18.24-1~bpo11+1","1:9.18.28-1~deb12u1","1:9.18.28-1~deb12u2"],"bundled":2},{"source":"osv","ecosystem":"Mageia:9","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.18.33-1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.18.21-4.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.18.21-4.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bind9.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.29-1.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bind9.18-chroot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.29-1.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bind9.18-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.29-1.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bind9.18-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.29-1.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bind9.18-dnssec-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.29-1.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bind9.18-dnssec-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.29-1.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bind9.18-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.29-1.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bind9.18-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.29-1.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bind9.18-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.29-1.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bind9.18-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.29-1.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"bind9.18-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.29-1.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"bind9.18-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.29-1.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"bind9.18-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.29-1.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"bind9.18-dnssec-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.29-1.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"bind9.18-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.29-1.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"bind9.18-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.29-1.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"bind9.18-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.29-1.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"bind9.18-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.29-1.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"bind9.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.18.29-1.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20.9-150700.3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20.9-150700.3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.18.33-150600.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.18.33-150600.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.18.33-150600.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"isc-dhcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.5-3ubuntu2","4.3.5-3ubuntu3","4.3.5-3ubuntu4","4.3.5-3ubuntu5","4.3.5-3ubuntu6","4.3.5-3ubuntu7","4.3.5-3ubuntu7.1","4.3.5-3ubuntu7.2","4.3.5-3ubuntu7.3","4.3.5-3ubuntu7.4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.18.30-0ubuntu0.20.04.2"}]}],"versions":["1:9.11.5.P4+dfsg-5.1ubuntu2","1:9.11.5.P4+dfsg-5.1ubuntu3","1:9.11.5.P4+dfsg-5.1ubuntu4","1:9.11.5.P4+dfsg-5.1ubuntu5","1:9.11.14+dfsg-1ubuntu1","1:9.11.14+dfsg-3ubuntu1","1:9.16.0-1ubuntu3","1:9.16.0-1ubuntu4","1:9.16.0-1ubuntu5","1:9.16.1-0ubuntu1","1:9.16.1-0ubuntu2","1:9.16.1-0ubuntu2.1","1:9.16.1-0ubuntu2.2","1:9.16.1-0ubuntu2.3","1:9.16.1-0ubuntu2.4","1:9.16.1-0ubuntu2.6","1:9.16.1-0ubuntu2.7","1:9.16.1-0ubuntu2.8","1:9.16.1-0ubuntu2.9","1:9.16.1-0ubuntu2.10","1:9.16.1-0ubuntu2.11","1:9.16.1-0ubuntu2.12","1:9.16.1-0ubuntu2.14","1:9.16.1-0ubuntu2.15","1:9.16.1-0ubuntu2.16","1:9.16.48-0ubuntu0.20.04.1","1:9.18.28-0ubuntu0.20.04.1","1:9.18.30-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"bind9-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:9.11.16+dfsg-3~build1","1:9.11.16+dfsg-3~ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.18.30-0ubuntu0.22.04.2"}]}],"versions":["1:9.16.15-1ubuntu1","1:9.16.15-1ubuntu2","1:9.16.15-1ubuntu3","1:9.18.0-2ubuntu1","1:9.18.0-2ubuntu2","1:9.18.0-2ubuntu3","1:9.18.1-1ubuntu1","1:9.18.1-1ubuntu1.1","1:9.18.1-1ubuntu1.2","1:9.18.1-1ubuntu1.3","1:9.18.12-0ubuntu0.22.04.1","1:9.18.12-0ubuntu0.22.04.2","1:9.18.12-0ubuntu0.22.04.3","1:9.18.18-0ubuntu0.22.04.1","1:9.18.18-0ubuntu0.22.04.2","1:9.18.24-0ubuntu0.22.04.1","1:9.18.28-0ubuntu0.22.04.1","1:9.18.30-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"bind9-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:9.11.19+dfsg-2.1ubuntu1","1:9.11.19+dfsg-2.1ubuntu2","1:9.11.19+dfsg-2.1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.18.30-0ubuntu0.24.04.2"}]}],"versions":["1:9.18.18-0ubuntu2","1:9.18.21-0ubuntu1","1:9.18.24-0ubuntu3","1:9.18.24-0ubuntu4","1:9.18.24-0ubuntu5","1:9.18.28-0ubuntu0.24.04.1","1:9.18.30-0ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"isc-dhcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.3-P1-2ubuntu5","4.4.3-P1-4ubuntu1","4.4.3-P1-4ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"isc-dhcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.3-P1-4ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"isc-dhcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.3-P1-4ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.18.30-0ubuntu0.20.04.2"}]}],"versions":["1:9.11.5.P4+dfsg-5.1ubuntu2","1:9.11.5.P4+dfsg-5.1ubuntu3","1:9.11.5.P4+dfsg-5.1ubuntu4","1:9.11.5.P4+dfsg-5.1ubuntu5","1:9.11.14+dfsg-1ubuntu1","1:9.11.14+dfsg-3ubuntu1","1:9.16.0-1ubuntu3","1:9.16.0-1ubuntu4","1:9.16.0-1ubuntu5","1:9.16.1-0ubuntu1","1:9.16.1-0ubuntu2","1:9.16.1-0ubuntu2.1","1:9.16.1-0ubuntu2.2","1:9.16.1-0ubuntu2.3","1:9.16.1-0ubuntu2.4","1:9.16.1-0ubuntu2.6","1:9.16.1-0ubuntu2.7","1:9.16.1-0ubuntu2.8","1:9.16.1-0ubuntu2.9","1:9.16.1-0ubuntu2.10","1:9.16.1-0ubuntu2.11","1:9.16.1-0ubuntu2.12","1:9.16.1-0ubuntu2.14","1:9.16.1-0ubuntu2.15","1:9.16.1-0ubuntu2.16","1:9.16.48-0ubuntu0.20.04.1","1:9.18.28-0ubuntu0.20.04.1","1:9.18.30-0ubuntu0.20.04.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.18.30-0ubuntu0.22.04.2"}]}],"versions":["1:9.16.15-1ubuntu1","1:9.16.15-1ubuntu2","1:9.16.15-1ubuntu3","1:9.18.0-2ubuntu1","1:9.18.0-2ubuntu2","1:9.18.0-2ubuntu3","1:9.18.1-1ubuntu1","1:9.18.1-1ubuntu1.1","1:9.18.1-1ubuntu1.2","1:9.18.1-1ubuntu1.3","1:9.18.12-0ubuntu0.22.04.1","1:9.18.12-0ubuntu0.22.04.2","1:9.18.12-0ubuntu0.22.04.3","1:9.18.18-0ubuntu0.22.04.1","1:9.18.18-0ubuntu0.22.04.2","1:9.18.24-0ubuntu0.22.04.1","1:9.18.28-0ubuntu0.22.04.1","1:9.18.30-0ubuntu0.22.04.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.18.30-0ubuntu0.24.04.2"}]}],"versions":["1:9.18.18-0ubuntu2","1:9.18.21-0ubuntu1","1:9.18.24-0ubuntu3","1:9.18.24-0ubuntu4","1:9.18.24-0ubuntu5","1:9.18.28-0ubuntu0.24.04.1","1:9.18.30-0ubuntu0.24.04.1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20.5-1.1"}]}],"bundled":2}],"products":[{"vendor":"isc","product":"bind 9"}],"references":[{"url":"https://kb.isc.org/docs/cve-2024-12705","tags":["vendor-advisory","web","article"]},{"url":"https://security.netapp.com/advisory/ntap-20250207-0003/","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12705","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20250207-0003"},{"url":"https://github.com/advisories/GHSA-gf34-2fpp-vmc4"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-12705","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:1670","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-11187","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-12705","tags":["report"]},{"url":"https://bugzilla.redhat.com/2342879","tags":["report"]},{"url":"https://bugzilla.redhat.com/2342880","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-1670.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-12705","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/advisories/BELL-SA-2025-3","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-12705","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0036.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33972","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2025/01/29/1","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1105","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11187","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1106","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2342879","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2342880","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1670.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-11187","tags":["advisory"]},{"url":"https://kb.isc.org/docs/cve-2024-11187","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-12705","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2025:1670","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501787-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1236596","tags":["report"]},{"url":"https://bugzilla.suse.com/1236597","tags":["report"]},{"url":"https://bugzilla.suse.com/1243361","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40775","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250355-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-12705","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7241-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-11187","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/U3SN2G4DQTD5LI632EWUNITUPW44ZK6V/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-12705","title":"DNS-over-HTTPS implementation suffers from multiple issues under heavy query load","description":"Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1.","status":"published","published":"2025-01-29T21:40:27.839Z","modified":"2025-02-07T17:02:44.473Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:34:12.635756Z"}],"euvd":[{"id":"EUVD-2024-51062","description":"Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1.","status":"published","published":"2025-01-29T21:40:27Z","modified":"2025-02-07T17:02:44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:04:01.828429Z"}],"ghsa":[{"id":"GHSA-gf34-2fpp-vmc4","title":"Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it...","description":"Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1.","status":"published","published":"2025-01-30T00:31:03Z","modified":"2025-02-07T18:32:19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:59:50.611216Z"}],"nvd":[{"id":"CVE-2024-12705","description":"Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1.","status":"published","published":"2025-01-29T22:15:28.8Z","modified":"2026-06-17T07:00:18.683Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:10:43.581383Z"}],"osv":[{"id":"ALPINE-CVE-2024-12705","description":"Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1.","status":"published","published":"2025-01-29T22:15:28.8Z","modified":"2026-11-02T11:17:50.062389003Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"BELL-CVE-2024-12705","status":"published","published":"2025-01-30T05:56:50.268962Z","modified":"2026-01-26T09:42:49.677801Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:19.288949Z"},{"id":"DEBIAN-CVE-2024-12705","description":"Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic. This issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1.","status":"published","published":"2025-01-29T22:15:28.8Z","modified":"2026-11-02T12:00:24.725626988Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"OESA-2025-1105","title":"bind security update","description":"BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly.\r\n\r\nSecurity Fix(es):\n\nIt is possible to construct a zone such that some queries to it will generate responses containing numerous records in the Additional section. An attacker sending many such queries can cause either the authoritative server itself or an independent resolver to use disproportionate resources processing the queries. Zones will usually need to have been deliberately crafted to attack this exposure.\nThis issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.32-S1.(CVE-2024-11187)\n\nClients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver\u0026apos;s CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1.(CVE-2024-12705)","status":"published","published":"2025-02-14T11:08:12Z","modified":"2026-08-18T01:18:46.184880412Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1106","title":"bind security update","description":"BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly.\r\n\r\nSecurity Fix(es):\n\nIt is possible to construct a zone such that some queries to it will generate responses containing numerous records in the Additional section. An attacker sending many such queries can cause either the authoritative server itself or an independent resolver to use disproportionate resources processing the queries. Zones will usually need to have been deliberately crafted to attack this exposure.\nThis issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.32-S1.(CVE-2024-11187)\n\nClients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver\u0026apos;s CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1.(CVE-2024-12705)","status":"published","published":"2025-02-14T11:08:12Z","modified":"2026-08-18T01:18:46.340270828Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"RHSA-2025:1670","title":"Red Hat Security Advisory: bind9.18 security update","status":"published","published":"2025-02-20T10:02:50Z","modified":"2026-10-14T10:08:10Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"UBUNTU-CVE-2024-12705","description":"Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic. This issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1.","status":"published","published":"2025-01-29T00:00:00Z","modified":"2026-05-20T16:16:30.981081182Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:41.555387Z"},{"id":"ALSA-2025:1670","title":"Important: bind9.18 security update","description":"BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly.  \n\nSecurity Fix(es):  \n\n  * bind: bind9: Many records in the additional section cause CPU exhaustion (CVE-2024-11187)\n  * bind: bind9: DNS-over-HTTPS implementation suffers from multiple issues under heavy query load (CVE-2024-12705)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-02-19T00:00:00Z","modified":"2026-10-29T11:32:28.261526516Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"AZL-56105","title":"CVE-2024-12705 affecting package bind for versions less than 9.20.5-1","description":"Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1.","status":"published","published":"2025-01-29T22:15:28Z","modified":"2026-04-21T04:54:06.915487Z","updated_at":"2026-11-02T15:28:06.879785Z"},{"id":"CVE-2024-12705","description":"Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1.","status":"published","published":"2025-01-29T22:15:28Z","modified":"2026-04-16T04:40:08.985251036Z","updated_at":"2026-11-02T15:44:37.917085Z"},{"id":"DSA-5854-1","title":"bind9 - security update","status":"published","published":"2025-01-29T00:00:00Z","modified":"2026-03-09T02:09:51.234076Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2025-0036","title":"Updated bind packages fix security vulnerabilities","description":"Many records in the additional section cause CPU exhaustion.\n(CVE-2024-11187)\nDNS-over-HTTPS implementation suffers from multiple issues under heavy\nquery load. (CVE-2024-12705)\n","status":"published","published":"2025-02-05T19:51:21Z","modified":"2026-04-16T04:40:41.8759963Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2025:14719-1","title":"bind-9.20.5-1.1 on GA media","description":"These are all security issues fixed in the bind-9.20.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-31T00:00:00Z","modified":"2025-05-07T18:15:41.291764Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"RLSA-2025:1670","title":"Important: bind9.18 security update","description":"BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly.\n\nSecurity Fix(es):\n\n* bind: bind9: Many records in the additional section cause CPU exhaustion (CVE-2024-11187)\n\n* bind: bind9: DNS-over-HTTPS implementation suffers from multiple issues under heavy query load (CVE-2024-12705)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-03-17T20:16:45.510776Z","modified":"2026-02-04T11:30:10.706895Z","updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"SUSE-SU-2025:01787-1","title":"Security update for bind","description":"This update for bind fixes the following issues:\n\nUpdate to version 9.20.9.\n\n- Security issues fixed:\n\n  * CVE-2025-40775: denial-of-service due to assertion failure caused by the processing of a NS message with an invalid\n    TSIG (bsc#1243361).\n  * CVE-2024-12705: CPU and memory exhaustion due to DNS-over-HTTPS issues that arise under heavy query load\n    (bsc#1236597).\n  * CVE-2024-11187: CPU exhaustion when processing queries that lead to responses containing several records in the\n    Additional data section (bsc#1236596).\n\n- Changelog:\n\n  - Feature changes:\n    * Performance optimization for NSEC3 lookups introduced in BIND 9.20.2\n      was reverted to avoid risks associated with a complex code change.\n    * The configuration clauses parental-agents and primaries are renamed\n      to remote-servers.\n    * Add none parameter to query-source and query-source-v6 to disable\n      IPv4 or IPv6 upstream queries but allow listening to queries from\n      clients on IPv4 or IPv6.\n    * dnssec-ksr now supports KSK rollovers.\n    * Print RFC 7314: EXPIRE option in transfer summary.\n    * Emit more helpful log messages for exceeding max-records-per-type.\n    * Harden key management when key files have become unavailable.\n  \n  - New Features:\n    * Add support for EDE 20 (Not Authoritative).\n    * Add support for EDE 7 and EDE 8.\n    * `dig` can now display the received BADVERS message during\n      negotiation.\n    * Add an `rndc` command to reset some statistics counters.\n    * Implement the min-transfer-rate-in configuration option.\n    * Add HTTPS record query to host command line tool.\n    * Implement sig0key-checks-limit and sig0message-checks-limit.\n    * Adds support for EDE code 1 and 2.\n    * Add an rndc command to toggle jemalloc profiling.\n    * Add support for multiple extended DNS errors.\n    * Print the expiration time of stale records.\n    * Add Extended DNS Error Code 22 - No Reachable Authority.\n    * Add a new option to configure the maximum number of outgoing queries\n      per client request.\n    * Use the Server Name Indication (SNI) extension for all outgoing TLS\n      connections.\n    * Update built-in bind.keys file with the new 2025 IANA root key.\n    * Add an initial-ds entry to bind.keys for the new root key, ID\n      38696, which is scheduled for publication in January 2025.\n  \n  - Bug Fixes:\n    * Restore NSEC3 closest-encloser lookup improvements.\n    * Stop caching lack of EDNS support.\n    * Fix resolver statistics counters for timed-out responses.\n    * Nested DNS validation could cause an assertion failure.\n    * Wait for memory reclamation to finish in `named-checkconf`.\n    * Ensure `max-clients-per-query` is at least `clients-per-query`.\n    * Fix write after free in validator code.\n    * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.\n    * Fix several small DNSSEC timing issues.\n    * Fix inconsistency in CNAME/DNAME handling during resolution.\n    * Fix dual-stack-servers configuration option.\n    * Fix a data race causing a permanent active client increase.\n    * Fix deferred validation of unsigned DS and DNSKEY records.\n    * Fix RPZ race condition during a reconfiguration.\n    * 'CNAME and other data check' not applied to all types.\n    * Relax private DNSKEY and RRSIG constraints.\n    * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().\n    * Fix TTL issue with ANY queries processed through RPZ 'passthru';.\n    * dnssec-signzone needs to check for a NULL key when setting offline.\n    * Fix a bug in the statistics channel when querying zone transfer\n      information.\n    * Fix assertion failure when dumping recursing clients.\n    * Dump the active resolver fetches from dns_resolver_dumpfetches().\n    * Recently expired records could be returned with a timestamp in\n      future.\n    * YAML string not terminated in negative response in delv.\n    * Fix a bug in dnssec-signzone related to keys being offline.\n    * Apply the memory limit only to ADB database items.\n    * Avoid unnecessary locking in the zone/cache database.\n    * Fix reporting of Extended DNS Error 22 (No Reachable Authority).\n    * Fix nsupdate hang when processing a large update.\n    * Fix possible assertion failure when reloading server while\n      processing update policy rules.\n    * Preserve cache across reconfig when using attach-cache.\n    * Resolve the spurious drops in performance due to glue cache.\n    * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked keys.\n    * Fix improper handling of unknown directives in resolv.conf.\n    * Fix response policy zones and catalog zones with an $INCLUDE\n      statement defined.\n    * Use TLS for notifies if configured to do so.\n    * Notifies configured to use TLS will now be sent over TLS, instead of\n      plain text UDP or TCP. Also, failing to load the TLS\n      configuration for notify now results in an error.'\n    * {\u0026dns} is as valid as {?dns} in a SVCB's dohpath.\n    * dig failed to parse a valid SVCB record with a dohpath URI template\n      containing a {\u0026dns}, like\n      'dohpath=/some/path?key=value{\u0026dns}';. \n    * Fix NSEC3 closest encloser lookup for names with empty non-terminals.\n    * A previous performance optimization for finding the NSEC3 closest\n      encloser when generating authoritative responses could cause servers\n      to return incorrect NSEC3 records in some cases. This has been fixed.\n    * recursive-clients statement with value 0 triggered an assertion\n      failure.\n    * BIND 9.20.0 broke recursive-clients 0;. This has now been fixed.\n    * Parsing of hostnames in rndc.conf was broken.\n    * When DSCP support was removed, parsing of hostnames in rndc.conf was\n      accidentally broken, resulting in an assertion failure. This has been\n      fixed.\n    * `dig` options of the form [+-]option=\u003cvalue\u003e failed to display\n      the value on the printed command line. This has been fixed.\n    * Provide more visibility into TLS configuration errors by logging\n      SSL_CTX_use_certificate_chain_file() and\n      SSL_CTX_use_PrivateKey_file() errors individually.\n    * Fix a race condition when canceling ADB find which could cause an\n      assertion failure.\n    * SERVFAIL cache memory cleaning is now more aggressive; it no longer\n      consumes a lot of memory if the server encounters many SERVFAILs at\n      once.\n    * Fix trying the next primary XoT server when the previous one was\n      marked as unreachable.\n    * In some cases named failed to try the next primary server in the\n      primaries list when the previous one was marked as unreachable. This\n      has been fixed.\n","status":"published","published":"2025-05-30T17:15:20Z","modified":"2025-05-31T11:59:05.793645Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:0355-1","title":"Security update for bind","description":"This update for bind fixes the following issues:\n\nUpdate to release 9.18.33\n\nSecurity Fixes:\n\n- CVE-2024-11187: Fixes CPU exhaustion caused by many records in the additional section (bsc#1236596)\n- CVE-2024-12705: Fixes multiple issues in DNS-over-HTTPS implementation when under heavy query load (bsc#1236597)\n","status":"published","published":"2025-02-04T12:59:26Z","modified":"2026-02-04T03:48:09.697246Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"USN-7241-1","title":"bind9 vulnerabilities","description":"Toshifumi Sakaguchi discovered that Bind incorrectly handled many records\nin the additional section. A remote attacker could possibly use this issue\nto cause Bind to consume CPU resources, leading to a denial of service.\n(CVE-2024-11187)\n\nJean-François Billaud discovered that the Bind DNS-over-HTTPS\nimplementation incorrectly handled a heavy query load. A remote attacker\ncould possibly use this issue to cause Bind to consume resources, leading\nto a denial of service. (CVE-2024-12705)\n","status":"published","published":"2025-01-29T17:33:42Z","modified":"2026-04-27T17:42:53.616342Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}