CVE-2024-0760

A flaw was found in the bind9 package, where a malicious client may send many DNS messages over the TCP protocol, leading to instabilities on the server side and potentially causing a denial of service. The server will recover automatically once the attack ceases.

This vulnerability does not affect the bind and dhcp versions as shipped with Red Hat Enterprise Linux 6, 7, 8 and 9. The bind versions vulnerable to this flaw are 9.18.1 to 9.18.27 and 9.19.0 to 9.19.24, while the most recent bind version in Red Hat Enterprise Linux 9 is bind-9.16.26-11.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.