CVE-2024-11187

A flaw was found in the bind package where a crafted DNS zone may generate numerous records in the 'Additional' section of the response. This flaw allows an attacker to send a large amount of such queries, which may lead either the authoritative server or an independent resolver to run into an uncontrolled CPU resource scenario, ultimately resulting in the server not being able to attend new requests and causing a denial of service as a consequence.

The bind package as shipped by Red Hat does not by default set the option minimal-responses yes; in the configuration file.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Users can set the option minimal-responses yes;in the configuration file located at /etc/named.confto mitigate this vulnerability.