CVE-2024-12705

A flaw was found in BIND 9. By flooding a target resolver with HTTP/2 traffic and exploiting this flaw, an attacker could overwhelm the server, causing high CPU and/or memory usage and preventing other clients from establishing DoH connections. This issue could significantly impair the resolver's performance and effectively deny legitimate clients access to the DNS resolution service.

The bind package shipped by Red Hat by default does not enable DNS-over-HTTPS functionality.

The bind-9.11 version used in Red Hat Enterprise Linux 7 and 8 does not have any DNS-over-HTTP/HTTPS/TLS implementation and is therefore not affected.

The bind-9.16 version used in Red Hat Enterprise Linux 8 and 9 does not have any DNS-over-HTTP/HTTPS/TLS implementation and is therefore not affected by this vulnerability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If the feature is not needed, disable DNS-over-HTTPS (DoH) in your bind config. Otherwise, we recommend upgrading to a patched version of bind.