CVE-2024-1737

A flaw was found in the bind9 package, where a hostname with significant resource records may slow down bind's resolver cache and authoritative zone databases while these records are being added or updated. In addition, client queries for the related hostname may cause the same issue. This vulnerability may lead to a denial of service.

The identified flaw in the bind9 package represents a significant severity issue due to its potential to disrupt DNS resolution services. Specifically, a hostname with an extensive number of resource records can substantially degrade the performance of bind's resolver cache and authoritative zone databases. This degradation occurs during the addition or updating of these records, and is further exacerbated by client queries, which can lead to resource exhaustion. Consequently, the system may experience increased latency or complete unavailability of DNS services, resulting in a Denial of Service (DoS).

The DHCP package as shipped with Red Hat Enterprise 9 is not affected by this vulnerability. Although the DHCP binary ships bundled versions of bind libraries, the DHCP application uses its own routines to DDNS and configuration meaning the affected code is not reachable through it.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.