CVE-2024-11187: Many records in the additional section cause CPU exhaustion

High severity · published Jan 29, 2025

CVE-2024-11187

Many records in the additional section cause CPU exhaustion

7.5

CVSS

15.8%

EPSS

On KEV

Description

It is possible to construct a zone such that some queries to it will generate responses containing numerous records in the Additional section. An attacker sending many such queries can cause either the authoritative server itself or an independent resolver to use disproportionate resources processing the queries. Zones will usually need to have been deliberately crafted to attack this exposure. This issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.32-S1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)15.8% · higher than 97% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

BIND 9 · ISC

9.11.0 through 9.11.37; 9.16.0 through 9.16.50; 9.18.0 through 9.18.32; 9.20.0 through 9.20.4; 9.21.0 through 9.21.3; 9.11.3-S1 through 9.11.37-S1; +2 more · source: vendor

Affected product

BIND 9

ISC

All BIND 9 CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-11187

CVE.org

https://www.cve.org/CVERecord?id=CVE-2024-11187

kb.isc.org

https://kb.isc.org/docs/cve-2024-11187

lists.debian.org

https://lists.debian.org/debian-lts-announce/2025/02/msg00011.html

security.netapp.com

https://security.netapp.com/advisory/ntap-20250207-0002/