Vulnerability · Published Jan 29, 2025 · Assigned by isc
CVE-2024-11187Many records in the additional section cause CPU exhaustion
High 7.5
In plain English
A high-severity security flaw in BIND 9 from ISC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 16.0% (higher than 97% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
It is possible to construct a zone such that some queries to it will generate responses containing numerous records in the Additional section. An attacker sending many such queries can cause either the authoritative server itself or an independent resolver to use disproportionate resources processing the queries. Zones will usually need to have been deliberately crafted to attack this exposure. This issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.32-S1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | bind | 32:9.11.36-16.el8_10.4 | ALSA-2025:1675 |
| AlmaLinux:9 | bind | 32:9.16.23-24.el9_5.3 | ALSA-2025:1681 |
| AlmaLinux:8 | bind-chroot | 32:9.11.36-16.el8_10.4 | ALSA-2025:1675 |
| AlmaLinux:9 | bind-chroot | 32:9.16.23-24.el9_5.3 | ALSA-2025:1681 |
| AlmaLinux:8 | bind-devel | 32:9.11.36-16.el8_10.4 | ALSA-2025:1675 |
| AlmaLinux:9 | bind-devel | 32:9.16.23-24.el9_5.3 | ALSA-2025:1681 |
| AlmaLinux:9 | bind-dnssec-doc | 32:9.16.23-24.el9_5.3 | ALSA-2025:1681 |
| AlmaLinux:9 | bind-dnssec-utils | 32:9.16.23-24.el9_5.3 | ALSA-2025:1681 |
| AlmaLinux:9 | bind-doc | 32:9.16.23-24.el9_5.3 | ALSA-2025:1681 |
| AlmaLinux:8 | bind-export-devel | 32:9.11.36-16.el8_10.4 | ALSA-2025:1675 |
| AlmaLinux:8 | bind-export-libs | 32:9.11.36-16.el8_10.4 | ALSA-2025:1675 |
| AlmaLinux:8 | bind-libs | 32:9.11.36-16.el8_10.4 | ALSA-2025:1675 |
| AlmaLinux:9 | bind-libs | 32:9.16.23-24.el9_5.3 | ALSA-2025:1681 |
| AlmaLinux:8 | bind-libs-lite | 32:9.11.36-16.el8_10.4 | ALSA-2025:1675 |
| AlmaLinux:8 | bind-license | 32:9.11.36-16.el8_10.4 | ALSA-2025:1675 |
| AlmaLinux:9 | bind-license | 32:9.16.23-24.el9_5.3 | ALSA-2025:1681 |
| AlmaLinux:8 | bind-lite-devel | 32:9.11.36-16.el8_10.4 | ALSA-2025:1675 |
| AlmaLinux:8 | bind-pkcs11 | 32:9.11.36-16.el8_10.4 | ALSA-2025:1675 |
| AlmaLinux:8 | bind-pkcs11-devel | 32:9.11.36-16.el8_10.4 | ALSA-2025:1675 |
| AlmaLinux:8 | bind-pkcs11-libs | 32:9.11.36-16.el8_10.4 | ALSA-2025:1675 |
| AlmaLinux:8 | bind-pkcs11-utils | 32:9.11.36-16.el8_10.4 | ALSA-2025:1675 |
| AlmaLinux:8 | bind-sdb | 32:9.11.36-16.el8_10.4 | ALSA-2025:1675 |
| AlmaLinux:8 | bind-sdb-chroot | 32:9.11.36-16.el8_10.4 | ALSA-2025:1675 |
| AlmaLinux:8 | bind-utils | 32:9.11.36-16.el8_10.4 | ALSA-2025:1675 |
| AlmaLinux:9 | bind-utils | 32:9.16.23-24.el9_5.3 | ALSA-2025:1681 |
| AlmaLinux:8 | bind9.16 | 32:9.16.23-0.22.el8_10.2 | ALSA-2025:1676 |
| AlmaLinux:8 | bind9.16-chroot | 32:9.16.23-0.22.el8_10.2 | ALSA-2025:1676 |
| AlmaLinux:8 | bind9.16-devel | 32:9.16.23-0.22.el8_10.2 | ALSA-2025:1676 |
| AlmaLinux:8 | bind9.16-dnssec-utils | 32:9.16.23-0.22.el8_10.2 | ALSA-2025:1676 |
| AlmaLinux:8 | bind9.16-doc | 32:9.16.23-0.22.el8_10.2 | ALSA-2025:1676 |
| AlmaLinux:8 | bind9.16-libs | 32:9.16.23-0.22.el8_10.2 | ALSA-2025:1676 |
| AlmaLinux:8 | bind9.16-license | 32:9.16.23-0.22.el8_10.2 | ALSA-2025:1676 |
| AlmaLinux:8 | bind9.16-utils | 32:9.16.23-0.22.el8_10.2 | ALSA-2025:1676 |
| AlmaLinux:9 | bind9.18 | 32:9.18.29-1.el9_5.1 | ALSA-2025:1670 |
| AlmaLinux:9 | bind9.18-chroot | 32:9.18.29-1.el9_5.1 | ALSA-2025:1670 |
| AlmaLinux:9 | bind9.18-devel | 32:9.18.29-1.el9_5.1 | ALSA-2025:1670 |
| AlmaLinux:9 | bind9.18-dnssec-utils | 32:9.18.29-1.el9_5.1 | ALSA-2025:1670 |
| AlmaLinux:9 | bind9.18-doc | 32:9.18.29-1.el9_5.1 | ALSA-2025:1670 |
| AlmaLinux:9 | bind9.18-libs | 32:9.18.29-1.el9_5.1 | ALSA-2025:1670 |
| AlmaLinux:9 | bind9.18-utils | 32:9.18.29-1.el9_5.1 | ALSA-2025:1670 |
| AlmaLinux:8 | python3-bind | 32:9.11.36-16.el8_10.4 | ALSA-2025:1675 |
| AlmaLinux:9 | python3-bind | 32:9.16.23-24.el9_5.3 | ALSA-2025:1681 |
| AlmaLinux:8 | python3-bind9.16 | 32:9.16.23-0.22.el8_10.2 | ALSA-2025:1676 |
| Alpine:v3.20 | bind | 9.18.33-r0 | ALPINE-CVE-2024-11187 |
| Alpine:v3.21 | bind | 9.18.33-r0 | ALPINE-CVE-2024-11187 |
| Alpine:v3.22 | bind | 9.18.33-r0 | ALPINE-CVE-2024-11187 |
| Alpine:v3.23 | bind | 9.18.33-r0 | ALPINE-CVE-2024-11187 |
| Alpine:v3.24 | bind | 9.18.33-r0 | ALPINE-CVE-2024-11187 |
| Debian:12 | bind9 | 1:9.18.33-1~deb12u2 | DEBIAN-CVE-2024-11187 |
| Debian:12 | bind9 | 1:9.18.33-1~deb12u2 | DSA-5854-1 |
| Debian:13 | bind9 | 1:9.20.5-1 | DEBIAN-CVE-2024-11187 |
| Debian:14 | bind9 | 1:9.20.5-1 | DEBIAN-CVE-2024-11187 |
| Rocky Linux:8 | bind | 2:9.11.36-16.el8_10.4 | RLSA-2025:1675 |
| Rocky Linux:9 | bind | 2:9.16.23-24.el9_5.3 | RLSA-2025:1681 |
| Rocky Linux:8 | bind9.16 | 2:9.16.23-0.22.el8_10.2 | RLSA-2025:1676 |
| Rocky Linux:9 | bind9.18 | 2:9.18.29-1.el9_5.1 | RLSA-2025:1670 |
| Ubuntu:22.04:LTS | bind9 | 1:9.18.30-0ubuntu0.22.04.2 | UBUNTU-CVE-2024-11187 |
| Ubuntu:22.04:LTS | bind9 | 1:9.18.30-0ubuntu0.22.04.2 | USN-7241-1 |
| Ubuntu:24.04:LTS | bind9 | 1:9.18.30-0ubuntu0.24.04.2 | USN-7241-1 |
| Ubuntu:24.04:LTS | bind9 | 1:9.18.30-0ubuntu0.24.04.2 | UBUNTU-CVE-2024-11187 |
| Ubuntu:22.04:LTS | bind9-libs | no fix listed | UBUNTU-CVE-2024-11187 |
| Ubuntu:24.04:LTS | isc-dhcp | no fix listed | UBUNTU-CVE-2024-11187 |
| Ubuntu:25.10 | isc-dhcp | no fix listed | UBUNTU-CVE-2024-11187 |
| Ubuntu:26.04:LTS | isc-dhcp | no fix listed | UBUNTU-CVE-2024-11187 |
Affected products (as reported)
Weakness: CWE-405 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H