Critical CPU Exhaustion Vulnerability in BIND Package - ALSA-2025:1675
Summary
ALSA-2025:1675: Important: bind security update. Affects bind versions < 32:9.11.36-16.el8_10.4. Fixed in 32:9.11.36-16.el8_10.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Berkeley Internet Name Domain (BIND) is a widely used implementation of the Domain Name System (DNS) protocols. It includes a DNS server (named), a resolver library for applications, and various tools for DNS server verification. BIND is crucial for translating domain names into IP addresses, making it a backbone of internet functionality. This vulnerability affects multiple BIND-related packages in AlmaLinux 8, which could lead to significant performance degradation.
Vulnerability Detail
The vulnerability identified as CVE-2024-11187 allows for CPU exhaustion due to many records in the additional section of DNS responses. This can be exploited by an attacker to overwhelm the DNS server, leading to denial of service. The issue arises from improper handling of certain DNS records, which can cause excessive CPU usage, potentially bringing down the server and affecting all services relying on it.
How To Fix
Minimum fixed version
32:9.11.36-16.el8_10.4
This is the first release that contains the fix.
sudo dnf update bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the number of DNS queries processed by the server or implement rate limiting to mitigate the impact of this vulnerability until a patch is applied. However, the best course of action is to update to the patched version as soon as possible.
Conclusion
The BIND package vulnerability (CVE-2024-11187) poses a significant risk of CPU exhaustion, which can lead to denial of service. It is crucial to update to the patched version to safeguard your systems. Monitoring tools like Vulert can assist in identifying vulnerabilities in real-time.
See every vulnerability recorded for bind →
FAQ
CVE-2024-11187 is a vulnerability in BIND that allows for CPU exhaustion, potentially leading to denial of service.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which requires no signup.
Failure to fix this vulnerability can lead to server downtime, affecting all services that rely on the DNS server.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If you cannot update immediately, consider implementing rate limiting on your DNS server to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
