Critical CPU Exhaustion Vulnerability in BIND Package
Summary
ALSA-2025:1681: Important: bind security update. Affects bind versions < 32:9.16.23-24.el9_5.3. Fixed in 32:9.16.23-24.el9_5.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Berkeley Internet Name Domain (BIND) is a widely used implementation of the Domain Name System (DNS) protocols, which includes a DNS server (named), a resolver library for application interfacing, and various tools for DNS server verification. BIND is crucial for translating domain names into IP addresses, enabling users to access websites and services. However, it is susceptible to vulnerabilities that can compromise its performance and security.
Vulnerability Detail
The vulnerability identified as CVE-2024-11187 affects the BIND package, specifically bind9. It allows for CPU exhaustion when many records are present in the additional section of DNS responses. This can lead to denial of service, severely impacting the availability of services relying on BIND for DNS resolution. The issue arises from improper handling of DNS records, which can be exploited by attackers to overload the server, causing it to become unresponsive.
How To Fix
Minimum fixed version
32:9.16.23-24.el9_5.3
This is the first release that contains the fix.
sudo dnf update bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the number of DNS queries processed by the server or implement rate limiting to mitigate the impact of potential attacks. However, the best course of action is to apply the security update as soon as possible.
Conclusion
The BIND package is essential for DNS operations, but it is vulnerable to a critical CPU exhaustion issue (CVE-2024-11187). It is crucial to update to the patched version to maintain the security and availability of your services. Utilizing tools like Vulert can help monitor for vulnerabilities in your applications.
See every vulnerability recorded for bind →
FAQ
CVE-2024-11187 is a vulnerability in the BIND package that can lead to CPU exhaustion due to excessive DNS records in responses.
Exploitation of this vulnerability can result in denial of service, making your DNS services unavailable and affecting all applications relying on them.
Yes, the patched version of the BIND package is 32:9.16.23-24.el9_5.3. Updating to this version will resolve the issue.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If immediate updating is not possible, consider implementing rate limiting on your DNS server to reduce the risk of exploitation until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
