CVE-2024-12705
Published: 29 January 2025
Summary
CVE-2024-12705 is a high-severity Allocation of Resources Without Limits or Throttling (CWE-770) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 9.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly implements denial-of-service protections to prevent resource exhaustion from HTTP/2 traffic floods targeting the BIND DoH endpoint.
Enforces resource availability protections to mitigate CPU and memory depletion caused by unthrottled HTTP/2 requests in BIND 9.
Ensures timely flaw remediation through patching of the specific BIND 9 DoH vulnerability across affected versions.
NVD Description
Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic. This issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through…
more
9.18.32-S1.
Deeper analysisAI
CVE-2024-12705 is a denial-of-service vulnerability in BIND 9 that allows clients using DNS-over-HTTPS (DoH) to exhaust a DNS resolver's CPU and/or memory resources by flooding it with crafted valid or invalid HTTP/2 traffic. The issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1. It is associated with CWE-770 (Allocation of Resources Without Limits or Throttling) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Remote attackers can exploit this vulnerability without authentication or user interaction by sending HTTP/2 traffic to the DoH endpoint of an affected BIND resolver. Successful exploitation leads to resource exhaustion, causing high-impact denial of service that disrupts DNS resolution services.
Mitigation details are available in the ISC knowledge base advisory at https://kb.isc.org/docs/cve-2024-12705 and the NetApp security advisory at https://security.netapp.com/advisory/ntap-20250207-0003/. Security practitioners should consult these resources for patch information and recommended actions.
Details
- CWE(s)