CVE-2024-12705

Deeper analysis

CVE-2024-12705 is a denial-of-service vulnerability in the DNS-over-HTTPS (DoH) implementation of ISC BIND 9. Affected versions include 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and the corresponding subscription editions 9.18.11-S1 through 9.18.32-S1. The flaw, tracked as CWE-770, allows remote clients to exhaust resolver CPU and memory resources by sending a flood of specially crafted but syntactically valid or invalid HTTP/2 frames over a DoH connection.

An unauthenticated attacker reachable over the network can open a DoH session to a vulnerable resolver and transmit a high volume of malicious HTTP/2 traffic. Because the server performs insufficient resource accounting and throttling for these streams, the resolver’s worker threads or memory allocator can be driven to saturation, resulting in degraded service or complete unavailability for legitimate DNS clients. The issue carries a CVSS 3.1 base score of 7.5 with network attack vector and no required privileges or user interaction.

ISC’s knowledge-base article and the NetApp advisory both recommend upgrading to fixed releases once they become available and, in the interim, disabling DoH or applying network-level rate limiting and connection throttling on port 443 to reduce exposure. The EPSS score has remained flat at 0.0862 with no material increase since disclosure.