CVE-2024-12705: isc bind 9
CVSS: 7.5v3.1HighDeferred
AliasesALPINE-CVE-2024-12705UBUNTU-CVE-2024-12705DEBIAN-CVE-2024-12705CGA-g47g-rv4w-vwq9CGA-g4qq-29f8-xvpx
Published 29-01-2025Last modified 07-02-2025
Vulnerability summary
CVE-2024-12705 is a high (CVSS 7.5) vulnerability in isc bind 9. EPSS estimates a 18.37% chance of exploitation in the next 30 days, higher than 97.2% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
18.37%
0%100%
Medium · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 7 · Related 5Timeline
- 29-01-2025PublishedVulnerability first disclosed.
- 07-02-2025Last modifiedVulnerability information updated.
Description
Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic. This issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1.
CVSS metrics
5 scores · 5 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 5 agree
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
18.37%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
0.00 pp
From 18.37% on 19-09-2026
19-09-202619-10-2026
EPSS score18.37%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu3 products
- bind9< 1:9.18.30-0ubuntu0.20.04.2 | < 1:9.18.30-0ubuntu0.22.04.2 | < 1:9.18.30-0ubuntu0.24.04.2
- bind9-libsAll versions (No fix recorded)
- isc-dhcpAll versions (No fix recorded)
Alpine1 product
- bind< 9.18.33-r0
Chainguard1 product
- bind-dnssec-toolsAll versions (No fix recorded)
Debian1 product
- bind9< 1:9.18.33-1~deb12u2 | < 1:9.20.5-1
Isc1 product
- bind 9≥ 9.18.0, ≤ 9.18.32 | ≥ 9.20.0, ≤ 9.20.4 | ≥ 9.21.0, ≤ 9.21.3 | ≥ 9.18.11-S1, ≤ 9.18.32-S1
Wolfi1 product
- bind-dnssec-toolsAll versions (No fix recorded)
6 vendors · 8 products
References
8 links- kb.isc.org/docs/cve-2024-12705Vendor Advisory
