CVE-2024-12705

CVE-2024-12705 is a denial-of-service vulnerability in BIND 9 that allows clients using DNS-over-HTTPS (DoH) to exhaust a DNS resolver's CPU and/or memory resources by flooding it with crafted valid or invalid HTTP/2 traffic. The issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1. It is associated with CWE-770 (Allocation of Resources Without Limits or Throttling) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Remote attackers can exploit this vulnerability without authentication or user interaction by sending HTTP/2 traffic to the DoH endpoint of an affected BIND resolver. Successful exploitation leads to resource exhaustion, causing high-impact denial of service that disrupts DNS resolution services.

Mitigation details are available in the ISC knowledge base advisory at https://kb.isc.org/docs/cve-2024-12705 and the NetApp security advisory at https://security.netapp.com/advisory/ntap-20250207-0003/. Security practitioners should consult these resources for patch information and recommended actions.