Loading story…
Red Hat addressed CVE-2024-11187, an Important BIND 9 denial-of-service flaw in which specially constructed DNS zones can cause responses to contain excessive Additional-section records. Attackers able to repeatedly query those records can drive disproportionate CPU consumption on authoritative DNS servers or independent resolvers; exploitation generally depends on a zone deliberately built to trigger the condition.
The fix was shipped in Red Hat OpenShift Container Platform releases including 4.17.19 and 4.16.37. The 4.16.37 update also remediates CVE-2024-12705, covering several DNS-over-HTTPS issues under heavy query load. Red Hat recommends that affected OpenShift deployments upgrade through their applicable release channels using the OpenShift CLI or web console.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Red Hat published RHSA-2025:1912, an Important security advisory releasing OpenShift Container Platform 4.17.19 container images. The release fixes CVE-2024-11187 in BIND 9, where DNS messages with many Additional-section records can cause CPU exhaustion.
Red Hat published RHSA-2025:1907, an Important security advisory releasing OpenShift Container Platform 4.16.37 container images. The update fixes BIND 9 CPU-exhaustion flaw CVE-2024-11187 and DNS-over-HTTPS issues tracked as CVE-2024-12705.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Important security updates for BIND addressing **CVE-2024-1975** and **CVE-2024-1737**, denial-of-service flaws affecting DNS resolvers and authoritative servers. CVE-2024-1975 allows clients to exhaust CPU resources with streams of SIG(0)-signed requests when a server hosts a `KEY` record or a validating resolver has cached one. CVE-2024-1737 causes severe database and query-performance degradation when a single hostname contains very large numbers of resource records. Affected upstream BIND releases include 9.11 through 9.11.37, 9.16 through 9.16.50, 9.18 through 9.18.27, and 9.19 through 9.19.24, with CVE-2024-1975 also affecting releases from 9.0.0 onward. The fixes are available across supported RHEL 8 and RHEL 9 update channels and OpenShift Container Platform 4.12 through 4.16. Red Hat advisories provide updated packages including `9.11.36-16.el8_10.2` for RHEL 8, `9.11.36-8.el8_8.6` for RHEL 8.8 channels, and `9.16.23-11.el9_2.5` for RHEL 9.2; selected RHEL 8.6 and RHEL 9.2 channels also remediate **CVE-2024-4076**, an assertion-failure condition when serving stale cache data and authoritative-zone content. Organizations should apply the applicable BIND updates promptly, prioritizing exposed recursive resolvers and authoritative DNS infrastructure.
Aug 27, 2026
**CVE-2024-4076** is a denial-of-service vulnerability in BIND 9 in which a client query can trigger an assertion failure when the server simultaneously serves stale cached data and performs a lookup against local authoritative zone content. The resulting crash can terminate DNS service; Red Hat rates the issue as Important with a CVSS v3.1 score of 7.5, citing network exploitability, no required privileges or user interaction, and high availability impact. Affected upstream versions are BIND 9.16.13–9.16.50, 9.18.0–9.18.27, and 9.19.0–9.19.24. Red Hat issued security errata for affected Red Hat Enterprise Linux 8 and 9 package streams and OpenShift Container Platform 4.13–4.16, and reports no qualifying standalone mitigation; organizations should apply the relevant updated BIND packages. The flaw is an instance of **CWE-617: Reachable Assertion**, where attacker-controlled input reaches an assertion condition and causes an availability-impacting process termination.
Aug 27, 2026
**ISC disclosed a high-severity denial-of-service vulnerability in BIND 9** tracked as **CVE-2025-13878**, where remote attackers can crash the `named` daemon by sending specially crafted DNS traffic that triggers improper handling of malformed **BRID** and **HHIT** record data structures. The issue is remotely exploitable (no authentication or user interaction required) and is scored **CVSS 3.1: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)**, making publicly exposed DNS infrastructure a primary risk. The flaw affects both **authoritative name servers and DNS resolvers**, enabling an attacker to force a service outage by causing `named` to terminate unexpectedly. Reported affected versions include **BIND 9.18.40–9.18.43**, **9.20.13–9.20.17**, and **9.21.12–9.21.16**, with fixes available in **9.18.44**, **9.20.18**, and **9.21.17** (and corresponding *SPE* preview builds). The vulnerability was reported by **Vlatko Kosturjak (Marlink Cyber)**, and ISC issued early notification ahead of public disclosure, urging administrators to verify deployed versions and apply patched releases to prevent remote crash/DoS conditions.
Jun 29, 2026