Loading story…
Red Hat released Important security updates for BIND addressing CVE-2024-1975 and CVE-2024-1737, denial-of-service flaws affecting DNS resolvers and authoritative servers. CVE-2024-1975 allows clients to exhaust CPU resources with streams of SIG(0)-signed requests when a server hosts a KEY record or a validating resolver has cached one. CVE-2024-1737 causes severe database and query-performance degradation when a single hostname contains very large numbers of resource records. Affected upstream BIND releases include 9.11 through 9.11.37, 9.16 through 9.16.50, 9.18 through 9.18.27, and 9.19 through 9.19.24, with CVE-2024-1975 also affecting releases from 9.0.0 onward.
The fixes are available across supported RHEL 8 and RHEL 9 update channels and OpenShift Container Platform 4.12 through 4.16. Red Hat advisories provide updated packages including 9.11.36-16.el8_10.2 for RHEL 8, 9.11.36-8.el8_8.6 for RHEL 8.8 channels, and 9.16.23-11.el9_2.5 for RHEL 9.2; selected RHEL 8.6 and RHEL 9.2 channels also remediate CVE-2024-4076, an assertion-failure condition when serving stale cache data and authoritative-zone content. Organizations should apply the applicable BIND updates promptly, prioritizing exposed recursive resolvers and authoritative DNS infrastructure.
See real exploitation activity before you spend the cycle.
17 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important advisory RHSA-2024:6013, releasing OpenShift Container Platform 4.15.30 images and packages for RHEL 8 and 9. The update fixed BIND CVE-2024-1737, CVE-2024-1975, and CVE-2024-4076, plus Helm CVE-2024-26147.
Red Hat issued RHSA-2024:6009, releasing OpenShift Container Platform 4.13.49 for supported RHEL 8 and RHEL 9 architectures. The Important update fixed BIND CVE-2024-1737, CVE-2024-1975, and CVE-2024-4076, along with CoreDNS CVE-2024-0874, go-retryablehttp CVE-2024-6104, and other security issues.
Red Hat issued Important advisory RHSA-2024:5930 for RHEL 7 Extended Lifecycle Support, providing bind-9.11.4-26.P2.el7_9.17 packages for x86_64, s390x, ppc64, and ppc64le. The update remediated the BIND denial-of-service vulnerabilities CVE-2024-1737 and CVE-2024-1975.
Red Hat issued Important advisory RHSA-2024:5894 for BIND on RHEL Server 7.7 Advanced Update Support for x86_64. The update supplied BIND 9.11.4-9.P2.el7_7.7 and remediated CVE-2024-1737 and CVE-2024-1975 denial-of-service vulnerabilities.
Red Hat issued Important advisory RHSA-2024:5908 for RHEL 8.6 Extended Life Cycle Long Life, AUS, TUS, and SAP update-service offerings. The update supplied BIND 9.11.36-3.el8_6.9 and remediated CVE-2024-1737 and CVE-2024-1975 denial-of-service vulnerabilities.
Red Hat issued Important advisory RHSA-2024:5907 for RHEL 9.0 update-service offerings, updating BIND to 9.16.23-1.el9_0.7 and bind-dyndb-ldap to 11.9-7.el9_0.3. The update remediated CVE-2024-1737, CVE-2024-1975, and CVE-2024-4076 for applicable SAP and four-year update-service architectures.
Red Hat issued Important advisory RHSA-2024:5871 for supported RHEL 8.4 update-service variants, supplying bind-9.11.26-4.el8_4.6 packages. The update remediated CVE-2024-1737 and CVE-2024-1975 across applicable AUS, TUS, SAP Solutions, and Extended Life Cycle Long Life channels.
Red Hat issued Important advisory RHSA-2024:5838 for RHEL 8.8 supported update channels, providing BIND version 9.11.36-8.el8_8.6. The update remediated CVE-2024-1737 and CVE-2024-1975 across EUS, TUS, SAP Solutions, and Extended Life Cycle Long Life offerings.
Red Hat issued Important advisory RHSA-2024:5813 for RHEL 9.2 support channels, updating BIND to 9.16.23-11.el9_2.5 and bind-dyndb-ldap to 11.9-8.el9_2.3. The advisory remediated CVE-2024-1737, CVE-2024-1975, and CVE-2024-4076.
Red Hat published Important advisory RHSA-2024:5655 for RHEL Server AUS 8.2 on x86_64, supplying BIND 9.11.13-6.el8_2.9. It remediated CVE-2024-1737 and CVE-2024-1975 denial-of-service risks.
Red Hat issued Important advisory RHSA-2024:5525 for RHEL 8.8 Extended Update Support and associated repositories, supplying bind9.16 9.16.23-0.14.el8_8.5. The update remediated CVE-2024-1737, CVE-2024-1975, and CVE-2024-4076 on supported RHEL 8.8 architectures and lifecycle offerings.
Red Hat published Important advisory RHSA-2024:5524 for RHEL 8, providing fixed BIND packages version 9.11.36-16.el8_10.2. The update addressed database slowdown caused by many records at one name and SIG(0)-based CPU exhaustion.
Red Hat issued Important advisory RHSA-2024:5418 for selected RHEL 8.6 support channels, updating bind9.16 to 9.16.23-0.7.el8_6.6. The update remediated CVE-2024-1737, CVE-2024-1975, and CVE-2024-4076.
Red Hat issued Important advisory RHSA-2024:5390 for RHEL 8.10, providing bind9.16 version 9.16.23-0.22.el8_10. The update remediated CVE-2024-1737, CVE-2024-1975, and CVE-2024-4076 for supported RHEL 8 architectures and RHEL 8.10 Extended Life Cycle releases.
Red Hat issued Important advisory RHSA-2024:5231 for RHEL 9, updating BIND to 9.16.23-18.el9_4.6 and bind-dyndb-ldap to 11.9-10.el9_4. The update remediated CVE-2024-1737, CVE-2024-1975, and CVE-2024-4076 across supported RHEL 9 architectures and lifecycle channels.
Red Hat stated that no mitigation meeting its deployment, applicability, and stability criteria was available for CVE-2024-1737. It also said the DHCP package in RHEL 9 is not affected because its DDNS and configuration routines do not expose the vulnerable BIND-library code path.
Red Hat issued RHSA advisories addressing CVE-2024-1737 and CVE-2024-1975 in Red Hat OpenShift Container Platform versions 4.12 through 4.16 during September 3–18, 2024.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
21 references tracked. Mallory keeps watching after this page renders.
cve.org
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat addressed **CVE-2024-11187**, an Important BIND 9 denial-of-service flaw in which specially constructed DNS zones can cause responses to contain excessive Additional-section records. Attackers able to repeatedly query those records can drive disproportionate CPU consumption on authoritative DNS servers or independent resolvers; exploitation generally depends on a zone deliberately built to trigger the condition. The fix was shipped in Red Hat OpenShift Container Platform releases including **4.17.19** and **4.16.37**. The 4.16.37 update also remediates **CVE-2024-12705**, covering several DNS-over-HTTPS issues under heavy query load. Red Hat recommends that affected OpenShift deployments upgrade through their applicable release channels using the OpenShift CLI or web console.
Aug 26, 2026
**CVE-2024-4076** is a denial-of-service vulnerability in BIND 9 in which a client query can trigger an assertion failure when the server simultaneously serves stale cached data and performs a lookup against local authoritative zone content. The resulting crash can terminate DNS service; Red Hat rates the issue as Important with a CVSS v3.1 score of 7.5, citing network exploitability, no required privileges or user interaction, and high availability impact. Affected upstream versions are BIND 9.16.13–9.16.50, 9.18.0–9.18.27, and 9.19.0–9.19.24. Red Hat issued security errata for affected Red Hat Enterprise Linux 8 and 9 package streams and OpenShift Container Platform 4.13–4.16, and reports no qualifying standalone mitigation; organizations should apply the relevant updated BIND packages. The flaw is an instance of **CWE-617: Reachable Assertion**, where attacker-controlled input reaches an assertion condition and causes an availability-impacting process termination.
Aug 27, 2026
Internet Systems Consortium disclosed **nine vulnerabilities** in **BIND 9** and released patched versions **9.20.26** and **9.21.24**. The most severe issue, **`CVE-2026-13321`** (CVSS **8.6**), allows a remotely exploitable **DNSSEC validation bypass** by accepting signed **NSEC** records whose `Next Domain Name` points outside the signer’s zone, enabling cross-zone cache poisoning with authenticated denial responses. ISC also disclosed **`CVE-2026-11721`**, a high-severity **cache poisoning** flaw tied to label-count discrepancies in **RRSIG** and wildcard synthesis, and **`CVE-2026-10723`**, which can let attackers forge authenticated **NXDOMAIN** responses for sibling zones through incorrect acceptance of child-zone **NSEC3** records. ISC said no active exploitation was known at disclosure time and reported no workaround for the affected releases. The remaining flaws include several remotely exploitable **denial-of-service** and **resource exhaustion** bugs affecting DNSSEC-validating resolvers and other BIND components. **`CVE-2026-11622`** can drive memory consumption far beyond configured limits during random-subdomain attacks against DNSSEC-signed zones, while **`CVE-2026-11605`** can force excessive CPU use by making BIND validate unnecessary but valid **RRSIG** records. **`CVE-2026-13204`**, **`CVE-2026-12617`**, and **`CVE-2026-10822`** can cause **`named`** to exit unexpectedly under specific malformed or specially ordered DNS responses, and **`CVE-2026-11331`** can bypass wildcard **RPZ CNAME** policies and also trigger a crash with overly long query names. ISC advised users of affected **9.11**, **9.18**, **9.20**, **9.21**, and Supported Preview Edition branches to upgrade to the nearest patched supported release.
Jul 23, 2026