CVE catalog

CVE-2024-11187

Bind vulnerabilities

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
15.84% · Oct 25, 2026

It is possible to construct a zone such that some queries to it will generate responses containing numerous records in the Additional section. An attacker sending many such queries can cause either the authoritative server itself or an independent resolver to use disproportionate resources processing the queries. Zones will usually need to have been deliberately crafted to attack this exposure. This issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.32-S1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianbind9sid1:9.20.30-1fixed
Debianbind9forky1:9.20.30-1fixed
Debianbind9trixie1:9.20.26-1~deb13u1fixed
Debianbind9trixie-security1:9.20.30-1~deb13u1fixed
Debianbind9bookworm1:9.18.49-1~deb12u1fixed
Debianbind9bookworm-security1:9.18.49-1~deb12u3fixed
Ubuntubind9noble1:9.18.30-0ubuntu0.24.04.2fixed
Ubuntubind9-devnoble1:9.18.30-0ubuntu0.24.04.2fixed
Ubuntubind9-dnsutilsnoble1:9.18.30-0ubuntu0.24.04.2fixed
Ubuntubind9-docnoble1:9.18.30-0ubuntu0.24.04.2fixed
Ubuntubind9-hostnoble1:9.18.30-0ubuntu0.24.04.2fixed
Ubuntubind9-libsnoble1:9.18.30-0ubuntu0.24.04.2fixed
Ubuntubind9-utilsnoble1:9.18.30-0ubuntu0.24.04.2fixed
Ubuntubind9utilsnoble1:9.18.30-0ubuntu0.24.04.2fixed
Ubuntudnsutilsnoble1:9.18.30-0ubuntu0.24.04.2fixed
Alpinebind3.189.18.33-r0fixed
Alpinebind3.199.18.33-r0fixed
Alpinebind3.209.18.33-r0fixed
Alpinebind3.219.18.33-r0fixed
Alpinebind3.229.18.33-r0fixed
Alpinebind3.239.18.33-r0fixed
Alpinebind3.249.18.33-r0fixed
Ubuntubind920.041:9.11.5.P4+dfsg-5.1ubuntu2vulnerable
Ubuntubind920.041:9.11.5.P4+dfsg-5.1ubuntu3vulnerable
Ubuntubind920.041:9.11.5.P4+dfsg-5.1ubuntu4vulnerable
Ubuntubind920.041:9.11.5.P4+dfsg-5.1ubuntu5vulnerable
Ubuntubind920.041:9.11.14+dfsg-1ubuntu1vulnerable
Ubuntubind920.041:9.11.14+dfsg-3ubuntu1vulnerable
Ubuntubind920.041:9.16.0-1ubuntu3vulnerable
Ubuntubind920.041:9.16.0-1ubuntu4vulnerable
Ubuntubind920.041:9.16.0-1ubuntu5vulnerable
Ubuntubind920.041:9.16.1-0ubuntu1vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.1vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.2vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.3vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.4vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.6vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.7vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.8vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.9vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.10vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.11vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.12vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.14vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.15vulnerable
Ubuntubind920.041:9.16.1-0ubuntu2.16vulnerable
Ubuntubind920.041:9.16.48-0ubuntu0.20.04.1vulnerable
Ubuntubind920.041:9.18.28-0ubuntu0.20.04.1vulnerable
Ubuntubind920.041:9.18.30-0ubuntu0.20.04.1vulnerable
Ubuntubind920.041:9.18.30-0ubuntu0.20.04.2fixed
Ubuntubind922.041:9.16.15-1ubuntu1vulnerable
Ubuntubind922.041:9.16.15-1ubuntu2vulnerable
Ubuntubind922.041:9.16.15-1ubuntu3vulnerable
Ubuntubind922.041:9.18.0-2ubuntu1vulnerable
Ubuntubind922.041:9.18.0-2ubuntu2vulnerable
Ubuntubind922.041:9.18.0-2ubuntu3vulnerable
Ubuntubind922.041:9.18.1-1ubuntu1vulnerable
Ubuntubind922.041:9.18.1-1ubuntu1.1vulnerable
Ubuntubind922.041:9.18.1-1ubuntu1.2vulnerable
Ubuntubind922.041:9.18.1-1ubuntu1.3vulnerable
Ubuntubind922.041:9.18.12-0ubuntu0.22.04.1vulnerable
Ubuntubind922.041:9.18.12-0ubuntu0.22.04.2vulnerable
Ubuntubind922.041:9.18.12-0ubuntu0.22.04.3vulnerable
Ubuntubind922.041:9.18.18-0ubuntu0.22.04.1vulnerable
Ubuntubind922.041:9.18.18-0ubuntu0.22.04.2vulnerable
Ubuntubind922.041:9.18.24-0ubuntu0.22.04.1vulnerable
Ubuntubind922.041:9.18.28-0ubuntu0.22.04.1vulnerable
Ubuntubind922.041:9.18.30-0ubuntu0.22.04.1vulnerable
Ubuntubind922.041:9.18.30-0ubuntu0.22.04.2fixed
Ubuntubind924.041:9.18.18-0ubuntu2vulnerable
Ubuntubind924.041:9.18.21-0ubuntu1vulnerable
Ubuntubind924.041:9.18.24-0ubuntu3vulnerable
Ubuntubind924.041:9.18.24-0ubuntu4vulnerable
Ubuntubind924.041:9.18.24-0ubuntu5vulnerable
Ubuntubind924.041:9.18.28-0ubuntu0.24.04.1vulnerable
Ubuntubind924.041:9.18.30-0ubuntu0.24.04.1vulnerable
Ubuntubind924.041:9.18.30-0ubuntu0.24.04.2fixed
Susebindmanager client tools for sle micro 59.16.6-150000.12.80.1fixed
Susebindlinux enterprise high performance computing 15 sp4-espos9.16.50-150400.5.46.1fixed
Susebindlinux enterprise high performance computing 15 sp4-ltss9.16.50-150400.5.46.1fixed
Susebindlinux enterprise server 15 sp4-ltss9.16.50-150400.5.46.1fixed
Susebindlinux enterprise server for sap applications 15 sp49.16.50-150400.5.46.1fixed
Susebindmanager proxy 4.39.16.50-150400.5.46.1fixed
Susebindmanager server 4.39.16.50-150400.5.46.1fixed
Susebindlinux enterprise module for basesystem 15 sp69.18.33-150600.3.6.1fixed
Susebindlinux enterprise module for server applications 15 sp69.18.33-150600.3.6.1fixed
Opensusebindleap 15.69.18.33-150600.3.6.1fixed
Susebindlinux enterprise server 12 sp5-ltss9.11.22-3.60.2fixed
Susebindlinux enterprise server ltss extended security 12 sp59.11.22-3.60.2fixed
Susebindlinux enterprise module for basesystem 15 sp79.20.9-150700.3.3.1fixed
Susebindlinux enterprise module for server applications 15 sp79.20.9-150700.3.3.1fixed
Opensusebindtumbleweed9.20.5-1.1fixed
Susebindlinux enterprise module for basesystem 15 sp69.16.6-150300.22.50.1fixed
Susebindlinux enterprise high performance computing 15 sp3-ltss9.16.6-150300.22.50.1fixed
Susebindlinux enterprise server 15 sp3-ltss9.16.6-150300.22.50.1fixed
Susebindlinux enterprise server for sap applications 15 sp39.16.6-150300.22.50.1fixed
Susebindenterprise storage 7.19.16.6-150300.22.50.1fixed
Susebindlinux enterprise micro 5.59.16.50-150500.8.24.1fixed
Susebindlinux enterprise high performance computing 15 sp5-espos9.16.50-150500.8.24.1fixed
Susebindlinux enterprise high performance computing 15 sp5-ltss9.16.50-150500.8.24.1fixed
Susebindlinux enterprise server 15 sp5-ltss9.16.50-150500.8.24.1fixed
Susebindlinux enterprise server for sap applications 15 sp59.16.50-150500.8.24.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianbind9sourcesid1:9.20.5-1not yet assignedNot reported[1094735]
Debianbind9sourceforky1:9.20.5-1not yet assignedNot reported[1094735]
Debianbind9sourcetrixie1:9.20.5-1not yet assignedNot reported[1094735]
Debianbind9sourcebookworm1:9.18.33-1~deb12u2not yet assignedNot reported[1094735]
Ubuntubind9debnoble1:9.18.30-0ubuntu0.24.04.2Not reportedNot reportedNot reported
Ubuntubind9-devdebnoble1:9.18.30-0ubuntu0.24.04.2Not reportedNot reportedNot reported
Ubuntubind9-dnsutilsdebnoble1:9.18.30-0ubuntu0.24.04.2Not reportedNot reportedNot reported
Ubuntubind9-docdebnoble1:9.18.30-0ubuntu0.24.04.2Not reportedNot reportedNot reported
Ubuntubind9-hostdebnoble1:9.18.30-0ubuntu0.24.04.2Not reportedNot reportedNot reported
Ubuntubind9-libsdebnoble1:9.18.30-0ubuntu0.24.04.2Not reportedNot reportedNot reported
Ubuntubind9-utilsdebnoble1:9.18.30-0ubuntu0.24.04.2Not reportedNot reportedNot reported
Ubuntubind9utilsdebnoble1:9.18.30-0ubuntu0.24.04.2Not reportedNot reportedNot reported
Ubuntudnsutilsdebnoble1:9.18.30-0ubuntu0.24.04.2Not reportedNot reportedNot reported
Alpinebindapk3.189.18.33-r0Not reportedALPINE-CVE-2024-11187Not reported
Alpinebindapk3.199.18.33-r0Not reportedALPINE-CVE-2024-11187Not reported
Alpinebindapk3.209.18.33-r0Not reportedALPINE-CVE-2024-11187Not reported
Alpinebindapk3.219.18.33-r0Not reportedALPINE-CVE-2024-11187Not reported
Alpinebindapk3.229.18.33-r0Not reportedALPINE-CVE-2024-11187Not reported
Alpinebindapk3.239.18.33-r0Not reportedALPINE-CVE-2024-11187Not reported
Alpinebindapk3.249.18.33-r0Not reportedALPINE-CVE-2024-11187Not reported
Ubuntubind9deb20.041:9.18.30-0ubuntu0.20.04.2Not reportedUSN-7241-1Not reported
Ubuntubind9deb22.041:9.18.30-0ubuntu0.22.04.2Not reportedUSN-7241-1Not reported
Ubuntubind9deb24.041:9.18.30-0ubuntu0.24.04.2Not reportedUSN-7241-1Not reported
Susebindrpmmanager client tools for sle micro 59.16.6-150000.12.80.1Not reportedSUSE-SU-2025:0337-1Not reported
Susebindrpmlinux enterprise high performance computing 15 sp4-espos9.16.50-150400.5.46.1Not reportedSUSE-SU-2025:0384-1Not reported
Susebindrpmlinux enterprise high performance computing 15 sp4-ltss9.16.50-150400.5.46.1Not reportedSUSE-SU-2025:0384-1Not reported
Susebindrpmlinux enterprise server 15 sp4-ltss9.16.50-150400.5.46.1Not reportedSUSE-SU-2025:0384-1Not reported
Susebindrpmlinux enterprise server for sap applications 15 sp49.16.50-150400.5.46.1Not reportedSUSE-SU-2025:0384-1Not reported
Susebindrpmmanager proxy 4.39.16.50-150400.5.46.1Not reportedSUSE-SU-2025:0384-1Not reported
Susebindrpmmanager server 4.39.16.50-150400.5.46.1Not reportedSUSE-SU-2025:0384-1Not reported
Susebindrpmlinux enterprise module for basesystem 15 sp69.18.33-150600.3.6.1Not reportedSUSE-SU-2025:0355-1Not reported
Susebindrpmlinux enterprise module for server applications 15 sp69.18.33-150600.3.6.1Not reportedSUSE-SU-2025:0355-1Not reported
Opensusebindrpmleap 15.69.18.33-150600.3.6.1Not reportedSUSE-SU-2025:0355-1Not reported
Susebindrpmlinux enterprise server 12 sp5-ltss9.11.22-3.60.2Not reportedSUSE-SU-2025:0389-1Not reported
Susebindrpmlinux enterprise server ltss extended security 12 sp59.11.22-3.60.2Not reportedSUSE-SU-2025:0389-1Not reported
Susebindrpmlinux enterprise module for basesystem 15 sp79.20.9-150700.3.3.1Not reportedSUSE-SU-2025:01787-1Not reported
Susebindrpmlinux enterprise module for server applications 15 sp79.20.9-150700.3.3.1Not reportedSUSE-SU-2025:01787-1Not reported
Opensusebindrpmtumbleweed9.20.5-1.1Not reportedOPENSUSE-SU-2025:14719-1Not reported
Susebindrpmlinux enterprise module for basesystem 15 sp69.16.6-150300.22.50.1Not reportedSUSE-SU-2025:0427-1Not reported
Susebindrpmlinux enterprise high performance computing 15 sp3-ltss9.16.6-150300.22.50.1Not reportedSUSE-SU-2025:0427-1Not reported
Susebindrpmlinux enterprise server 15 sp3-ltss9.16.6-150300.22.50.1Not reportedSUSE-SU-2025:0427-1Not reported
Susebindrpmlinux enterprise server for sap applications 15 sp39.16.6-150300.22.50.1Not reportedSUSE-SU-2025:0427-1Not reported
Susebindrpmenterprise storage 7.19.16.6-150300.22.50.1Not reportedSUSE-SU-2025:0427-1Not reported
Susebindrpmlinux enterprise micro 5.59.16.50-150500.8.24.1Not reportedSUSE-SU-2025:0359-1Not reported
Susebindrpmlinux enterprise high performance computing 15 sp5-espos9.16.50-150500.8.24.1Not reportedSUSE-SU-2025:0359-1Not reported
Susebindrpmlinux enterprise high performance computing 15 sp5-ltss9.16.50-150500.8.24.1Not reportedSUSE-SU-2025:0359-1Not reported
Susebindrpmlinux enterprise server 15 sp5-ltss9.16.50-150500.8.24.1Not reportedSUSE-SU-2025:0359-1Not reported
Susebindrpmlinux enterprise server for sap applications 15 sp59.16.50-150500.8.24.1Not reportedSUSE-SU-2025:0359-1Not reported

[Debian bug #1094735]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]