CVE-2024-12705: 
Rocky Linux vulnerability analysis and mitigation

CVE-2024-12705 is a vulnerability affecting BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1. The vulnerability was disclosed on January 29, 2025, and involves DNS-over-HTTPS (DoH) functionality where clients can exhaust a DNS resolver's CPU and/or memory resources (NVD, Ubuntu).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The issue is classified under CWE-770 (Allocation of Resources Without Limits or Throttling) and involves the exploitation of HTTP/2 traffic handling in DNS-over-HTTPS implementations (NVD).

When successfully exploited, this vulnerability can lead to Denial of Service (DoS) conditions by overwhelming the DNS resolver's CPU and/or memory resources through flooding with crafted valid or invalid HTTP/2 traffic (NetApp).

Multiple vendors have released patches to address this vulnerability. Ubuntu has fixed the issue in versions 24.10, 24.04 LTS, 22.04 LTS, and 20.04 LTS with updated packages (Ubuntu).