CVE-2024-33655 Denial of service in n/a
Remote attackers can cause denial of service via DNS query accumulation leading to resource consumption and traffic amplification bursts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-33655?
CVE-2024-33655 is a high-severity denial of service vulnerability in n/a, published on 6 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service (resource consumption) by arranging for DNS queries to be accumulated for seconds, such that responses are later sent in a pulsing burst (which can be considered traffic amplification in some cases), aka the "DNSBomb" issue.
Weakness: CWE-400
Which versions are affected by CVE-2024-33655?
Linux distribution packages (1)
unbound openSUSE:Tumbleweed | All versions | 1.20.0-1.1 |
How do I fix CVE-2024-33655?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-33655 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-33655 exists.
Sources
Also known as ALPINE-CVE-2024-33655, AZL-42447, AZL-42490, CLSA-2026-1780912053, DEBIAN-CVE-2024-33655, GHSA-2xh4-pf7v-vh6h and 8 more.