Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-cjha-wacb-mqds
Vulnerability ID VCID-cjha-wacb-mqds
Aliases CVE-2024-33655
Summary unbound: DNSBomb vulnerability
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-400 Uncontrolled Resource Consumption
System Score Found at
cvssv3 3.7 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-33655.json
cvssv3.1 7.5 https://alas.aws.amazon.com/ALAS-2024-1934.html
ssvc Track https://alas.aws.amazon.com/ALAS-2024-1934.html
epss 0.03922 https://api.first.org/data/v1/epss?cve=CVE-2024-33655
epss 0.03922 https://api.first.org/data/v1/epss?cve=CVE-2024-33655
epss 0.03922 https://api.first.org/data/v1/epss?cve=CVE-2024-33655
epss 0.03922 https://api.first.org/data/v1/epss?cve=CVE-2024-33655
epss 0.03922 https://api.first.org/data/v1/epss?cve=CVE-2024-33655
epss 0.03922 https://api.first.org/data/v1/epss?cve=CVE-2024-33655
epss 0.03922 https://api.first.org/data/v1/epss?cve=CVE-2024-33655
cvssv3.1 7.5 https://datatracker.ietf.org/doc/html/rfc1035
ssvc Track https://datatracker.ietf.org/doc/html/rfc1035
cvssv3.1 3.7 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 7.5 https://github.com/NLnetLabs/unbound/commit/c3206f4568f60c486be6d165b1f2b5b254fea3de
ssvc Track https://github.com/NLnetLabs/unbound/commit/c3206f4568f60c486be6d165b1f2b5b254fea3de
cvssv3.1 7.5 https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md#version-120
ssvc Track https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md#version-120
cvssv3.1 7.5 https://gitlab.isc.org/isc-projects/bind9/-/issues/4398
ssvc Track https://gitlab.isc.org/isc-projects/bind9/-/issues/4398
cvssv3.1 7.5 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3TBXPRJ2Q235YUZKYDRWOSYNDFBJQWJ3/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3TBXPRJ2Q235YUZKYDRWOSYNDFBJQWJ3/
cvssv3.1 7.5 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QITY2QBX2OCBTZIXD2A5ES62STFIA4AL/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QITY2QBX2OCBTZIXD2A5ES62STFIA4AL/
cvssv3.1 7.5 https://meterpreter.org/researchers-uncover-dnsbomb-a-new-pdos-attack-exploiting-legitimate-dns-features/
ssvc Track https://meterpreter.org/researchers-uncover-dnsbomb-a-new-pdos-attack-exploiting-legitimate-dns-features/
cvssv3.1 7.5 https://nlnetlabs.nl/downloads/unbound/CVE-2024-33655.txt
ssvc Track https://nlnetlabs.nl/downloads/unbound/CVE-2024-33655.txt
cvssv3.1 7.5 https://nlnetlabs.nl/projects/unbound/security-advisories/
ssvc Track https://nlnetlabs.nl/projects/unbound/security-advisories/
cvssv3.1 7.5 https://sp2024.ieee-security.org/accepted-papers.html
ssvc Track https://sp2024.ieee-security.org/accepted-papers.html
cvssv3.1 7.5 https://www.isc.org/blogs/2024-dnsbomb/
ssvc Track https://www.isc.org/blogs/2024-dnsbomb/
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-33655.json
https://api.first.org/data/v1/epss?cve=CVE-2024-33655
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-33655
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
2024-dnsbomb https://www.isc.org/blogs/2024-dnsbomb/
2279942 https://bugzilla.redhat.com/show_bug.cgi?id=2279942
3TBXPRJ2Q235YUZKYDRWOSYNDFBJQWJ3 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3TBXPRJ2Q235YUZKYDRWOSYNDFBJQWJ3/
4398 https://gitlab.isc.org/isc-projects/bind9/-/issues/4398
accepted-papers.html https://sp2024.ieee-security.org/accepted-papers.html
ALAS-2024-1934.html https://alas.aws.amazon.com/ALAS-2024-1934.html
c3206f4568f60c486be6d165b1f2b5b254fea3de https://github.com/NLnetLabs/unbound/commit/c3206f4568f60c486be6d165b1f2b5b254fea3de
CHANGELOG.md#version-120 https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md#version-120
CVE-2024-33655.txt https://nlnetlabs.nl/downloads/unbound/CVE-2024-33655.txt
QITY2QBX2OCBTZIXD2A5ES62STFIA4AL https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QITY2QBX2OCBTZIXD2A5ES62STFIA4AL/
researchers-uncover-dnsbomb-a-new-pdos-attack-exploiting-legitimate-dns-features https://meterpreter.org/researchers-uncover-dnsbomb-a-new-pdos-attack-exploiting-legitimate-dns-features/
rfc1035 https://datatracker.ietf.org/doc/html/rfc1035
security-advisories https://nlnetlabs.nl/projects/unbound/security-advisories/
USN-6791-1 https://usn.ubuntu.com/6791-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-33655.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://alas.aws.amazon.com/ALAS-2024-1934.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-22T18:13:28Z/ Found at https://alas.aws.amazon.com/ALAS-2024-1934.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://datatracker.ietf.org/doc/html/rfc1035
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-22T18:13:28Z/ Found at https://datatracker.ietf.org/doc/html/rfc1035
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/NLnetLabs/unbound/commit/c3206f4568f60c486be6d165b1f2b5b254fea3de
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-22T18:13:28Z/ Found at https://github.com/NLnetLabs/unbound/commit/c3206f4568f60c486be6d165b1f2b5b254fea3de
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md#version-120
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-22T18:13:28Z/ Found at https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md#version-120
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://gitlab.isc.org/isc-projects/bind9/-/issues/4398
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-22T18:13:28Z/ Found at https://gitlab.isc.org/isc-projects/bind9/-/issues/4398
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3TBXPRJ2Q235YUZKYDRWOSYNDFBJQWJ3/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-22T18:13:28Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3TBXPRJ2Q235YUZKYDRWOSYNDFBJQWJ3/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QITY2QBX2OCBTZIXD2A5ES62STFIA4AL/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-22T18:13:28Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QITY2QBX2OCBTZIXD2A5ES62STFIA4AL/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://meterpreter.org/researchers-uncover-dnsbomb-a-new-pdos-attack-exploiting-legitimate-dns-features/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-22T18:13:28Z/ Found at https://meterpreter.org/researchers-uncover-dnsbomb-a-new-pdos-attack-exploiting-legitimate-dns-features/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nlnetlabs.nl/downloads/unbound/CVE-2024-33655.txt
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-22T18:13:28Z/ Found at https://nlnetlabs.nl/downloads/unbound/CVE-2024-33655.txt
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nlnetlabs.nl/projects/unbound/security-advisories/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-22T18:13:28Z/ Found at https://nlnetlabs.nl/projects/unbound/security-advisories/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://sp2024.ieee-security.org/accepted-papers.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-22T18:13:28Z/ Found at https://sp2024.ieee-security.org/accepted-papers.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://www.isc.org/blogs/2024-dnsbomb/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-22T18:13:28Z/ Found at https://www.isc.org/blogs/2024-dnsbomb/
Exploit Prediction Scoring System (EPSS)
Percentile 0.88263
EPSS Score 0.03922
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:47:46.071251+00:00 RedHat Importer Import https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-33655.json 38.0.0