CVE-2024-33655 – CVE-2024-33655, known as DNSBomb, is a DNS prot... (How to Fix)

Q: What is the severity of CVE-2024-33655?

CVE-2024-33655 has a CVSS score of 7.5 (HIGH). CVE-2024-33655, known as DNSBomb, is a DNS protocol vulnerability that allows remote attackers to cause denial of service by accumulating DNS queries and sending responses in bursts, leading to resource consumption and potential traffic amplification. It affects DNS servers and resolvers implementing RFC 1035 and updates, potentially impacting any organization using vulnerable DNS software.

📋 TL;DR

CVE-2024-33655, known as DNSBomb, is a DNS protocol vulnerability that allows remote attackers to cause denial of service by accumulating DNS queries and sending responses in bursts, leading to resource consumption and potential traffic amplification. It affects DNS servers and resolvers implementing RFC 1035 and updates, potentially impacting any organization using vulnerable DNS software.

💻 Affected Systems

Products:

Unbound
BIND9
Technitium DNS Server
Other DNS implementations based on RFC 1035

Versions: Versions prior to fixes; check specific vendor advisories for exact ranges.

Operating Systems: All operating systems running affected DNS software

Default Config Vulnerable: ⚠️ Yes

Notes: Default configurations of affected DNS software are vulnerable; no special settings required for exploitation.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

DNS servers become unresponsive due to resource exhaustion, causing widespread service disruption for dependent applications and networks.

🟠

Likely Case

Intermittent DNS performance degradation or temporary outages affecting query resolution.

🟢

If Mitigated

Minimal impact with proper patching or workarounds, such as rate limiting or updated software.

🌐 Internet-Facing: HIGH, as DNS servers exposed to the internet can be directly targeted by remote attackers.

🏢 Internal Only: MEDIUM, as internal DNS servers could be exploited via compromised internal systems or misconfigurations.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires crafting DNS queries to trigger accumulation and burst responses, but no public proof-of-concept is available yet.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check vendor-specific versions: Unbound (commit c3206f4568f60c486be6d165b1f2b5b254fea3de), BIND9 (issue 4398), Technitium DNS Server (version 120).

Vendor Advisory: https://alas.aws.amazon.com/ALAS-2024-1934.html

Restart Required: Yes

Instructions:

1. Identify affected DNS software and version. 2. Apply vendor-provided patches or updates. 3. Restart the DNS service to apply changes. 4. Verify the fix using version checks or testing.

🔧 Temporary Workarounds

Implement DNS Rate Limiting

all

Configure rate limiting on DNS queries to prevent accumulation and burst responses.

# Example for BIND9: set 'rate-limit' options in named.conf
# Example for Unbound: use 'rate-limit' settings in unbound.conf

Use DNS Firewall or Filtering

linux

Deploy network-level controls to block or throttle suspicious DNS traffic patterns.

# Use iptables or similar to limit DNS query rates
iptables -A INPUT -p udp --dport 53 -m limit --limit 10/sec -j ACCEPT

🧯 If You Can't Patch

Monitor DNS traffic for unusual burst patterns and implement alerting.
Isolate DNS servers behind firewalls and restrict access to trusted sources only.

🔍 How to Verify

Check if Vulnerable:

Check if DNS software version is unpatched by comparing with vendor advisories; e.g., run 'unbound -V' or 'named -v'.

Check Version:

unbound -V  # for Unbound, named -v  # for BIND9, or check software-specific commands.

Verify Fix Applied:

After patching, confirm the version matches the fixed release and test DNS functionality under normal load.

📡 Detection & Monitoring

Log Indicators:

Unusual spikes in DNS query volumes or response bursts in server logs.
Increased error rates or timeouts in DNS resolution logs.

Network Indicators:

Abnormal UDP traffic patterns on port 53 with high packet rates.
DNS amplification attempts visible in network monitoring tools.

SIEM Query:

Example: search for 'dns query count > threshold' or 'dns response burst' over short time windows.

📊 Metadata

CVE ID: CVE-2024-33655

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-400

Published: June 6, 2024

Last Updated: November 4, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-33655, you might also want to check these: