[GH-ISSUE #2296] address CVE-2024-33655 DOS attack (DNSBomb) #961

New issue

Open

opened 2026-03-16 01:05:56 +03:00 by kerem · 1 comment

kerem commented

2026-03-16 01:05:56 +03:00

Owner

Originally created by @bdaehlie on GitHub (Jul 9, 2024).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2296

See this CVE report.

If Hickory suffers from this it should be addressed.

Originally created by @bdaehlie on GitHub (Jul 9, 2024). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2296 See [this CVE report](https://nvd.nist.gov/vuln/detail/CVE-2024-33655). If Hickory suffers from this it should be addressed.

kerem added the

enhance

trust

crate:recursor

labels

2026-03-16 01:05:56 +03:00

kerem commented

2026-03-16 01:06:07 +03:00

Author

Owner

@djc commented on GitHub (Jul 9, 2024):

Looks like this is specific to recursors: attackers set up an authoritative name server and leverage timeouts and other shenanigans in a recursor to amplify traffic. Unbound has introduced a slew of new configuration values that set up various timeouts and limits:

github.com/NLnetLabs/unbound@c3206f4568 (diff-2e824197ec)

I'm guessing the Hickory recursor would be vulnerable to this.

@djc commented on GitHub (Jul 9, 2024): Looks like this is specific to recursors: attackers set up an authoritative name server and leverage timeouts and other shenanigans in a recursor to amplify traffic. Unbound has introduced a slew of new configuration values that set up various timeouts and limits: https://github.com/NLnetLabs/unbound/commit/c3206f4568f60c486be6d165b1f2b5b254fea3de#diff-2e824197ecb0cafe24f8e1709182a66d5d7eef05fb6b6c30d5ae26731216acda I'm guessing the Hickory recursor would be vulnerable to this.