CVE-2024-26212: Windows Server 2008 DHCP DoS Vulnerability

CVE-2024-26212 Overview

CVE-2024-26212 is a denial of service vulnerability in the Microsoft Windows DHCP Server Service. The flaw allows an unauthenticated remote attacker to disrupt the availability of DHCP services on affected Windows Server systems. Microsoft addressed the issue in the April 2024 Patch Tuesday cycle. The vulnerability is tracked under [CWE-400] (Uncontrolled Resource Consumption) and impacts every supported Windows Server release running the DHCP Server role.

Critical Impact
An unauthenticated network attacker can crash or stall the DHCP Server Service, preventing clients from obtaining IP address leases and disrupting network connectivity across an enterprise.

Affected Products

Microsoft Windows Server 2008 SP2 and Windows Server 2008 R2 SP1 (x64)
Microsoft Windows Server 2012 and Windows Server 2012 R2
Microsoft Windows Server 2016, 2019, 2022, and 2022 23H2

Discovery Timeline

2024-04-09 - Microsoft releases security patch for CVE-2024-26212
2024-04-09 - CVE-2024-26212 published to NVD
2025-01-08 - Last updated in NVD database

Technical Details for CVE-2024-26212

Vulnerability Analysis

The vulnerability resides in the Windows DHCP Server Service, the component responsible for issuing IP address leases and network configuration to DHCP clients. An unauthenticated attacker on the network can send specially crafted traffic to a vulnerable DHCP server. The service then enters a state of uncontrolled resource consumption, resulting in service degradation or termination.

Because the attack targets availability only, it does not expose data or grant code execution. However, DHCP outages can cascade across an environment. Clients with expired leases lose connectivity, and dependent services such as DNS dynamic updates, network access control, and PXE boot also fail.

The EPSS data indicates a high probability of exploitation activity relative to other CVEs, placing this issue in the top percentile for likely exploitation despite no public proof-of-concept being available at this time.

Root Cause

The root cause is classified as [CWE-400] Uncontrolled Resource Consumption. The DHCP Server Service fails to properly bound resource usage when processing specific request patterns. Microsoft has not published low-level technical details for this issue. Refer to the Microsoft Security Update CVE-2024-26212 advisory for vendor guidance.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker with the ability to reach UDP port 67 on a Windows DHCP server, typically from within a broadcast domain or via a DHCP relay, can trigger the condition. Environments that expose the DHCP role across routed segments through ip helper-address relays expand the reachable attack surface.

Detection Methods for CVE-2024-26212

Indicators of Compromise

Unexpected termination or repeated restart of the DHCPServer service on Windows Server hosts.
Spikes in DHCP request traffic from anomalous source addresses or MAC addresses targeting UDP port 67.
Surge of Event ID 1056, 1059, or service crash events in the System and DHCP-Server operational logs.
Loss of lease issuance correlated with elevated CPU or memory usage on the DHCP server process.

Detection Strategies

Monitor the Windows Event Log channels Microsoft-Windows-DHCP-Server/Operational and System for service stop, crash, and recovery events.
Baseline normal DHCP request volume per scope and alert on deviation thresholds that indicate flooding.
Correlate DHCP service crashes with inbound network captures on UDP port 67 to identify malformed or abusive packets.

Monitoring Recommendations

Ingest DHCP server logs and Windows service control events into a centralized SIEM for correlation across servers.
Track service uptime and lease pool exhaustion as availability key performance indicators for the DHCP role.
Apply network flow monitoring at distribution-layer switches to flag abnormal DHCP discovery and request rates.

How to Mitigate CVE-2024-26212

Immediate Actions Required

Apply the April 2024 Microsoft security update for every Windows Server host running the DHCP Server role.
Inventory all systems with the DHCP role enabled and prioritize patching of production lease servers and failover partners.
Restrict inbound DHCP traffic to authorized client segments and trusted relay agents only.
Review DHCP failover configurations so a single server outage does not exhaust lease availability.

Patch Information

Microsoft released fixes for CVE-2024-26212 as part of the April 9, 2024 security update cycle. Patches are available for Windows Server 2008 SP2, 2008 R2 SP1, 2012, 2012 R2, 2016, 2019, 2022, and 2022 23H2. Consult the Microsoft Security Update CVE-2024-26212 advisory for the specific KB article that matches each operating system build.

Workarounds

Disable the DHCP Server Service on hosts that do not require the role, removing the attack surface entirely.
Enforce DHCP snooping and rate-limiting on access-layer switches to throttle malicious traffic before it reaches the server.
Segment management and client VLANs so only authorized subnets can reach UDP port 67 on the DHCP server.
Configure Windows Server Failover Clustering or DHCP failover scopes to maintain lease issuance if one server is disrupted.

bash

# Verify DHCP Server patch level and service status on Windows Server
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10
Get-Service DHCPServer | Format-List Name, Status, StartType
Get-WinEvent -LogName 'Microsoft-Windows-DHCP-Server/Operational' -MaxEvents 50