Unbound before 1.3.4 does not properly verify signatures for NSEC3 records, which allows remote attackers to cause secure delegations to be

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• nlnetlabs unboundup to 1.3.3 inclusive
• nlnetlabs unbound0.0
• nlnetlabs unbound0.09
• nlnetlabs unbound0.1
• nlnetlabs unbound0.10
• nlnetlabs unbound0.11
• nlnetlabs unbound0.2
• nlnetlabs unbound0.3
• nlnetlabs unbound0.4
• nlnetlabs unbound0.5
• nlnetlabs unbound0.6
• nlnetlabs unbound0.7
• nlnetlabs unbound0.7.1
• nlnetlabs unbound0.7.2
• nlnetlabs unbound0.8
• nlnetlabs unbound1.0.0
• nlnetlabs unbound1.0.1
• nlnetlabs unbound1.0.2
• nlnetlabs unbound1.1.0
• nlnetlabs unbound1.1.1

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2019-25042Unbound before 1.9.5 allows an out-of-bounds write via a compressed name in rdata_copy.
  40Plan
• CVE-2019-25039Unbound before 1.9.5 allows an integer overflow in a size calculation in respip/respip.c.
  40Plan
• CVE-2019-25038Unbound before 1.9.5 allows an integer overflow in a size calculation in dnscrypt/dnscrypt.c.
  40Plan
• CVE-2019-25035Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par.
  40Plan
• CVE-2019-25034Unbound before 1.9.5 allows an integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write.
  40Plan
• CVE-2019-25033Unbound before 1.9.5 allows an integer overflow in the regional allocator via the ALIGN_UP macro.
  40Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.