Description
Unbound before 1.3.4 does not properly verify signatures for NSEC3 records, which allows remote attackers to cause secure delegations to be downgraded via DNS spoofing or other DNS-related attacks in conjunction with crafted delegation responses.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | unbound | 1.3.4-1 | — |
| Debian 13 | unbound | 1.3.4-1 | — |
| Debian 12 | unbound | 1.3.4-1 | — |
| Debian 5.0 | unbound | 1.0.2-1+lenny1 | DSA-1963-1 |
Advisories 1
- DSA-1963-1 unbound - DNSSEC validation Debian Security (DSA / DLA) · Mar 9, 2026
References
- 37913 third-party-advisory
- [oss-security] 20091009 Re: CVE request: Unbound mailing-list
- 36996 third-party-advisory
- [Unbound-users] 20091007 Release of unbound 1.3.4 mailing-list
- ADV-2009-2875 vdb-entry
- unbound-nsec3-security-bypass(53729) vdb-entry
- [oss-security] 20091009 CVE request: Unbound mailing-list
- 58836 vdb-entry
- DSA-1963 vendor-advisory