Description
NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compression for. Malicious upstreams responses with very large RRsets can cause Unbound to spend a considerable time applying name compression to downstream replies. This can lead to degraded performance and eventually denial of service in well orchestrated attacks. The vulnerability can be exploited by a malicious actor querying Unbound for the specially crafted contents of a malicious zone with very large RRsets. Before Unbound replies to the query it will try to apply name compression which was an unbounded operation that could lock the CPU until the whole packet was complete. Unbound version 1.21.1 introduces a hard limit on the number of name compression calculations it is willing to do per packet. Packets that need more compression will result in semi-compressed packets or truncated packets, even on TCP for huge messages, to avoid locking the CPU for long. This change should not affect normal DNS traffic.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| NLnet Labs | Unbound | ≤ 1.21.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | unbound | 1.21.1-1 | — |
| Debian 13 | unbound | 1.21.1-1 | — |
| Debian 12 | unbound | 1.17.1-2+deb12u3 | DSA-5987-1 |
| Debian 11 | unbound | 1.13.1-1+deb11u4 | DLA-3952-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | unbound | 1.19.2-1ubuntu3.3 | USN-7080-1 |
| Ubuntu 22.04 LTS | unbound | 1.13.1-1ubuntu5.8 | USN-7080-1 |
| Ubuntu 20.04 LTS | unbound | 1.9.4-2ubuntu1.9 | USN-7080-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | unbound | 1.6.7-1ubuntu2.6+esm3 | USN-7080-1 |
| Ubuntu Pro 16.04 LTS | unbound | 1.5.8-1ubuntu1.1+esm2 | USN-7080-1 |
| Ubuntu Pro 14.04 LTS | unbound | 1.4.22-1ubuntu4.14.04.3+esm2 | USN-7080-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | unbound +5 | 1.20.0-10.el10_0 | RHSA-2025:8047 |
| RHEL 9 | unbound +3 | 1.16.2-8.el9_5.1 | RHSA-2025:8197, RHSA-2024:11232 |
| RHEL 9 | unbound-dracut | 1.16.2-18.el9_6 | RHSA-2025:8197 |
| RHEL 8 | unbound +3 | 1.16.2-5.8.el8_10 | RHSA-2025:0837 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.4 EUS | unbound +3 | 1.16.2-8.el9_4.1 | RHSA-2024:11170 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | unbound +5 | 1.20.0-10.el10_0 | ALSA-2025:8047 |
| AlmaLinux 9 | unbound +3 | 1.16.2-8.el9_5.1 | ALSA-2024:11232 |
| AlmaLinux 8 | unbound +3 | 1.16.2-5.8.el8_10 | ALSA-2025:0837 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | unbound | 1.20.0-10.el10_0 | RLSA-2025:8047 |
| Rocky Linux 9 | unbound | 1.16.2-8.el9_5.1 | RLSA-2025:8197, RLSA-2024:11232 |
| Rocky Linux 8 | unbound | 1.16.2-5.8.el8_10 | RLSA-2025:0837 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | unbound | 1.20.0-150600.23.9.1 | SUSE-SU-2024:3647-1 |
| SLES 15 SP5 | unbound | 1.20.0-150100.10.19.1 | SUSE-SU-2024:3646-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.1 | unbound | 1.22.0-slfo.1.1_1.1 | SUSE-SU-2025:20359-1 |
| SLE Micro 6.0 | unbound | 1.22.0-1.1 | SUSE-SU-2025:20126-1 |
| SLE Micro 5.5 | unbound | 1.20.0-150100.10.19.1 | SUSE-SU-2024:3646-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | unbound | 1.21.1-1.1 | openSUSE-SU-2024:14391-1 |
| openSUSE Leap 15.6 | unbound | 1.20.0-150600.23.9.1 | SUSE-SU-2024:3647-1 |
| openSUSE Leap 15.5 | unbound | 1.20.0-150100.10.19.1 | SUSE-SU-2024:3646-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | unbound | 1.21.1-r0 | — |
| Alpine v3.23 | unbound | 1.21.1-r0 | — |
| Alpine v3.22 | unbound | 1.21.1-r0 | — |
| Alpine v3.21 | unbound | 1.21.1-r0 | — |
| Alpine v3.20 | unbound | 1.20.0-r1 | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | unbound | 1.20.0-r1 | — |
| Alpine v3.18 | unbound | 1.20.0-r1 | — |
| Alpine v3.17 | unbound | 1.20.0-r1 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | unbound +5 | 1.17.1-1.amzn2023.0.6 | ALAS2023-2024-719 |
| Amazon Linux 2 | unbound +4 | 1.7.3-15.amzn2.0.9 | ALAS2-2024-2650 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | unbound | 1.19.1-4 | — |
| Azure Linux 2 (CBL-Mariner) | unbound | 1.19.1-3 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | unbound +5 | 1.20.0-10.el10_0 | ELSA-2025-8047 |
| Oracle Linux 9 | unbound +3 | 1.16.2-8.el9_5.1 | ELSA-2025-8197, ELSA-2024-11232 |
| Oracle Linux 9 | unbound-dracut | 1.16.2-18.el9_6 | ELSA-2025-8197 |
| Oracle Linux 8 | unbound +3 | 1.16.2-5.8.el8_10 | ELSA-2025-0837 |
Advisories 28
- ALSA-2025:8047 Moderate: unbound security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:11232 Moderate: unbound:1.16.2 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:0837 Important: unbound security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:8197 Red Hat Security Advisory: unbound security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:8047 Red Hat Security Advisory: unbound security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:0837 Red Hat Security Advisory: unbound security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2024:11232 Red Hat Security Advisory: unbound:1.16.2 security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2024:11170 Red Hat Security Advisory: unbound security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- WID-SEC-2024-3710 Red Hat Enterprise Linux (unbound und mpg123): Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 20, 2026
- USN-7080-1 unbound vulnerability Ubuntu Security Notices (USN) · Jun 29, 2026
- WID-SEC-2024-3169 OpenBSD: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · May 21, 2026
- SUSE-SU-2025:20359-1 Security update for unbound SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20126-1 Security update for unbound SUSE / openSUSE Security Updates · Mar 23, 2026
- DSA-5987-1 unbound - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3952-1 unbound - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2025:0837 Important: unbound security update Rocky Linux Security Advisories · Feb 5, 2026
- RLSA-2024:11232 Moderate: unbound:1.16.2 security update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2024:3646-1 Security update for unbound SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14391-1 libunbound8-1.21.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3647-1 Security update for unbound SUSE / openSUSE Security Updates · Feb 4, 2026
- RLSA-2025:8197 Moderate: unbound security update Rocky Linux Security Advisories · Oct 7, 2025
- RLSA-2025:8047 Moderate: unbound security update Rocky Linux Security Advisories · Oct 3, 2025
- ELSA-2025-8047 Moderate: unbound security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jun 27, 2025
- ELSA-2025-8197 Moderate: unbound security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 27, 2025
- ELSA-2025-0837 Important: unbound security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jan 30, 2025
- ELSA-2024-11232 Moderate: unbound:1.16.2 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Dec 19, 2024
- ALAS2-2024-2650 Moderate: unbound security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 15, 2024
- ALAS2023-2024-719 Moderate: unbound security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 14, 2024
References
- https://www.nlnetlabs.nl/downloads/unbound/CVE-2024-8508.txt vendor-advisory