Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Unbound DNS server can crash from crafted response

CVE-2011-4869 · published 14 years ago
Summary

Versions of Unbound prior to 1.4.13p2 may stop working if they receive a specially formed DNS reply that is missing certain security records. This can cause the DNS service to stop, affecting name resolution for users. Update Unbound to the latest version or apply the provided patches to prevent the crash.

What to do
  • Update debian unbound to version 1.4.14-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian unbound < 1.4.14-1
Fix: upgrade to 1.4.14-1
Debian:13 debian unbound < 1.4.14-1
Fix: upgrade to 1.4.14-1
Debian:14 debian unbound < 1.4.14-1
Fix: upgrade to 1.4.14-1
– unbound unbound <= 1.4.12
0.0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.7.1
0.7.2
0.8
26 more version ranges
cpe:2.3:a:unbound:unbound:*:*:*:*:*:*:*:*
Original advisory text
validator/val_nsec3.c in Unbound before 1.4.13p2 does not properly perform proof processing for NSEC3-signed zones, which allows remote DNS servers to cause a denial of service (daemon crash) via a...
validator/val_nsec3.c in Unbound before 1.4.13p2 does not properly perform proof processing for NSEC3-signed zones, which allows remote DNS servers to cause a denial of service (daemon crash) via a malformed response that lacks expected NSEC3 records, a different vulnerability than CVE-2011-4528.
References
Severity
7.8 High
Exploitation
3% chance of attack within 30 days
Type
CWE-399Resource Management Errors
Timeline
Published20 Dec 2011
Updated31 Oct 2026
First seen11 Sep 2026
Sources
DEBIAN-CVE-2011-4869 · OSV
CVE-2011-4869 · NVD
Track software like this
Free during beta