https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 15:58:55 +0000 https://cve.radiocsirt.org/vuln/alsa-2024:11232 <p><strong>Affected:</strong> AlmaLinux:9: python3-unbound, AlmaLinux:9: unbound, AlmaLinux:9: unbound-devel, AlmaLinux:9: unbound-libs</p> <p>The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.</p> <p>Security Fix(es):</p> <p>* unbound: Unbounded name compression could lead to Denial of Service (CVE-2024-8508)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:9: python3-unbound, AlmaLinux:9: unbound, AlmaLinux:9: unbound-devel, AlmaLinux:9: unbound-libs</p> <p>The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.</p> <p>Security Fix(es):</p> <p>* unbound: Unbounded name compression could lead to Denial of Service (CVE-2024-8508)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2024:11232 https://cve.radiocsirt.org/vuln/bdu:2025-11496 bdu:2025-11496 https://cve.radiocsirt.org/vuln/bdu:2025-11496 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0154 certfr-2025-avi-0154 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0154 https://cve.radiocsirt.org/vuln/euvd-2026-201743 EUVD-2026-201743 https://cve.radiocsirt.org/vuln/euvd-2026-201743 https://cve.radiocsirt.org/vuln/fkie_cve-2024-8508 <p>NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compression for. Malicious upstreams responses with very large RRsets can cause Unbound to spend a considerable time applying name compression to downstream replies. This can lead to degraded performance and eventually denial of service in well orchestrated attacks. The vulnerability can be exploited by a malicious actor querying Unbound for the specially crafted contents of a malicious zone with very large RRsets. Before Unbound replies to the query it will try to apply name compression which was an unbounded operation that could lock the CPU until the whole packet was complete. Unbound version 1.21.1 introduces a hard limit on the number of name compression calculations it is willing to do per packet. Packets that need more compression will result in semi-compressed packets or truncated packets, even on TCP for huge messages, to avoid locking the CPU for long. This change should not affect normal DNS traffic.</p> <p>NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compression for. Malicious upstreams responses with very large RRsets can cause Unbound to spend a considerable time applying name compression to downstream replies. This can lead to degraded performance and eventually denial of service in well orchestrated attacks. The vulnerability can be exploited by a malicious actor querying Unbound for the specially crafted contents of a malicious zone with very large RRsets. Before Unbound replies to the query it will try to apply name compression which was an unbounded operation that could lock the CPU until the whole packet was complete. Unbound version 1.21.1 introduces a hard limit on the number of name compression calculations it is willing to do per packet. Packets that need more compression will result in semi-compressed packets or truncated packets, even on TCP for huge messages, to avoid locking the CPU for long. This change should not affect normal DNS traffic.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-8508 https://cve.radiocsirt.org/vuln/ghsa-g7cv-x9wx-38gx <p>NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compression for. Malicious upstreams responses with very large RRsets can cause Unbound to spend a considerable time applying name compression to downstream replies. This can lead to degraded performance and eventually denial of service in well orchestrated attacks. The vulnerability can be exploited by a malicious actor querying Unbound for the specially crafted contents of a malicious zone with very large RRsets. Before Unbound replies to the query it will try to apply name compression which was an unbounded operation that could lock the CPU until the whole packet was complete. Unbound version 1.21.1 introduces a hard limit on the number of name compression calculations it is willing to do per packet. Packets that need more compression will result in semi-compressed packets or truncated packets, even on TCP for huge messages, to avoid locking the CPU for long. This change should not affect normal DNS traffic.</p> <p>NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compression for. Malicious upstreams responses with very large RRsets can cause Unbound to spend a considerable time applying name compression to downstream replies. This can lead to degraded performance and eventually denial of service in well orchestrated attacks. The vulnerability can be exploited by a malicious actor querying Unbound for the specially crafted contents of a malicious zone with very large RRsets. Before Unbound replies to the query it will try to apply name compression which was an unbounded operation that could lock the CPU until the whole packet was complete. Unbound version 1.21.1 introduces a hard limit on the number of name compression calculations it is willing to do per packet. Packets that need more compression will result in semi-compressed packets or truncated packets, even on TCP for huge messages, to avoid locking the CPU for long. This change should not affect normal DNS traffic.</p> https://cve.radiocsirt.org/vuln/ghsa-g7cv-x9wx-38gx https://cve.radiocsirt.org/vuln/msrc_cve-2024-8508 msrc_CVE-2024-8508 https://cve.radiocsirt.org/vuln/msrc_cve-2024-8508 https://cve.radiocsirt.org/vuln/oesa-2024-2266 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP1: unbound, openEuler:24.03-LTS: unbound, openEuler:22.03-LTS-SP4: unbound, openEuler:22.03-LTS-SP3: unbound, openEuler:20.03-LTS-SP4: unbound</p> <p>Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn&amp;apos;t make custom builds or provide specific features to paying customers only. Security Fix(es): NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compression for. Malicious upstreams responses with very large RRsets can cause Unbound to spend a considerable time applying name compression to downstream replies. This can lead to degraded performance and eventually denial of service in well orchestrated attacks. The vulnerability can be exploited by a malicious actor querying Unbound for the specially crafted contents of a malicious zone with very large RRsets. Before Unbound replies to the query it will try to apply name compression which was an unbounded operation that could lock the CPU until the whole packet was complete. Unbound version 1.21.1 introduces a hard limit on the number of name compression calculations it is willing to do per packet. Packets that need more compression will result in semi-compressed pack…</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP1: unbound, openEuler:24.03-LTS: unbound, openEuler:22.03-LTS-SP4: unbound, openEuler:22.03-LTS-SP3: unbound, openEuler:20.03-LTS-SP4: unbound</p> <p>Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn&amp;apos;t make custom builds or provide specific features to paying customers only. Security Fix(es): NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compression for. Malicious upstreams responses with very large RRsets can cause Unbound to spend a considerable time applying name compression to downstream replies. This can lead to degraded performance and eventually denial of service in well orchestrated attacks. The vulnerability can be exploited by a malicious actor querying Unbound for the specially crafted contents of a malicious zone with very large RRsets. Before Unbound replies to the query it will try to apply name compression which was an unbounded operation that could lock the CPU until the whole packet was complete. Unbound version 1.21.1 introduces a hard limit on the number of name compression calculations it is willing to do per packet. Packets that need more compression will result in semi-compressed pack…</p> https://cve.radiocsirt.org/vuln/oesa-2024-2266 https://cve.radiocsirt.org/vuln/opensuse-su-2024:14391-1 <p>libunbound8-1.21.1-1.1 on GA media</p> <p>libunbound8-1.21.1-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:14391-1 https://cve.radiocsirt.org/vuln/rhsa-2024:11170 <p>unbound: Unbounded name compression could lead to Denial of Service</p> <p>unbound: Unbounded name compression could lead to Denial of Service</p> https://cve.radiocsirt.org/vuln/rhsa-2024:11170 https://cve.radiocsirt.org/vuln/rustsec-2026-0119 <p><strong>Affected:</strong> crates.io: hickory-proto</p> <p>During message encoding, `hickory-proto`&#39;s `BinEncoder` stores pointers to labels that are candidates for name compression in a `Vec&lt;(usize, Vec&lt;u8&gt;)&gt;`. The name compression logic then searches for matches with a linear scan.</p> <p>A malicious message with many records can both introduce many candidate labels, and invoke this linear scan many times. This can amplify CPU exhaustion in DoS attacks.</p> <p>This is similar to [CVE-2024-8508](https://www.nlnetlabs.nl/downloads/unbound/CVE-2024-8508.txt).</p> <p>We recommend all affected users update to `hickory-proto` 0.26.1 for the fix.</p> <p><strong>Affected:</strong> crates.io: hickory-proto</p> <p>During message encoding, `hickory-proto`&#39;s `BinEncoder` stores pointers to labels that are candidates for name compression in a `Vec&lt;(usize, Vec&lt;u8&gt;)&gt;`. The name compression logic then searches for matches with a linear scan.</p> <p>A malicious message with many records can both introduce many candidate labels, and invoke this linear scan many times. This can amplify CPU exhaustion in DoS attacks.</p> <p>This is similar to [CVE-2024-8508](https://www.nlnetlabs.nl/downloads/unbound/CVE-2024-8508.txt).</p> <p>We recommend all affected users update to `hickory-proto` 0.26.1 for the fix.</p> https://cve.radiocsirt.org/vuln/rustsec-2026-0119 https://cve.radiocsirt.org/vuln/suse-su-2024:3646-1 <p>Security update for unbound</p> <p>Security update for unbound</p> https://cve.radiocsirt.org/vuln/suse-su-2024:3646-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-8508 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: unbound, Ubuntu:Pro:16.04:LTS: unbound, Ubuntu:Pro:18.04:LTS: unbound, Ubuntu:20.04:LTS: unbound, Ubuntu:22.04:LTS: unbound, Ubuntu:24.04:LTS: unbound</p> <p>NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compression for. Malicious upstreams responses with very large RRsets can cause Unbound to spend a considerable time applying name compression to downstream replies. This can lead to degraded performance and eventually denial of service in well orchestrated attacks. The vulnerability can be exploited by a malicious actor querying Unbound for the specially crafted contents of a malicious zone with very large RRsets. Before Unbound replies to the query it will try to apply name compression which was an unbounded operation that could lock the CPU until the whole packet was complete. Unbound version 1.21.1 introduces a hard limit on the number of name compression calculations it is willing to do per packet. Packets that need more compression will result in semi-compressed packets or truncated packets, even on TCP for huge messages, to avoid locking the CPU for long. This change should not affect normal DNS traffic.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: unbound, Ubuntu:Pro:16.04:LTS: unbound, Ubuntu:Pro:18.04:LTS: unbound, Ubuntu:20.04:LTS: unbound, Ubuntu:22.04:LTS: unbound, Ubuntu:24.04:LTS: unbound</p> <p>NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compression for. Malicious upstreams responses with very large RRsets can cause Unbound to spend a considerable time applying name compression to downstream replies. This can lead to degraded performance and eventually denial of service in well orchestrated attacks. The vulnerability can be exploited by a malicious actor querying Unbound for the specially crafted contents of a malicious zone with very large RRsets. Before Unbound replies to the query it will try to apply name compression which was an unbounded operation that could lock the CPU until the whole packet was complete. Unbound version 1.21.1 introduces a hard limit on the number of name compression calculations it is willing to do per packet. Packets that need more compression will result in semi-compressed packets or truncated packets, even on TCP for huge messages, to avoid locking the CPU for long. This change should not affect normal DNS traffic.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-8508 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3169 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in OpenBSD ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in OpenBSD ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3169