CVE-2011-4869

published 2011-12-20

CVE-2011-4869: validator/val_nsec3.c in Unbound before 1.4.13p2 does not properly perform proof processing for NSEC3-signed zones, which allows remote DNS servers to cause a…

Priority P4 31 high 7.8 CVSS 2.0

AV N AC L Au N C N I N A C

validator/val_nsec3.c in Unbound before 1.4.13p2 does not properly perform proof processing for NSEC3-signed zones, which allows remote DNS servers to cause a denial of service (daemon crash) via a malformed response that lacks expected NSEC3 records, a different vulnerability than CVE-2011-4528.

Affected

44 ranges · showing 25

Vendor	Product	Version range	Fixed in
debian	unbound	< unbound 1.4.14-1 (bookworm)	unbound 1.4.14-1 (bookworm)
nlnetlabs	unbound	>= 0 < 1.4.14-1	1.4.14-1
nlnetlabs	unbound	>= 0 < 1.4.14-1	1.4.14-1
nlnetlabs	unbound	>= 0 < 1.4.14-1	1.4.14-1
nlnetlabs	unbound	>= 0 < 1.4.14-1	1.4.14-1
unbound	unbound	<= 1.4.12	—
unbound	unbound	—	—
unbound	unbound	—	—
unbound	unbound	—	—
unbound	unbound	—	—
unbound	unbound	—	—
unbound	unbound	—	—
unbound	unbound	—	—
unbound	unbound	—	—
unbound	unbound	—	—
unbound	unbound	—	—
unbound	unbound	—	—
unbound	unbound	—	—
unbound	unbound	—	—
unbound	unbound	—	—
unbound	unbound	—	—
unbound	unbound	—	—
unbound	unbound	—	—
unbound	unbound	—	—
unbound	unbound	—	—

CVSS provenance

nvd v2.0 7.8 HIGH AV:N/AC:L/Au:N/C:N/I:N/A:C

osv 5.0 MEDIUM

vendor_debian 5.0 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.