Read the docs
TI-2009-03439 Aliases CVE-2009-3602GHSA-3xrf-3v7w-582w

Unbound before 1.3.4 does not properly verify signatures for NSEC3 records, which allows…

Priority LOW 38CWE-310Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Unbound before 1.3.4 does not properly verify signatures for NSEC3 records, which allows remote attackers to cause secure delegations to be downgraded via DNS spoofing or other DNS-related attacks in conjunction with crafted delegation responses.

Why it matters now

EPSS 0.02976 87th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 25

CPEVersionsRoleVendor
cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*up to 1.3.3VulnerableNLNETLABS
cpe:2.3:a:nlnetlabs:unbound:0.0:*:*:*:*:*:*:*0.0VulnerableNLNETLABS
cpe:2.3:a:nlnetlabs:unbound:0.1:*:*:*:*:*:*:*0.1VulnerableNLNETLABS
cpe:2.3:a:nlnetlabs:unbound:0.2:*:*:*:*:*:*:*0.2VulnerableNLNETLABS
cpe:2.3:a:nlnetlabs:unbound:0.3:*:*:*:*:*:*:*0.3VulnerableNLNETLABS
cpe:2.3:a:nlnetlabs:unbound:0.4:*:*:*:*:*:*:*0.4VulnerableNLNETLABS
cpe:2.3:a:nlnetlabs:unbound:0.5:*:*:*:*:*:*:*0.5VulnerableNLNETLABS
cpe:2.3:a:nlnetlabs:unbound:0.6:*:*:*:*:*:*:*0.6VulnerableNLNETLABS
cpe:2.3:a:nlnetlabs:unbound:0.7:*:*:*:*:*:*:*0.7VulnerableNLNETLABS
cpe:2.3:a:nlnetlabs:unbound:0.7.1:*:*:*:*:*:*:*0.7.1VulnerableNLNETLABS
  • cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:* Versions up to 1.3.3 Vulnerable ·NLNETLABS
  • cpe:2.3:a:nlnetlabs:unbound:0.0:*:*:*:*:*:*:* Versions 0.0 Vulnerable ·NLNETLABS
  • cpe:2.3:a:nlnetlabs:unbound:0.1:*:*:*:*:*:*:* Versions 0.1 Vulnerable ·NLNETLABS
  • cpe:2.3:a:nlnetlabs:unbound:0.2:*:*:*:*:*:*:* Versions 0.2 Vulnerable ·NLNETLABS
  • cpe:2.3:a:nlnetlabs:unbound:0.3:*:*:*:*:*:*:* Versions 0.3 Vulnerable ·NLNETLABS
  • cpe:2.3:a:nlnetlabs:unbound:0.4:*:*:*:*:*:*:* Versions 0.4 Vulnerable ·NLNETLABS
  • cpe:2.3:a:nlnetlabs:unbound:0.5:*:*:*:*:*:*:* Versions 0.5 Vulnerable ·NLNETLABS
  • cpe:2.3:a:nlnetlabs:unbound:0.6:*:*:*:*:*:*:* Versions 0.6 Vulnerable ·NLNETLABS
  • cpe:2.3:a:nlnetlabs:unbound:0.7:*:*:*:*:*:*:* Versions 0.7 Vulnerable ·NLNETLABS
  • cpe:2.3:a:nlnetlabs:unbound:0.7.1:*:*:*:*:*:*:* Versions 0.7.1 Vulnerable ·NLNETLABS
Show 15 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:nlnetlabs:unbound:0.7.2:*:*:*:*:*:*:*0.7.2VulnerableNLNETLABS
cpe:2.3:a:nlnetlabs:unbound:0.8:*:*:*:*:*:*:*0.8VulnerableNLNETLABS
cpe:2.3:a:nlnetlabs:unbound:0.09:*:*:*:*:*:*:*0.09VulnerableNLNETLABS
cpe:2.3:a:nlnetlabs:unbound:0.10:*:*:*:*:*:*:*0.10VulnerableNLNETLABS
cpe:2.3:a:nlnetlabs:unbound:0.11:*:*:*:*:*:*:*0.11VulnerableNLNETLABS
cpe:2.3:a:nlnetlabs:unbound:1.0.0:*:*:*:*:*:*:*1.0.0VulnerableNLNETLABS
cpe:2.3:a:nlnetlabs:unbound:1.0.1:*:*:*:*:*:*:*1.0.1VulnerableNLNETLABS
cpe:2.3:a:nlnetlabs:unbound:1.0.2:*:*:*:*:*:*:*1.0.2VulnerableNLNETLABS
cpe:2.3:a:nlnetlabs:unbound:1.1.0:*:*:*:*:*:*:*1.1.0VulnerableNLNETLABS
cpe:2.3:a:nlnetlabs:unbound:1.1.1:*:*:*:*:*:*:*1.1.1VulnerableNLNETLABS
cpe:2.3:a:nlnetlabs:unbound:1.2.0:*:*:*:*:*:*:*1.2.0VulnerableNLNETLABS
cpe:2.3:a:nlnetlabs:unbound:1.2.1:*:*:*:*:*:*:*1.2.1VulnerableNLNETLABS
cpe:2.3:a:nlnetlabs:unbound:1.3.0:*:*:*:*:*:*:*1.3.0VulnerableNLNETLABS
cpe:2.3:a:nlnetlabs:unbound:1.3.1:*:*:*:*:*:*:*1.3.1VulnerableNLNETLABS
cpe:2.3:a:nlnetlabs:unbound:1.3.2:*:*:*:*:*:*:*1.3.2VulnerableNLNETLABS
  • cpe:2.3:a:nlnetlabs:unbound:0.7.2:*:*:*:*:*:*:* Versions 0.7.2 Vulnerable ·NLNETLABS
  • cpe:2.3:a:nlnetlabs:unbound:0.8:*:*:*:*:*:*:* Versions 0.8 Vulnerable ·NLNETLABS
  • cpe:2.3:a:nlnetlabs:unbound:0.09:*:*:*:*:*:*:* Versions 0.09 Vulnerable ·NLNETLABS
  • cpe:2.3:a:nlnetlabs:unbound:0.10:*:*:*:*:*:*:* Versions 0.10 Vulnerable ·NLNETLABS
  • cpe:2.3:a:nlnetlabs:unbound:0.11:*:*:*:*:*:*:* Versions 0.11 Vulnerable ·NLNETLABS
  • cpe:2.3:a:nlnetlabs:unbound:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·NLNETLABS
  • cpe:2.3:a:nlnetlabs:unbound:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·NLNETLABS
  • cpe:2.3:a:nlnetlabs:unbound:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·NLNETLABS
  • cpe:2.3:a:nlnetlabs:unbound:1.1.0:*:*:*:*:*:*:* Versions 1.1.0 Vulnerable ·NLNETLABS
  • cpe:2.3:a:nlnetlabs:unbound:1.1.1:*:*:*:*:*:*:* Versions 1.1.1 Vulnerable ·NLNETLABS
  • cpe:2.3:a:nlnetlabs:unbound:1.2.0:*:*:*:*:*:*:* Versions 1.2.0 Vulnerable ·NLNETLABS
  • cpe:2.3:a:nlnetlabs:unbound:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·NLNETLABS
  • cpe:2.3:a:nlnetlabs:unbound:1.3.0:*:*:*:*:*:*:* Versions 1.3.0 Vulnerable ·NLNETLABS
  • cpe:2.3:a:nlnetlabs:unbound:1.3.1:*:*:*:*:*:*:* Versions 1.3.1 Vulnerable ·NLNETLABS
  • cpe:2.3:a:nlnetlabs:unbound:1.3.2:*:*:*:*:*:*:* Versions 1.3.2 Vulnerable ·NLNETLABS

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-3602
  2. 2026-10-03 Alias added: GHSA-3xrf-3v7w-582w

References

Advisory 3

Other 3

  • TI-2023-27571 Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related… CVSS 3.1HIGH 7.5
  • TI-2019-15178 Unbound before 1.9.5 allows an integer overflow in a size calculation in… CVSS 3.1CRITICAL 9.8
  • TI-2026-25690 Possible arbitrary code execution during DNSSEC validation CVSS 4.0CRITICAL 9.1
  • TI-2026-56302 Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY CVSS 4.0CRITICAL 9.1
  • TI-2019-15182 Unbound before 1.9.5 allows an out-of-bounds write via a compressed name in rdata_copy. CVSS 3.1CRITICAL 9.8
  • TI-2019-15179 Unbound before 1.9.5 allows an integer overflow in a size calculation in respip/respip.c. CVSS 3.1CRITICAL 9.8
See all 72 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences