Denial of service when trimming EDE text on positive replies
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 3 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-835.
Summary
NLnet Labs Unbound version 1.18.0 up to and including version 1.19.1 contain a vulnerability that can cause denial of service by a certain code path that can lead to an infinite loop. Unbound 1.18.0 introduced a feature that removes EDE records from responses with size higher than the client's advertised buffer size. Before removing all the EDE records however, it would try to see if trimming the extra text fields on those records would result in an acceptable size while still retaining the EDE codes. Due to an unchecked condition, the code that trims the text of the EDE records could loop indefinitely. This happens when Unbound would reply with attached EDE information on a positive reply and the client's buffer size is smaller than the needed space to include EDE records. The vulnerability can only be triggered when the 'ede: yes' option is used; non default configuration. From version 1.19.2 on, the code is fixed to avoid looping indefinitely.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NLnet Labs | Unbound | 1.18.0 to before 1.19.2 | 1.19.2 | Patch available | CNA |
- Unbound VendorNLnet Labs Affected 1.18.0 to before 1.19.2 Fixed in 1.19.2 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:* | 1.18.0 to before 1.19.2 | Vulnerable | NLNETLABS |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* | 39 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* | 40 | Vulnerable | Fedoraproject |
- cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:* Versions 1.18.0 to before 1.19.2 Vulnerable ·NLNETLABS
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* Versions 40 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA Unbound (NLnet Labs) Fixed in 1.19.2
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
Not affected: 1 product
- Red Hat Enterprise Linux 8
Timeline
- 2026-10-02 Threatist record created from CVE-2024-1931
- 2026-10-03 Alias added: GHSA-q63v-rwfp-q5p2
References
Advisory 2
Other 4
- https://lists.fedoraproject.org/archives/list/[email protected]/message/4VCBRQ7KMSIGBQ6A4SBL5PF326DIJIIV/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/B2JUIFPA7H75Q2W3VXW2TUNHK6NVGOX4/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/RBR4H7RCVMJ6H76S4LLRSY5EBFTYWGXK/
- https://lists.freebsd.org/archives/freebsd-security/2024-July/000283.html
More NLnet Labs vulnerabilities
- TI-2026-25690 Possible arbitrary code execution during DNSSEC validation CVSS 4.0CRITICAL 9.1
- TI-2026-56302 Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY CVSS 4.0CRITICAL 9.1
- TI-2026-31146 Crash during DNSSEC validation of malicious content CVSS 4.0HIGH 8.7
- TI-2026-31135 Heap overflow with multiple NSID, COOKIE, PADDING EDNS options CVSS 4.0HIGH 8.7
- TI-2026-36436 Routinator crashes on specifically crafted RRDP XML files CVSS 4.0HIGH 8.7
- TI-2026-36433 Routinator exits when accepting an incoming HTTP or RTR connection fails CVSS 4.0HIGH 8.7
Sources
- CVE-2024-1931 · CVE Program
- CVE-2024-1931 · NVD
- FIRST EPSS
- GHSA-q63v-rwfp-q5p2 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-1931 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences