Skip to content
Fencer Vulns
medium 5.3

CVE-2024-8508 json

Unbounded name compression could lead to Denial of Service

published 2024-10-03 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-49228

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 56%
public exploits
0
none known

Summary

NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compression for. Malicious upstreams responses with very large RRsets can cause Unbound to spend a considerable time applying name compression to downstream replies. This can lead to degraded performance and eventually denial of service in well orchestrated attacks. The vulnerability can be exploited by a malicious actor querying Unbound for the specially crafted contents of a malicious zone with very large RRsets. Before Unbound replies to the query it will try to apply name compression which was an unbounded operation that could lock the CPU until the whole packet was complete. Unbound version 1.21.1 introduces a hard limit on the number of name compression calculations it is willing to do per packet. Packets that need more compression will result in semi-compressed packets or truncated packets, even on TCP for huge messages, to avoid locking the CPU for long. This change should not affect normal DNS traffic.

Patch / fix

  • nlnetlabs unbound 1.21.1
  • unbound Debian 12 1.17.1-2+deb12u3
  • unbound Debian 14, Debian 13 1.21.1-1

debian advisories DEBIAN-CVE-2024-8508

  • unbound Ubuntu 20.04 LTS 1.9.4-2ubuntu1.9
  • unbound Ubuntu 22.04 LTS 1.13.1-1ubuntu5.8
  • unbound Ubuntu 24.04 LTS 1.19.2-1ubuntu3.3
  • unbound Ubuntu Pro 14.04 LTS 1.4.22-1ubuntu4.14.04.3+esm2
  • unbound Ubuntu Pro 16.04 LTS 1.5.8-1ubuntu1.1+esm2
  • unbound Ubuntu Pro 18.04 LTS 1.6.7-1ubuntu2.6+esm3

ubuntu advisories UBUNTU-CVE-2024-8508

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • unbound RHEL 9 1.16.2-18.el9_6
  • unbound-libs RHEL 9 1.16.2-18.el9_6
  • unbound-dracut RHEL 9 1.16.2-18.el9_6
  • python3-unbound RHEL 9 1.16.2-18.el9_6
  • unbound RHEL 10.0 1.20.0-10.el10_0
  • unbound-libs RHEL 10.0 1.20.0-10.el10_0
  • unbound-anchor RHEL 10.0 1.20.0-10.el10_0
  • unbound-dracut RHEL 10.0 1.20.0-10.el10_0

red hat advisories RHSA-2025:8197RHSA-2025:8047RHSA-2025:0837RHSA-2024:11232RHSA-2024:11170

  • unbound Linux Micro 6.1 1.22.0-slfo.1.1_1.1
  • unbound Linux Micro 6.0 1.22.0-1.1
  • unbound SLE Module for Package Hub 15 SP6, SLE Module for Basesystem 15 SP6, openSUSE Leap 15.6 1.20.0-150600.23.9.1
  • unbound SLE Module for Package Hub 15 SP5, SLE Module for Basesystem 15 SP5, SLE Micro 5.5 +1 more 1.20.0-150100.10.19.1

suse advisories SUSE-SU-2025:20359-1SUSE-SU-2025:20126-1SUSE-SU-2024:3647-1SUSE-SU-2024:3646-1

  • unbound openSUSE Tumbleweed 1.21.1-1.1

opensuse advisories openSUSE-SU-2024:14391-1

  • unbound AlmaLinux 10 1.20.0-10.el10_0
  • unbound-libs AlmaLinux 10 1.20.0-10.el10_0
  • unbound-anchor AlmaLinux 10 1.20.0-10.el10_0
  • unbound-dracut AlmaLinux 10 1.20.0-10.el10_0
  • python3-unbound AlmaLinux 10 1.20.0-10.el10_0
  • unbound AlmaLinux 8 1.16.2-5.8.el8_10
  • unbound-libs AlmaLinux 8 1.16.2-5.8.el8_10
  • python3-unbound AlmaLinux 8 1.16.2-5.8.el8_10

almalinux advisories ALSA-2025:8047ALSA-2025:0837ALSA-2024:11232

  • unbound Rocky Linux 9 1.16.2-18.el9_6
  • unbound Rocky Linux 10 1.20.0-10.el10_0
  • unbound Rocky Linux 9 1.16.2-8.el9_5.1
  • unbound Rocky Linux 8 1.16.2-5.8.el8_10

rocky linux advisories RLSA-2025:8197RLSA-2025:8047RLSA-2024:11232RLSA-2025:0837

  • unbound Alpine 3.20, Alpine 3.19, Alpine 3.18 +1 more 1.20.0-r1
  • unbound Alpine 3.24, Alpine 3.23, Alpine 3.22 +1 more 1.21.1-r0

alpine advisories ALPINE-CVE-2024-8508

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • unbound Azure Linux 3.0 1.19.1-4
  • unbound CBL-Mariner 2.0 1.19.1-3

azure linux advisories AZL-49915AZL-49976

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-8508 updated cvss 5.3

unbound: Unbounded name compression could lead to Denial of Service

  • Red Hat Enterprise Linux 6 unbound, unbound-libs, unbound-python Red Hat Enterprise Linux 7 unbound, unbound-libs, unbound-python
    affected: no fix planned “Out of support scope”
  • Red Hat OpenStack Platform 18.0 openstack-unbound-container
    affected: no fix available
  • Red Hat CodeReady Linux Builder (v. 9) unbound-devel 1.16.2-8.el9_5.1, unbound-debuginfo 1.16.2-8.el9_5.1, unbound-debugsource 1.16.2-8.el9_5.1, unbound-libs-debuginfo 1.16.2-8.el9_5.1, python3-unbound-debuginfo 1.16.2-8.el9_5.1
    fixed: vendor fix RHSA-2024:11232
  • Red Hat CodeReady Linux Builder EUS (v.9.4) unbound-devel 1.16.2-8.el9_4.1, unbound-debuginfo 1.16.2-8.el9_4.1, unbound-debugsource 1.16.2-8.el9_4.1, unbound-libs-debuginfo 1.16.2-8.el9_4.1, python3-unbound-debuginfo 1.16.2-8.el9_4.1
    fixed: vendor fix RHSA-2024:11170
  • Red Hat Enterprise Linux AppStream (v. 8) unbound 1.16.2-5.8.el8_10, unbound-libs 1.16.2-5.8.el8_10, python3-unbound 1.16.2-5.8.el8_10
    fixed: vendor fix RHSA-2025:0837
  • Red Hat Enterprise Linux AppStream (v. 9) unbound 1.16.2-18.el9_6, unbound 1.16.2-8.el9_5.1, unbound-libs 1.16.2-18.el9_6, unbound-libs 1.16.2-8.el9_5.1, unbound-dracut 1.16.2-18.el9_6, python3-unbound 1.16.2-18.el9_6, +1 more
    fixed: vendor fix RHSA-2024:11232
  • Red Hat Enterprise Linux AppStream (v. 10) unbound 1.20.0-10.el10_0, unbound-libs 1.20.0-10.el10_0, unbound-anchor 1.20.0-10.el10_0, unbound-dracut 1.20.0-10.el10_0, python3-unbound 1.20.0-10.el10_0
    fixed: vendor fix RHSA-2025:8047
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) unbound 1.16.2-8.el9_4.1, unbound-libs 1.16.2-8.el9_4.1, python3-unbound 1.16.2-8.el9_4.1
    fixed: vendor fix RHSA-2024:11170
show 5 more
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) unbound-devel 1.16.2-18.el9_6, unbound-debuginfo 1.16.2-18.el9_6, unbound-debugsource 1.16.2-18.el9_6, unbound-libs-debuginfo 1.16.2-18.el9_6, python3-unbound-debuginfo 1.16.2-18.el9_6
    fixed: vendor fix RHSA-2025:8197
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) unbound-devel 1.20.0-10.el10_0, unbound-debuginfo 1.20.0-10.el10_0, unbound-debugsource 1.20.0-10.el10_0, unbound-libs-debuginfo 1.20.0-10.el10_0, unbound-utils-debuginfo 1.20.0-10.el10_0, unbound-anchor-debuginfo 1.20.0-10.el10_0, +1 more
    fixed: vendor fix RHSA-2025:8047
  • Red Hat OpenShift Container Platform 4.16 rhcos 416.94.202501030250-0
    fixed: vendor fix RHSA-2025:0140
  • Red Hat OpenShift Container Platform 4.17 rhcos 417.94.202502051822-0
    fixed: vendor fix RHSA-2025:1120
  • Red Hat OpenShift Container Platform 4.16 openshift4/ose-tests-rhel9 v4.16.0-202501080105.p0.gc740dbd.assembly.stream.el9, openshift4/ose-tools-rhel9 v4.16.0-202501080105.p0.gcf533b5.assembly.stream.el9, openshift4/ose-console-rhel9 v4.16.0-202501080105.p0.g6fe3e8b.assembly.stream.el9, openshift4/network-tools-rhel9 v4.16.0-202501080105.p0.g39eca10.assembly.stream.el9, openshift4/driver-toolkit-rhel9 v4.16.0-202501081237.p0.g1d5732f.assembly.stream.el9, openshift4/ose-hypershift-rhel9 v4.16.0-202501072135.p0.ge3c671d.assembly.stream.el9, +13 more Red Hat OpenShift Container Platform 4.17 openshift4/frr-rhel9 v4.17.0-202502051233.p0.g377d02f.assembly.stream.el9, openshift4/ose-cli-rhel9 v4.17.0-202502051534.p0.g1b0bf08.assembly.stream.el9, openshift4/ose-tests-rhel9 v4.17.0-202502051534.p0.g73c6041.assembly.stream.el9, openshift4/ose-tools-rhel9 v4.17.0-202502051534.p0.g1b0bf08.assembly.stream.el9, openshift4/ose-ironic-rhel9 v4.17.0-202502051933.p0.g1473528.assembly.stream.el9, openshift4/ose-console-rhel9 v4.17.0-202502052104.p0.g6f7e5c9.assembly.stream.el9, +17 more Red Hat OpenStack Platform 17.1 openstack-unbound-container
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.80% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

  • NLnet Labs Unbound
  • nlnetlabs unbound

Classification

Weakness
  • CWE-606 Unchecked Input for Loop Condition
  • CWE-1284 Improper Validation of Specified Quantity in Input

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.