CVE-2009-3602
Unbound before 1.3.4 does not properly verify signatures for NSEC3 records, which allows remote...
Unbound before 1.3.4 does not properly verify signatures for NSEC3 records, which allows remote attackers to cause secure delegations to be downgraded via DNS spoofing or other DNS-related attacks in conjunction with crafted delegation responses.
Exploit likelihood
What each source reports
NVD Score used
Unbound before 1.3.4 does not properly verify signatures for NSEC3 records, which allows remote attackers to cause secure delegations to be downgraded via DNS spoofing or other DNS-related attacks in conjunction with crafted delegation responses.
- Record
CVE-2009-3602- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
Unbound before 1.3.4 does not properly verify signatures for NSEC3 records, which allows remote attackers to cause secure delegations to be downgraded via DNS spoofing or other DNS-related attacks in conjunction with crafted delegation responses.
- Record
CVE-2009-3602- Updated
- 2026-11-02
EUVDEUVD-2009-3583 No score
Unbound before 1.3.4 does not properly verify signatures for NSEC3 records, which allows remote attackers to cause secure delegations to be downgraded via DNS spoofing or other DNS-related attacks in conjunction with crafted delegation responses.
- Record
EUVD-2009-3583- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3xrf-3v7w-582w No score
Unbound before 1.3.4 does not properly verify signatures for NSEC3 records, which allows remote...
Unbound before 1.3.4 does not properly verify signatures for NSEC3 records, which allows remote attackers to cause secure delegations to be downgraded via DNS spoofing or other DNS-related attacks in conjunction with crafted delegation responses.
- Record
GHSA-3xrf-3v7w-582w- Updated
- 2026-11-02
OSV No score
Unbound before 1.3.4 does not properly verify signatures for NSEC3 records, which allows remote attackers to cause secure delegations to be downgraded via DNS spoofing or other DNS-related attacks in conjunction with crafted delegation responses.
- Record
CVE-2009-3602- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-3602 No score
Unbound before 1.3.4 does not properly verify signatures for NSEC3 records, which allows remote attackers to cause secure delegations to be downgraded via DNS spoofing or other DNS-related attacks in conjunction with crafted delegation responses.
- Record
DEBIAN-CVE-2009-3602- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-3602 is a high vulnerability (CVSS 7.5) in Nlnetlabs Unbound, published October 13, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.98%, the 87th percentile. Fixed in unbound 1.3.4-1.