Every CVE Search/ Get API key

CVE-2019-25035

Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par.

9.8 CriticalFix availableDisputed

CVE-2019-25035 is a critical vulnerability (CVSS 9.8) in Nlnetlabs Unbound, published April 27, 2021. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 2.88%, the 86th percentile. Fixed in unbound 1.9.6-1.

Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

2.88%Up 2.5 points since Apr 27, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited

Record
CVE-2019-25035
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-787
Updated
2026-11-02
CVE List No score

Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited

Record
CVE-2019-25035
Updated
2026-11-02
EUVDEUVD-2019-11485 No score

Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited

Record
EUVD-2019-11485
Updated
2026-11-03
GitHub AdvisoriesGHSA-2mgx-qf67-h3rj 9.8

Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par.

Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par.

Record
GHSA-2mgx-qf67-h3rj
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
OSV 9.8

Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited

Record
CVE-2019-25035
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-25035 9.8

Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited

Record
DEBIAN-CVE-2019-25035
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 9 moreShow less
OSVRHSA-2021:1853 9.8

Red Hat Security Advisory: unbound security, bug fix, and enhancement update

Record
RHSA-2021:1853
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:0632 9.8

Red Hat Security Advisory: unbound security update

Record
RHSA-2022:0632
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2021:1853 9.8

Moderate: unbound security, bug fix, and enhancement update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

  • unbound: integer overflow in the regional allocator via regional_alloc (CVE-2019-25032)

  • unbound: integer overflow in sldns_str2wire_dname_buf_origin can lead to an out-of-bounds write (CVE-2019-25034)

  • unbound: out-of-bounds write in sldns_bget_token_par (CVE-2019-25035)

  • unbound: assertion failure and denial of service in synth_cname (CVE-2019-25036)

  • unbound: assertion failure and denial of service in dname_pkt_copy via an invalid packet (CVE-2019-25037)

  • unbound: integer overflow in a size calculation in dnscrypt/dnscrypt.c (CVE-2019-25038)

  • unbound: integer overflow in a size calculation in respip/respip.c (CVE-2019-25039)

  • unbound: infinite loop via a compressed name in dname_pkt_copy (CVE-2019-25040)

  • unbound: assertion failure via a compressed name in dname_pkt_copy (CVE-2019-25041)

  • unbound: out-of-bounds write via a compressed name in rdata_copy (CVE-2019-25042)

  • unbound: symbolic link traversal when writing PID file (CVE-2020-28935)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.

Record
RLSA-2021:1853
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-25035 9.8

Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited

Record
UBUNTU-CVE-2019-25035
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2022:0176-1 No score

Security update for unbound

This update for unbound fixes the following issues:

  • CVE-2019-25031: Fixed configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack (bsc#1185382).
  • CVE-2019-25032: Fixed integer overflow in the regional allocator via regional_alloc (bsc#1185383).
  • CVE-2019-25033: Fixed integer overflow in the regional allocator via the ALIGN_UP macro (bsc#1185384).
  • CVE-2019-25034: Fixed integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write (bsc#1185385).
  • CVE-2019-25035: Fixed out-of-bounds write in sldns_bget_token_par (bsc#1185386).
  • CVE-2019-25036: Fixed assertion failure and denial of service in synth_cname (bsc#1185387).
  • CVE-2019-25037: Fixed assertion failure and denial of service in dname_pkt_copy via an invalid packet (bsc#1185388).
  • CVE-2019-25038: Fixed integer overflow in a size calculation in dnscrypt/dnscrypt.c (bsc#1185389).
  • CVE-2019-25039: Fixed integer overflow in a size calculation in respip/respip.c (bsc#1185390).
  • CVE-2019-25040: Fixed infinite loop via a compressed name in dname_pkt_copy (bsc#1185391).
  • CVE-2019-25041: Fixed assertion failure via a compressed name in dname_pkt_copy (bsc#1185392).
  • CVE-2019-25042: Fixed out-of-bounds write via a compressed name in rdata_copy (bsc#1185393).
  • CVE-2020-28935: Fixed symbolic link traversal when writing PID file (bsc#1179191).
Record
openSUSE-SU-2022:0176-1
Updated
2026-11-02
OSVSUSE-SU-2022:0176-1 No score

Security update for unbound

This update for unbound fixes the following issues:

  • CVE-2019-25031: Fixed configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack (bsc#1185382).
  • CVE-2019-25032: Fixed integer overflow in the regional allocator via regional_alloc (bsc#1185383).
  • CVE-2019-25033: Fixed integer overflow in the regional allocator via the ALIGN_UP macro (bsc#1185384).
  • CVE-2019-25034: Fixed integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write (bsc#1185385).
  • CVE-2019-25035: Fixed out-of-bounds write in sldns_bget_token_par (bsc#1185386).
  • CVE-2019-25036: Fixed assertion failure and denial of service in synth_cname (bsc#1185387).
  • CVE-2019-25037: Fixed assertion failure and denial of service in dname_pkt_copy via an invalid packet (bsc#1185388).
  • CVE-2019-25038: Fixed integer overflow in a size calculation in dnscrypt/dnscrypt.c (bsc#1185389).
  • CVE-2019-25039: Fixed integer overflow in a size calculation in respip/respip.c (bsc#1185390).
  • CVE-2019-25040: Fixed infinite loop via a compressed name in dname_pkt_copy (bsc#1185391).
  • CVE-2019-25041: Fixed assertion failure via a compressed name in dname_pkt_copy (bsc#1185392).
  • CVE-2019-25042: Fixed out-of-bounds write via a compressed name in rdata_copy (bsc#1185393).
  • CVE-2020-28935: Fixed symbolic link traversal when writing PID file (bsc#1179191).
Record
SUSE-SU-2022:0176-1
Updated
2026-11-02
OSVSUSE-SU-2022:0176-2 No score

Security update for unbound

This update for unbound fixes the following issues:

  • CVE-2019-25031: Fixed configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack (bsc#1185382).
  • CVE-2019-25032: Fixed integer overflow in the regional allocator via regional_alloc (bsc#1185383).
  • CVE-2019-25033: Fixed integer overflow in the regional allocator via the ALIGN_UP macro (bsc#1185384).
  • CVE-2019-25034: Fixed integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write (bsc#1185385).
  • CVE-2019-25035: Fixed out-of-bounds write in sldns_bget_token_par (bsc#1185386).
  • CVE-2019-25036: Fixed assertion failure and denial of service in synth_cname (bsc#1185387).
  • CVE-2019-25037: Fixed assertion failure and denial of service in dname_pkt_copy via an invalid packet (bsc#1185388).
  • CVE-2019-25038: Fixed integer overflow in a size calculation in dnscrypt/dnscrypt.c (bsc#1185389).
  • CVE-2019-25039: Fixed integer overflow in a size calculation in respip/respip.c (bsc#1185390).
  • CVE-2019-25040: Fixed infinite loop via a compressed name in dname_pkt_copy (bsc#1185391).
  • CVE-2019-25041: Fixed assertion failure via a compressed name in dname_pkt_copy (bsc#1185392).
  • CVE-2019-25042: Fixed out-of-bounds write via a compressed name in rdata_copy (bsc#1185393).
  • CVE-2020-28935: Fixed symbolic link traversal when writing PID file (bsc#1179191).
Record
SUSE-SU-2022:0176-2
Updated
2026-11-02
OSVSUSE-SU-2022:0301-1 No score

Security update for unbound

This update for unbound fixes the following issues:

  • CVE-2019-25031: Fixed configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack (bsc#1185382).
  • CVE-2019-25032: Fixed integer overflow in the regional allocator via regional_alloc (bsc#1185383).
  • CVE-2019-25033: Fixed integer overflow in the regional allocator via the ALIGN_UP macro (bsc#1185384).
  • CVE-2019-25034: Fixed integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write (bsc#1185385).
  • CVE-2019-25035: Fixed out-of-bounds write in sldns_bget_token_par (bsc#1185386).
  • CVE-2019-25036: Fixed assertion failure and denial of service in synth_cname (bsc#1185387).
  • CVE-2019-25037: Fixed assertion failure and denial of service in dname_pkt_copy via an invalid packet (bsc#1185388).
  • CVE-2019-25038: Fixed integer overflow in a size calculation in dnscrypt/dnscrypt.c (bsc#1185389).
  • CVE-2019-25039: Fixed integer overflow in a size calculation in respip/respip.c (bsc#1185390).
  • CVE-2019-25040: Fixed infinite loop via a compressed name in dname_pkt_copy (bsc#1185391).
  • CVE-2019-25041: Fixed assertion failure via a compressed name in dname_pkt_copy (bsc#1185392).
  • CVE-2019-25042: Fixed out-of-bounds write via a compressed name in rdata_copy (bsc#1185393).
  • CVE-2020-28935: Fixed symbolic link traversal when writing PID file (bsc#1179191).
Record
SUSE-SU-2022:0301-1
Updated
2026-11-02
OSVUSN-4938-1 No score

unbound vulnerabilities

It was discovered that Unbound contained multiple security issues. A remote attacker could possibly use these issues to cause a denial of service, inject arbitrary commands, execute arbitrary code, and overwrite local files.

Record
USN-4938-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
unbound
Debian:12
 before 1.9.6-1
1.9.6-1
unbound
Debian:13
 before 1.9.6-1
1.9.6-1
unbound
Debian:14
 before 1.9.6-1
1.9.6-1
unbound1.9
Debian:9
 before 1.9.0-2+deb10u2~deb9u2
1.9.0-2+deb10u2~deb9u2
python3-unbound
Red Hat:enterprise_linux:8::appstream
 before 0:1.7.3-15.el8
0:1.7.3-15.el8
python3-unbound-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.7.3-15.el8
0:1.7.3-15.el8
unbound
Red Hat:enterprise_linux:8::appstream
 before 0:1.7.3-15.el8
0:1.7.3-15.el8
unbound-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.7.3-15.el8
0:1.7.3-15.el8
unbound-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.7.3-15.el8
0:1.7.3-15.el8
unbound-devel
Red Hat:enterprise_linux:8::appstream
 before 0:1.7.3-15.el8
0:1.7.3-15.el8
Show 35 moreShow less
Affected packages
PackageAffectedFixed
unbound-libs
Red Hat:enterprise_linux:8::appstream
 before 0:1.7.3-15.el8
0:1.7.3-15.el8
unbound-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.7.3-15.el8
0:1.7.3-15.el8
python3-unbound
Red Hat:rhel_eus:8.2::appstream
 before 0:1.7.3-12.el8_2
0:1.7.3-12.el8_2
python3-unbound-debuginfo
Red Hat:rhel_eus:8.2::appstream
 before 0:1.7.3-12.el8_2
0:1.7.3-12.el8_2
unbound
Red Hat:rhel_eus:8.2::appstream
 before 0:1.7.3-12.el8_2
0:1.7.3-12.el8_2
unbound-debuginfo
Red Hat:rhel_eus:8.2::appstream
 before 0:1.7.3-12.el8_2
0:1.7.3-12.el8_2
unbound-debugsource
Red Hat:rhel_eus:8.2::appstream
 before 0:1.7.3-12.el8_2
0:1.7.3-12.el8_2
unbound-devel
Red Hat:rhel_eus:8.2::appstream
 before 0:1.7.3-12.el8_2
0:1.7.3-12.el8_2
unbound-libs
Red Hat:rhel_eus:8.2::appstream
 before 0:1.7.3-12.el8_2
0:1.7.3-12.el8_2
unbound-libs-debuginfo
Red Hat:rhel_eus:8.2::appstream
 before 0:1.7.3-12.el8_2
0:1.7.3-12.el8_2
unbound
Rocky Linux:8
 before 0:1.7.3-15.el8
0:1.7.3-15.el8
unbound
SUSE:Linux Enterprise Module for Basesystem 15 SP3
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
SUSE:Linux Enterprise Server 15 SP1-BCL
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
SUSE:Linux Enterprise Server 15 SP1-LTSS
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
SUSE:Linux Enterprise Server 15 SP2-BCL
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
SUSE:Linux Enterprise Server 15 SP2-LTSS
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
SUSE:Manager Proxy 4.1
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
SUSE:Manager Retail Branch Server 4.1
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
SUSE:Manager Server 4.1
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
SUSE:Enterprise Storage 6
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
SUSE:Enterprise Storage 7
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
SUSE:Linux Enterprise Real Time 15 SP2
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
 before 1.6.8-3.9.1
1.6.8-3.9.1
unbound
SUSE:Linux Enterprise High Performance Computing 15-LTSS
 before 1.6.8-3.9.1
1.6.8-3.9.1
unbound
SUSE:Linux Enterprise Server 15-LTSS
 before 1.6.8-3.9.1
1.6.8-3.9.1
unbound
SUSE:Linux Enterprise Server for SAP Applications 15
 before 1.6.8-3.9.1
1.6.8-3.9.1
unbound
Ubuntu:18.04:LTS
 before 1.6.7-1ubuntu2.4, plus listed versions
1.6.5-11.6.7-11.6.7-1build11.6.7-1ubuntu11.6.7-1ubuntu21.6.7-1ubuntu2.11.6.7-1ubuntu2.21.6.7-1ubuntu2.3
1.6.7-1ubuntu2.4
unbound
Ubuntu:20.04:LTS
 before 1.9.4-2ubuntu1.2, plus listed versions
1.9.0-2ubuntu11.9.0-2ubuntu21.9.4-21.9.4-2ubuntu11.9.4-2ubuntu1.1
1.9.4-2ubuntu1.2
unbound
openSUSE:Leap 15.3
 before 1.6.8-10.6.1
1.6.8-10.6.1

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 100 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open