CVE-2011-4528
Unbound before 1.4.13p2 attempts to free unallocated memory during processing of duplicate CNAME...
Unbound before 1.4.13p2 attempts to free unallocated memory during processing of duplicate CNAME records in a signed zone, which allows remote DNS servers to cause a denial of service (daemon crash) via a crafted response.
Exploit likelihood
What each source reports
NVD Score used
Unbound before 1.4.13p2 attempts to free unallocated memory during processing of duplicate CNAME records in a signed zone, which allows remote DNS servers to cause a denial of service (daemon crash) via a crafted response.
- Record
CVE-2011-4528- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
Unbound before 1.4.13p2 attempts to free unallocated memory during processing of duplicate CNAME records in a signed zone, which allows remote DNS servers to cause a denial of service (daemon crash) via a crafted response.
- Record
CVE-2011-4528- Updated
- 2026-11-02
EUVDEUVD-2011-4454 No score
Unbound before 1.4.13p2 attempts to free unallocated memory during processing of duplicate CNAME records in a signed zone, which allows remote DNS servers to cause a denial of service (daemon crash) via a crafted response.
- Record
EUVD-2011-4454- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q376-m379-55x8 No score
Unbound before 1.4.13p2 attempts to free unallocated memory during processing of duplicate CNAME...
Unbound before 1.4.13p2 attempts to free unallocated memory during processing of duplicate CNAME records in a signed zone, which allows remote DNS servers to cause a denial of service (daemon crash) via a crafted response.
- Record
GHSA-q376-m379-55x8- Updated
- 2026-11-02
OSV No score
Unbound before 1.4.13p2 attempts to free unallocated memory during processing of duplicate CNAME records in a signed zone, which allows remote DNS servers to cause a denial of service (daemon crash) via a crafted response.
- Record
CVE-2011-4528- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-4528 No score
Unbound before 1.4.13p2 attempts to free unallocated memory during processing of duplicate CNAME records in a signed zone, which allows remote DNS servers to cause a denial of service (daemon crash) via a crafted response.
- Record
DEBIAN-CVE-2011-4528- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
unboundDebian:12 |
before 1.4.14-1 | 1.4.14-1 |
unboundDebian:13 |
before 1.4.14-1 | 1.4.14-1 |
unboundDebian:14 |
before 1.4.14-1 | 1.4.14-1 |
unboundDebian:5.0 From an advisory covering 2 CVEs |
before 1.4.6-1~lenny2, plus listed versions 1.0.2-11.0.2-1+lenny11.0.2-1.11.0.2-1.21.2.1-1 Show 16 moreShow less1.2.1-1~bpo40+11.2.1-21.3.0-11.3.2-11.3.3-11.3.4-11.4.0-11.4.1-11.4.1-21.4.2-11.4.3-11.4.4-11.4.5-11.4.5-1~bpo50+11.4.6-1~bpo50+11.4.6-1~lenny1 |
1.4.6-1~lenny2 |
unboundDebian:6.0 From an advisory covering 2 CVEs |
before 1.4.6-1+squeeze2, plus listed versions 1.4.6-1 |
1.4.6-1+squeeze2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-4528 is a medium vulnerability (CVSS 5.0) in Unbound, published December 20, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.84%, the 86th percentile. Fixed in unbound 1.4.14-1.