CVE-2024-33655

The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service (resource consumption) by arranging for DNS queries to be accumulated for seconds, such that responses are later sent in a pulsing burst (which can be considered traffic amplification in some cases), aka the "DNSBomb" issue.

Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn't make custom builds or provide specific features to paying customers only.

Security Fix(es):

The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service (resource consumption) by arranging for DNS queries to be accumulated for seconds, such that responses are later sent in a pulsing burst (which can be considered traffic amplification in some cases), aka the "DNSBomb" issue.(CVE-2024-33655)

Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn't make custom builds or provide specific features to paying customers only.

Security Fix(es):

The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service (resource consumption) by arranging for DNS queries to be accumulated for seconds, such that responses are later sent in a pulsing burst (which can be considered traffic amplification in some cases), aka the "DNSBomb" issue.(CVE-2024-33655)

Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn't make custom builds or provide specific features to paying customers only.

Security Fix(es):

The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service (resource consumption) by arranging for DNS queries to be accumulated for seconds, such that responses are later sent in a pulsing burst (which can be considered traffic amplification in some cases), aka the "DNSBomb" issue.(CVE-2024-33655)

Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn't make custom builds or provide specific features to paying customers only.

Security Fix(es):

The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service (resource consumption) by arranging for DNS queries to be accumulated for seconds, such that responses are later sent in a pulsing burst (which can be considered traffic amplification in some cases), aka the "DNSBomb" issue.(CVE-2024-33655)

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

• unbound: DNSBomb vulnerability (CVE-2024-33655)

• unbound: Unbound domain hijacking via promiscuous records (CVE-2025-11411)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

• unbound: DNSBomb vulnerability (CVE-2024-33655)

• unbound: Unbound domain hijacking via promiscuous records (CVE-2025-11411)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.

The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service (resource consumption) by arranging for DNS queries to be accumulated for seconds, such that responses are later sent in a pulsing burst (which can be considered traffic amplification in some cases), aka the "DNSBomb" issue.

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

• unbound: DNSBomb vulnerability (CVE-2024-33655)
• unbound: Unbound domain hijacking via promiscuous records (CVE-2025-11411)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

• unbound: DNSBomb vulnerability (CVE-2024-33655)
• unbound: Unbound domain hijacking via promiscuous records (CVE-2025-11411)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.

The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service (resource consumption) by arranging for DNS queries to be accumulated for seconds, such that responses are later sent in a pulsing burst (which can be considered traffic amplification in some cases), aka the "DNSBomb" issue.

The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service (resource consumption) by arranging for DNS queries to be accumulated for seconds, such that responses are later sent in a pulsing burst (which can be considered traffic amplification in some cases), aka the "DNSBomb" issue.

• CVE-2024-33655: add discard-timeout and per-IP wait-limit controls to bound the number of recursion replies queued per client, mitigating the DNSBomb pulsing denial-of-service attack

• CVE-2024-33655: add the upstream wait-limit and discard-timeout mechanism so accumulated recursion replies can no longer be released as a pulsing burst (DNSBomb), including every upstream follow-up to that mechanism: discard only UDP replies and never a reply on an open stream connection, clear the HTTP/2 stream back-pointer on the drop paths, account discarded replies in mesh num_reply_addrs, and fix CVE-2026-56444 in the serve-expired discard path
• CVE-2024-43167: NULL-check the first forward stub name in ub_ctx_set_fwd() to prevent a NULL pointer dereference in libunbound, and reject a forward-zone, stub-zone or view without a name at config parse time so no name-less object reaches the daemon
• CVE-2026-42955: clamp the cached TTL of parent-side A/AAAA glue as well as NS records so a client query can no longer renew a ghost domain delegation
• CVE-2026-46582: keep a secure wildcard RRset out of the rrset cache until the NSEC wildcard proof completes, preventing poisoning via the serve-expired reply path
• CVE-2026-50243: skip the response-ip/RPZ rewrite for BOGUS answers so a spoofed DNSSEC-protected answer is no longer redirected as INSECURE
• CVE-2026-55708: enter the default-protected local zones when unbound-control view_local_data creates a view-specific local zone tree

Along with various minor bug fixing, this update addresses the security vulnerability CVE-2024-33655 which would have allowed unbound to be used as a DNSBomb.

These are all security issues fixed in the libunbound8-1.20.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for unbound fixes the following issues:

• Update to 1.20.0: Features:

  • The config for discard-timeout, wait-limit, wait-limit-cookie, wait-limit-netblock and wait-limit-cookie-netblock was added, for the fix to the DNSBomb issue.
  • Merge GH#1027: Introduce 'cache-min-negative-ttl' option.
  • Merge GH#1043 from xiaoxiaoafeifei: Add loongarch support; updates config.guess(2024-01-01) and config.sub(2024-01-01), verified with upstream.
  • Implement cachedb-check-when-serve-expired: yes option, default is enabled. When serve expired is enabled with cachedb, it first checks cachedb before serving the expired response.
  • Fix GH#876: [FR] can unbound-checkconf be silenced when configuration is valid?

  Bug Fixes:

  • Fix for the DNSBomb vulnerability CVE-2024-33655. Thanks to Xiang Li from the Network and Information Security Lab of Tsinghua University for reporting it.
  • Update doc/unbound.doxygen with 'doxygen -u'. Fixes option deprecation warnings and updates with newer defaults.
  • Remove unused portion from iter_dname_ttl unit test.
  • Fix validator classification of qtype DNAME for positive and redirection answers, and fix validator signature routine for dealing with the synthesized CNAME for a DNAME without previously encountering it and also for when the qtype is DNAME.
  • Fix qname minimisation for reply with a DNAME for qtype CNAME that answers it.
  • Fix doc test so it ignores but outputs unsupported doxygen options.
  • Fix GH#1021 Inconsistent Behavior with Changing rpz-cname-override and doing a unbound-control reload.
  • Merge GH#1028: Clearer documentation for tcp-idle-timeout and edns-tcp-keepalive-timeout.
  • Fix GH#1029: rpz trigger clientip and action rpz-passthru not working as expected.
  • Fix rpz that the rpz override is taken in case of clientip triggers. Fix that the clientip passthru action is logged. Fix that the clientip localdata action is logged. Fix rpz override action cname for the clientip trigger.
  • Fix to unify codepath for local alias for rpz cname action override.
  • Fix rpz for cname override action after nsdname and nsip triggers.
  • Fix that addrinfo is not kept around but copied and freed, so that log-destaddr uses a copy of the information, much like NSD does.
  • Merge GH#1030: Persist the openssl and expat directories for repeated Windows builds.
  • Fix that rpz CNAME content is limited to the max number of cnames.
  • Fix rpz, it follows iterator CNAMEs for nsip and nsdname and sets the reply query_info values, that is better for debug logging.
  • Fix rpz that copies the cname override completely to the temp region, so there are no references to the rpz region.
  • Add rpz unit test for nsip action override.
  • Fix rpz for qtype CNAME after nameserver trigger.
  • Fix rpz so that rpz CNAME can apply after rpz CNAME. And fix that clientip and nsip can give a CNAME.
  • Fix localdata and rpz localdata to match CNAME only if no direct type match is available.
  • Merge GH#831 from Pierre4012: Improve Windows NSIS installer script (setup.nsi).
  • For GH#831: Format text, use exclamation icon and explicit label names.
  • Fix name of unit test for subnet cache response.
  • Fix GH#1032: The size of subnet_msg_cache calculation mistake cause memory usage increased beyond expectations.
  • Fix for GH#1032, add safeguard to make table space positive.
  • Fix comment in lruhash space function.
  • Fix to add unit test for lruhash space that exercises the routines.
  • Fix that when the server truncates the pidfile, it does not follow symbolic links.
  • Fix that the server does not chown the pidfile.
  • Fix GH#1034: DoT forward-zone via unbound-control.
  • Fix for crypto related failures to have a better error string.
  • Fix GH#1035: Potential Bug while parsing port from the "stub-host" string; also…

It was discovered that Unbound could take part in a denial of service amplification attack known as DNSBomb. This update introduces certain resource limits to make the impact from Unbound significantly lower.