Every CVE Search/ Get API key

CVE-2014-8602

iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining, which allows...

4.3 MediumFix available

iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a large or infinite number of referrals.

Exploit likelihood

32.2%Up 30.8 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a large or infinite number of referrals.

Record
CVE-2014-8602
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-399
Updated
2026-11-02
CVE List No score

iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a large or infinite number of referrals.

Record
CVE-2014-8602
Updated
2026-11-02
EUVDEUVD-2014-8439 No score

iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a large or infinite number of referrals.

Record
EUVD-2014-8439
Updated
2026-11-03
GitHub AdvisoriesGHSA-rmpj-rcj8-qh82 No score

iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining, which allows...

iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a large or infinite number of referrals.

Record
GHSA-rmpj-rcj8-qh82
Updated
2026-11-02
OSV No score

iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a large or infinite number of referrals.

Record
CVE-2014-8602
Updated
2026-11-02
OSVDEBIAN-CVE-2014-8602 No score

iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a large or infinite number of referrals.

Record
DEBIAN-CVE-2014-8602
Updated
2026-11-02
OSVopenSUSE-SU-2024:10121-1 No score

libunbound-devel-mini-1.5.10-1.1 on GA media

These are all security issues fixed in the libunbound-devel-mini-1.5.10-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10121-1
Updated
2026-11-02
OSVUBUNTU-CVE-2014-8602 No score

iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a large or infinite number of referrals.

Record
UBUNTU-CVE-2014-8602
Updated
2026-11-02
OSVUSN-2484-1 No score

unbound vulnerability

Florian Maury discovered that Unbound incorrectly handled delegation. A remote attacker could possibly use this issue to cause Unbound to consume resources, resulting in a denial of service.

Record
USN-2484-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
unbound
Debian:12
 before 1.4.22-3
1.4.22-3
unbound
Debian:13
 before 1.4.22-3
1.4.22-3
unbound
Debian:14
 before 1.4.22-3
1.4.22-3
unbound
Debian:6.0
 before 1.4.6-1+squeeze4, plus listed versions
1.4.6-11.4.6-1+squeeze21.4.6-1+squeeze3
1.4.6-1+squeeze4
unbound
Debian:7
 before 1.4.17-3+deb7u2, plus listed versions
1.4.17-31.4.17-3+deb7u1
1.4.17-3+deb7u2
unbound-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound-devel
Red Hat:enterprise_linux:7::client
 before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound-python
Red Hat:enterprise_linux:7::client
 before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound
Red Hat:enterprise_linux:7::client
 before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound-libs
Red Hat:enterprise_linux:7::client
 before 0:1.4.20-26.el7
0:1.4.20-26.el7
Show 17 moreShow less
Affected packages
PackageAffectedFixed
unbound
Red Hat:enterprise_linux:7::computenode
 before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound-devel
Red Hat:enterprise_linux:7::computenode
 before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound-python
Red Hat:enterprise_linux:7::computenode
 before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound-libs
Red Hat:enterprise_linux:7::computenode
 before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound-devel
Red Hat:enterprise_linux:7::server
 before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound-python
Red Hat:enterprise_linux:7::server
 before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound
Red Hat:enterprise_linux:7::server
 before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound-libs
Red Hat:enterprise_linux:7::server
 before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound-devel
Red Hat:enterprise_linux:7::workstation
 before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound-python
Red Hat:enterprise_linux:7::workstation
 before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound
Red Hat:enterprise_linux:7::workstation
 before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound-libs
Red Hat:enterprise_linux:7::workstation
 before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound
Ubuntu:14.04:LTS
 before 1.4.22-1ubuntu4.14.04.1, plus listed versions
1.4.20-11.4.21-11.4.21-1ubuntu11.4.21-1ubuntu21.4.22-1ubuntu11.4.22-1ubuntu21.4.22-1ubuntu31.4.22-1ubuntu4
1.4.22-1ubuntu4.14.04.1
unbound
openSUSE:Tumbleweed
 before 1.5.10-1.1
1.5.10-1.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-8602 is a medium vulnerability (CVSS 4.3) in Nlnetlabs Unbound, published December 10, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 32.2%, the 98th percentile. Fixed in unbound 1.4.22-3.

References

Show 17 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open