{"id":"CVE-2019-25035","aliases":["DEBIAN-CVE-2019-25035","DLA-2652-1","EUVD-2019-11485","GHSA-2mgx-qf67-h3rj","RHSA-2021:1853","RHSA-2022:0632","RLSA-2021:1853","SUSE-SU-2022:0176-1","SUSE-SU-2022:0176-2","SUSE-SU-2022:0301-1","UBUNTU-CVE-2019-25035","USN-4938-1","openSUSE-SU-2022:0176-1"],"status":"disputed","title":"Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par.","description":"Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02881,"percentile":0.86936,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2021-04-27T05:17:34Z","modified":"2026-10-24T14:03:42Z","fixes":[{"ecosystem":"Debian:12","package":"unbound","fixed_in":["1.9.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"unbound","fixed_in":["1.9.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"unbound","fixed_in":["1.9.6-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"unbound","fixed_in":["1.6.7-1ubuntu2.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"unbound","fixed_in":["1.9.4-2ubuntu1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.6-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"unbound1.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-2+deb10u2~deb9u2"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-15.el8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-15.el8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-15.el8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-15.el8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-15.el8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-15.el8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-15.el8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-15.el8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-12.el8_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"python3-unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-12.el8_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-12.el8_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-12.el8_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"unbound-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-12.el8_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-12.el8_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-12.el8_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"unbound-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-12.el8_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Rocky Linux:8","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-15.el8"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-3.9.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-3.9.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-3.9.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-3.9.1"}]}],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.7-1ubuntu2.4"}]}],"versions":["1.6.5-1","1.6.7-1","1.6.7-1build1","1.6.7-1ubuntu1","1.6.7-1ubuntu2","1.6.7-1ubuntu2.1","1.6.7-1ubuntu2.2","1.6.7-1ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-2ubuntu1.2"}]}],"versions":["1.9.0-2ubuntu1","1.9.0-2ubuntu2","1.9.4-2","1.9.4-2ubuntu1","1.9.4-2ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.7-1ubuntu2.4"}]}],"versions":["1.6.5-1","1.6.7-1","1.6.7-1build1","1.6.7-1ubuntu1","1.6.7-1ubuntu2","1.6.7-1ubuntu2.1","1.6.7-1ubuntu2.2","1.6.7-1ubuntu2.3"],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-2ubuntu1.2"}]}],"versions":["1.9.0-2ubuntu1","1.9.0-2ubuntu2","1.9.4-2","1.9.4-2ubuntu1","1.9.4-2ubuntu1.1"],"bundled":13},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"nlnetlabs","product":"unbound"}],"references":[{"url":"https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/","tags":["x_refsource_MISC","x_transferred","Not Applicable","Third Party Advisory","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20210507-0007/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25035","tags":["advisory"]},{"url":"https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results"},{"url":"https://security.netapp.com/advisory/ntap-20210507-0007"},{"url":"https://github.com/advisories/GHSA-2mgx-qf67-h3rj"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-25035","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:1853","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1714175","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1842837","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1850460","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1878761","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1954772","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1954778","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1954780","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1954782","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1954794","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1954796","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1954797","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1954799","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1954801","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1954804","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1853.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-25032","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-25032","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25032","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-25034","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-25034","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25034","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-25035","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-25035","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-25036","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-25036","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25036","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-25037","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-25037","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25037","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-25038","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-25038","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25038","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-25039","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-25039","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25039","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-25040","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-25040","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25040","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-25041","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-25041","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25041","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-25042","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-25042","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25042","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-28935","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-28935","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28935","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0632","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0632.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:1853","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220176-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1076963","tags":["report"]},{"url":"https://bugzilla.suse.com/1112009","tags":["report"]},{"url":"https://bugzilla.suse.com/1112033","tags":["report"]},{"url":"https://bugzilla.suse.com/1179191","tags":["report"]},{"url":"https://bugzilla.suse.com/1185382","tags":["report"]},{"url":"https://bugzilla.suse.com/1185383","tags":["report"]},{"url":"https://bugzilla.suse.com/1185384","tags":["report"]},{"url":"https://bugzilla.suse.com/1185385","tags":["report"]},{"url":"https://bugzilla.suse.com/1185386","tags":["report"]},{"url":"https://bugzilla.suse.com/1185387","tags":["report"]},{"url":"https://bugzilla.suse.com/1185388","tags":["report"]},{"url":"https://bugzilla.suse.com/1185389","tags":["report"]},{"url":"https://bugzilla.suse.com/1185390","tags":["report"]},{"url":"https://bugzilla.suse.com/1185391","tags":["report"]},{"url":"https://bugzilla.suse.com/1185392","tags":["report"]},{"url":"https://bugzilla.suse.com/1185393","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28935","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220176-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220301-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-25035","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4938-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-25031","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-25032","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-25033","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-25034","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-25036","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-25037","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-25038","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-25039","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-25040","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-25041","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-25042","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-28935","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JTS3PI42CZC7TVKVUTBOIMO2PDFTABYC/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-25035","description":"Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited","status":"disputed","published":"2021-04-27T05:17:34Z","modified":"2024-08-05T03:00:18.86Z","updated_at":"2026-11-02T14:20:19.737165Z"}],"euvd":[{"id":"EUVD-2019-11485","description":"Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited","status":"published","published":"2021-04-27T05:17:34Z","modified":"2024-08-05T03:00:18Z","updated_at":"2026-11-03T02:40:20.270172Z"}],"ghsa":[{"id":"GHSA-2mgx-qf67-h3rj","title":"Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par.","description":"Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par.","status":"published","published":"2022-05-24T17:48:56Z","modified":"2024-03-21T03:34:04Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:55:42.026509Z"}],"nvd":[{"id":"CVE-2019-25035","description":"Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited","status":"disputed","published":"2021-04-27T06:15:07.56Z","modified":"2026-06-17T02:31:31.453Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:05:48.502374Z"}],"osv":[{"id":"CVE-2019-25035","description":"Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited","status":"published","published":"2021-04-27T06:15:07.56Z","modified":"2026-10-24T14:03:42.184946336Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:12.363788Z"},{"id":"DEBIAN-CVE-2019-25035","description":"Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited","status":"published","published":"2021-04-27T06:15:07.56Z","modified":"2026-09-21T07:02:54.899979242Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"RHSA-2021:1853","title":"Red Hat Security Advisory: unbound security, bug fix, and enhancement update","status":"published","published":"2024-09-16T05:07:35Z","modified":"2026-06-27T10:13:35Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2022:0632","title":"Red Hat Security Advisory: unbound security update","status":"published","published":"2024-09-16T05:07:43Z","modified":"2026-06-27T10:14:41Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RLSA-2021:1853","title":"Moderate: unbound security, bug fix, and enhancement update","description":"The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. \n\nSecurity Fix(es):\n\n* unbound: integer overflow in the regional allocator via regional_alloc (CVE-2019-25032)\n\n* unbound: integer overflow in sldns_str2wire_dname_buf_origin can lead to an out-of-bounds write (CVE-2019-25034)\n\n* unbound: out-of-bounds write in sldns_bget_token_par (CVE-2019-25035)\n\n* unbound: assertion failure and denial of service in synth_cname (CVE-2019-25036)\n\n* unbound: assertion failure and denial of service in dname_pkt_copy via an invalid packet (CVE-2019-25037)\n\n* unbound: integer overflow in a size calculation in dnscrypt/dnscrypt.c (CVE-2019-25038)\n\n* unbound: integer overflow in a size calculation in respip/respip.c (CVE-2019-25039)\n\n* unbound: infinite loop via a compressed name in dname_pkt_copy (CVE-2019-25040)\n\n* unbound: assertion failure via a compressed name in dname_pkt_copy (CVE-2019-25041)\n\n* unbound: out-of-bounds write via a compressed name in rdata_copy (CVE-2019-25042)\n\n* unbound: symbolic link traversal when writing PID file (CVE-2020-28935)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.","status":"published","published":"2021-05-18T06:15:09Z","modified":"2026-02-05T08:15:12.220679Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2019-25035","description":"Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited","status":"published","published":"2021-04-27T06:15:00Z","modified":"2026-04-22T12:18:04.777817Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"DLA-2652-1","title":"unbound1.9 - security update","status":"published","published":"2021-05-06T00:00:00Z","modified":"2026-03-09T01:21:22.194101Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"openSUSE-SU-2022:0176-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\n- CVE-2019-25031: Fixed configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack (bsc#1185382).\n- CVE-2019-25032: Fixed integer overflow in the regional allocator via regional_alloc (bsc#1185383).\n- CVE-2019-25033: Fixed integer overflow in the regional allocator via the ALIGN_UP macro (bsc#1185384).\n- CVE-2019-25034: Fixed integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write (bsc#1185385).\n- CVE-2019-25035: Fixed out-of-bounds write in sldns_bget_token_par (bsc#1185386).\n- CVE-2019-25036: Fixed assertion failure and denial of service in synth_cname (bsc#1185387).\n- CVE-2019-25037: Fixed assertion failure and denial of service in dname_pkt_copy via an invalid packet (bsc#1185388).\n- CVE-2019-25038: Fixed integer overflow in a size calculation in dnscrypt/dnscrypt.c (bsc#1185389).\n- CVE-2019-25039: Fixed integer overflow in a size calculation in respip/respip.c (bsc#1185390).\n- CVE-2019-25040: Fixed infinite loop via a compressed name in dname_pkt_copy (bsc#1185391).\n- CVE-2019-25041: Fixed assertion failure via a compressed name in dname_pkt_copy (bsc#1185392).\n- CVE-2019-25042: Fixed out-of-bounds write via a compressed name in rdata_copy (bsc#1185393).\n- CVE-2020-28935: Fixed symbolic link traversal when writing PID file (bsc#1179191).\n","status":"published","published":"2022-01-25T13:13:02Z","modified":"2025-05-07T18:11:02.529949Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"SUSE-SU-2022:0176-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\n- CVE-2019-25031: Fixed configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack (bsc#1185382).\n- CVE-2019-25032: Fixed integer overflow in the regional allocator via regional_alloc (bsc#1185383).\n- CVE-2019-25033: Fixed integer overflow in the regional allocator via the ALIGN_UP macro (bsc#1185384).\n- CVE-2019-25034: Fixed integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write (bsc#1185385).\n- CVE-2019-25035: Fixed out-of-bounds write in sldns_bget_token_par (bsc#1185386).\n- CVE-2019-25036: Fixed assertion failure and denial of service in synth_cname (bsc#1185387).\n- CVE-2019-25037: Fixed assertion failure and denial of service in dname_pkt_copy via an invalid packet (bsc#1185388).\n- CVE-2019-25038: Fixed integer overflow in a size calculation in dnscrypt/dnscrypt.c (bsc#1185389).\n- CVE-2019-25039: Fixed integer overflow in a size calculation in respip/respip.c (bsc#1185390).\n- CVE-2019-25040: Fixed infinite loop via a compressed name in dname_pkt_copy (bsc#1185391).\n- CVE-2019-25041: Fixed assertion failure via a compressed name in dname_pkt_copy (bsc#1185392).\n- CVE-2019-25042: Fixed out-of-bounds write via a compressed name in rdata_copy (bsc#1185393).\n- CVE-2020-28935: Fixed symbolic link traversal when writing PID file (bsc#1179191).\n","status":"published","published":"2022-01-25T13:13:57Z","modified":"2026-02-04T04:08:14.067883Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0176-2","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\n- CVE-2019-25031: Fixed configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack (bsc#1185382).\n- CVE-2019-25032: Fixed integer overflow in the regional allocator via regional_alloc (bsc#1185383).\n- CVE-2019-25033: Fixed integer overflow in the regional allocator via the ALIGN_UP macro (bsc#1185384).\n- CVE-2019-25034: Fixed integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write (bsc#1185385).\n- CVE-2019-25035: Fixed out-of-bounds write in sldns_bget_token_par (bsc#1185386).\n- CVE-2019-25036: Fixed assertion failure and denial of service in synth_cname (bsc#1185387).\n- CVE-2019-25037: Fixed assertion failure and denial of service in dname_pkt_copy via an invalid packet (bsc#1185388).\n- CVE-2019-25038: Fixed integer overflow in a size calculation in dnscrypt/dnscrypt.c (bsc#1185389).\n- CVE-2019-25039: Fixed integer overflow in a size calculation in respip/respip.c (bsc#1185390).\n- CVE-2019-25040: Fixed infinite loop via a compressed name in dname_pkt_copy (bsc#1185391).\n- CVE-2019-25041: Fixed assertion failure via a compressed name in dname_pkt_copy (bsc#1185392).\n- CVE-2019-25042: Fixed out-of-bounds write via a compressed name in rdata_copy (bsc#1185393).\n- CVE-2020-28935: Fixed symbolic link traversal when writing PID file (bsc#1179191).\n","status":"published","published":"2022-02-15T06:39:05Z","modified":"2026-02-04T02:19:26.886123Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0301-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\n- CVE-2019-25031: Fixed configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack (bsc#1185382).\n- CVE-2019-25032: Fixed integer overflow in the regional allocator via regional_alloc (bsc#1185383).\n- CVE-2019-25033: Fixed integer overflow in the regional allocator via the ALIGN_UP macro (bsc#1185384).\n- CVE-2019-25034: Fixed integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write (bsc#1185385).\n- CVE-2019-25035: Fixed out-of-bounds write in sldns_bget_token_par (bsc#1185386).\n- CVE-2019-25036: Fixed assertion failure and denial of service in synth_cname (bsc#1185387).\n- CVE-2019-25037: Fixed assertion failure and denial of service in dname_pkt_copy via an invalid packet (bsc#1185388).\n- CVE-2019-25038: Fixed integer overflow in a size calculation in dnscrypt/dnscrypt.c (bsc#1185389).\n- CVE-2019-25039: Fixed integer overflow in a size calculation in respip/respip.c (bsc#1185390).\n- CVE-2019-25040: Fixed infinite loop via a compressed name in dname_pkt_copy (bsc#1185391).\n- CVE-2019-25041: Fixed assertion failure via a compressed name in dname_pkt_copy (bsc#1185392).\n- CVE-2019-25042: Fixed out-of-bounds write via a compressed name in rdata_copy (bsc#1185393).\n- CVE-2020-28935: Fixed symbolic link traversal when writing PID file (bsc#1179191).\n","status":"published","published":"2022-02-02T09:05:06Z","modified":"2026-02-04T04:31:50.533888Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"USN-4938-1","title":"unbound vulnerabilities","description":"It was discovered that Unbound contained multiple security issues. A\nremote attacker could possibly use these issues to cause a denial of\nservice, inject arbitrary commands, execute arbitrary code, and overwrite\nlocal files.\n","status":"published","published":"2021-05-06T12:58:29Z","modified":"2026-04-27T16:03:37.543872505Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}