{"id":"CVE-2022-3204","aliases":["ALPINE-CVE-2022-3204","ALSA-2023:2370","ALSA-2023:2771","AZL-11033","CLSA-2024-1725554505","DEBIAN-CVE-2022-3204","DLA-3371-1","EUVD-2022-42621","GHSA-7mc5-x7xh-682h","MGASA-2022-0361","OESA-2022-1972","RHSA-2023:2370","RHSA-2023:2771","RHSA-2024:2045","RLSA-2023:2771","SUSE-SU-2024:1923-1","SUSE-SU-2024:1991-1","SUSE-SU-2024:1991-2","UBUNTU-CVE-2022-3204","USN-5732-1","openSUSE-SU-2024:12368-1"],"status":"published","title":"NRDelegation Attack","description":"A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolving software. The NRDelegation Attack works by having a malicious delegation with a considerable number of non responsive nameservers. The attack starts by querying a resolver for a record that relies on those unresponsive nameservers. The attack can cause a resolver to spend a lot of time/resources resolving records under a malicious delegation point where a considerable number of unresponsive NS records reside. It can trigger high CPU usage in some resolver implementations that continually look in the cache for resolved NS records in that delegation. This can lead to degraded performance and eventually denial of service in orchestrated attacks. Unbound does not suffer from high CPU usage, but resources are still needed for resolving the malicious delegation. Unbound will keep trying to resolve the record until hard limits are reached. Based on the nature of the attack and the replies, different limits could be reached. From version 1.16.3 on, Unbound introduces fixes for better performance when under load, by cutting opportunistic queries for nameserver discovery and DNSKEY prefetching and limiting the number of times a delegation point can issue a cache lookup for missing records.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01647,"percentile":0.76642,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2022-09-26T13:41:46Z","modified":"2026-11-03T07:18:33Z","fixes":[{"ecosystem":"Alpine:v3.17","package":"unbound","fixed_in":["1.16.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"unbound","fixed_in":["1.16.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"unbound","fixed_in":["1.16.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"unbound","fixed_in":["1.16.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"unbound","fixed_in":["1.16.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"unbound","fixed_in":["1.16.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"unbound","fixed_in":["1.16.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"unbound","fixed_in":["1.16.3-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"python3-unbound","fixed_in":["1.16.2-3.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"unbound","fixed_in":["1.16.2-3.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"unbound-devel","fixed_in":["1.16.2-3.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"unbound-libs","fixed_in":["1.16.2-3.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"python3-unbound","fixed_in":["1.16.2-5.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"unbound","fixed_in":["1.16.2-5.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"unbound-devel","fixed_in":["1.16.2-5.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"unbound-libs","fixed_in":["1.16.2-5.el8"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"unbound","fixed_in":["1.16.3-1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"unbound","fixed_in":["1.6.6-5.el7_8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"unbound-devel","fixed_in":["1.6.6-5.el7_8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"unbound-libs","fixed_in":["1.6.6-5.el7_8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"unbound-python","fixed_in":["1.6.6-5.el7_8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"unbound","fixed_in":["1.16.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"unbound","fixed_in":["1.16.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"unbound","fixed_in":["1.16.3-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"unbound","fixed_in":["1.16.3-1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"unbound","fixed_in":["1.11.0-9.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"unbound","fixed_in":["1.11.0-8.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"unbound","fixed_in":["1.13.2-6.oe2203"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-unbound","fixed_in":["0:1.16.2-3.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-unbound-debuginfo","fixed_in":["0:1.16.2-3.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"unbound","fixed_in":["0:1.16.2-3.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"unbound-debuginfo","fixed_in":["0:1.16.2-3.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"unbound-debugsource","fixed_in":["0:1.16.2-3.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"unbound-libs","fixed_in":["0:1.16.2-3.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"unbound-libs-debuginfo","fixed_in":["0:1.16.2-3.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"python3-unbound-debuginfo","fixed_in":["0:1.16.2-3.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"unbound-debuginfo","fixed_in":["0:1.16.2-3.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"unbound-debugsource","fixed_in":["0:1.16.2-3.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"unbound-devel","fixed_in":["0:1.16.2-3.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"unbound-libs-debuginfo","fixed_in":["0:1.16.2-3.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-unbound","fixed_in":["0:1.16.2-5.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-unbound-debuginfo","fixed_in":["0:1.16.2-5.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound","fixed_in":["0:1.16.2-5.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-debuginfo","fixed_in":["0:1.16.2-5.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-debugsource","fixed_in":["0:1.16.2-5.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-devel","fixed_in":["0:1.16.2-5.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-libs","fixed_in":["0:1.16.2-5.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-libs-debuginfo","fixed_in":["0:1.16.2-5.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"unbound","fixed_in":["0:1.16.2-5.12.el8_10"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"unbound","fixed_in":["1.6.7-1ubuntu2.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"unbound","fixed_in":["1.9.4-2ubuntu1.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"unbound","fixed_in":["1.13.1-1ubuntu5.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"unbound","fixed_in":["1.16.3-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-3.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-3.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-3.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-3.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-5.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-5.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-5.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-5.el8"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-5.el7_8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-5.el7_8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-5.el7_8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"unbound-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-5.el7_8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-2+deb10u3"}]}],"versions":["1.9.0-2","1.9.0-2+deb10u1","1.9.0-2+deb10u2"],"bundled":4},{"source":"osv","ecosystem":"Mageia:8","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-9.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-8.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-6.oe2203"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-3.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-3.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-3.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-3.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"unbound-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-3.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-3.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"unbound-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-3.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"python3-unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-3.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-3.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"unbound-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-3.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-3.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"unbound-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-3.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-17.el8_6.5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"python3-unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-17.el8_6.5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-17.el8_6.5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-17.el8_6.5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"unbound-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-17.el8_6.5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-17.el8_6.5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-17.el8_6.5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"unbound-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-17.el8_6.5"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.12.el8_10"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-150600.23.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-150600.23.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-150600.23.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-150100.10.13.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-150100.10.13.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-150100.10.13.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-150100.10.13.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-150100.10.13.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-150100.10.13.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-150100.10.13.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-150100.10.13.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-150100.10.13.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-150100.10.13.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-150100.10.13.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-150100.10.13.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-150100.10.13.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-150100.10.13.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-150100.10.13.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-150100.10.13.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-150100.10.13.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-150100.10.13.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.20-1","1.4.21-1","1.4.21-1ubuntu1","1.4.21-1ubuntu2","1.4.22-1ubuntu1","1.4.22-1ubuntu2","1.4.22-1ubuntu3","1.4.22-1ubuntu4","1.4.22-1ubuntu4.14.04.1","1.4.22-1ubuntu4.14.04.2","1.4.22-1ubuntu4.14.04.3","1.4.22-1ubuntu4.14.04.3+esm1","1.4.22-1ubuntu4.14.04.3+esm2","1.4.22-1ubuntu4.14.04.3+esm3","1.4.22-1ubuntu4.14.04.3+esm4","1.4.22-1ubuntu4.14.04.3+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.22-1ubuntu6","1.5.7-1ubuntu1","1.5.7-1ubuntu2","1.5.8-1ubuntu1","1.5.8-1ubuntu1.1","1.5.8-1ubuntu1.1+esm1","1.5.8-1ubuntu1.1+esm2","1.5.8-1ubuntu1.1+esm3","1.5.8-1ubuntu1.1+esm4","1.5.8-1ubuntu1.1+esm5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.7-1ubuntu2.6"}]}],"versions":["1.6.5-1","1.6.7-1","1.6.7-1build1","1.6.7-1ubuntu1","1.6.7-1ubuntu2","1.6.7-1ubuntu2.1","1.6.7-1ubuntu2.2","1.6.7-1ubuntu2.3","1.6.7-1ubuntu2.4","1.6.7-1ubuntu2.5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-2ubuntu1.4"}]}],"versions":["1.9.0-2ubuntu1","1.9.0-2ubuntu2","1.9.4-2","1.9.4-2ubuntu1","1.9.4-2ubuntu1.1","1.9.4-2ubuntu1.2","1.9.4-2ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-1ubuntu5.3"}]}],"versions":["1.13.1-1ubuntu1","1.13.1-1ubuntu3","1.13.1-1ubuntu5","1.13.1-1ubuntu5.1","1.13.1-1ubuntu5.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.7-1ubuntu2.6"}]}],"versions":["1.6.5-1","1.6.7-1","1.6.7-1build1","1.6.7-1ubuntu1","1.6.7-1ubuntu2","1.6.7-1ubuntu2.1","1.6.7-1ubuntu2.2","1.6.7-1ubuntu2.3","1.6.7-1ubuntu2.4","1.6.7-1ubuntu2.5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-2ubuntu1.4"}]}],"versions":["1.9.0-2ubuntu1","1.9.0-2ubuntu2","1.9.4-2","1.9.4-2ubuntu1","1.9.4-2ubuntu1.1","1.9.4-2ubuntu1.2","1.9.4-2ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-1ubuntu5.3"}]}],"versions":["1.13.1-1ubuntu1","1.13.1-1ubuntu3","1.13.1-1ubuntu5","1.13.1-1ubuntu5.1","1.13.1-1ubuntu5.2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-1.1"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"nlnet labs","product":"unbound"},{"vendor":"nlnetlabs","product":"unbound"}],"references":[{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2022-3204.txt","tags":["x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3G2HS6CYPSIGAKO6QLEZPG3RD6AMPB7B/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35QGS5FBQTG3DBSK7QV67PA64P24ABHY/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S4EU6DMJXQFMAIE6SLAH4H5RNRU6VQL/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202212-02","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/03/msg00024.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3204","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35QGS5FBQTG3DBSK7QV67PA64P24ABHY"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3G2HS6CYPSIGAKO6QLEZPG3RD6AMPB7B"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S4EU6DMJXQFMAIE6SLAH4H5RNRU6VQL"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/35QGS5FBQTG3DBSK7QV67PA64P24ABHY"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3G2HS6CYPSIGAKO6QLEZPG3RD6AMPB7B"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4S4EU6DMJXQFMAIE6SLAH4H5RNRU6VQL"},{"url":"https://github.com/advisories/GHSA-7mc5-x7xh-682h"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-3204","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:2370","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-3204","tags":["report"]},{"url":"https://bugzilla.redhat.com/2128947","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-2370.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:2771","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-2771.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/centos7-els/CLSA-2024-1725554505.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-3204","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0361.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30876","tags":["report"]},{"url":"https://github.com/NLnetLabs/unbound/releases/tag/release-1.16.3","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1972","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2128947","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2370.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-3204","tags":["advisory","report"]},{"url":"https://nlnetlabs.nl/downloads/unbound/CVE-2022-3204.txt","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.8_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2135322","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2771.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:2045","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2116725","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2116729","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2045.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-30698","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30698","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30698","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-30699","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30699","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30699","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:2771","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241923-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1202031","tags":["report"]},{"url":"https://bugzilla.suse.com/1202033","tags":["report"]},{"url":"https://bugzilla.suse.com/1203643","tags":["report"]},{"url":"https://bugzilla.suse.com/1219823","tags":["report"]},{"url":"https://bugzilla.suse.com/1219826","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-50387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-50868","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241991-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241991-2/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-3204","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5732-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-3204","title":"NRDelegation Attack","description":"A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolving software. The NRDelegation Attack works by having a malicious delegation with a considerable number of non responsive nameservers. The attack starts by querying a resolver for a record that relies on those unresponsive nameservers. The attack can cause a resolver to spend a lot of time/resources resolving records under a malicious delegation point where a considerable number of unresponsive NS records reside. It can trigger high CPU usage in some resolver implementations that continually look in the cache for resolved NS records in that delegation. This can lead to degraded performance and eventually denial of service in orchestrated attacks. Unbound does not suffer from high CPU usage, but resources are still needed for resolving the malicious delegation. Unbound will keep trying to resolve the record until hard limits are reached. Based on the nature of the attack and the replies, different limits could be reached. From version 1.16.3 on, Unbound introduces fixes for better performance when under load, by cutting opportunistic queries for nameserver discovery and DNSKEY prefetching and limiting the number of times a delegation point can issue a cache lookup for missing records.","status":"published","published":"2022-09-26T13:41:46.275Z","modified":"2025-05-05T16:13:06.842Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:34:33.24035Z"}],"euvd":[{"id":"EUVD-2022-42621","description":"A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolving software. The NRDelegation Attack works by having a malicious delegation with a considerable number of non responsive nameservers. The attack starts by querying a resolver for a record that relies on those unresponsive nameservers. The attack can cause a resolver to spend a lot of time/resources resolving records under a malicious delegation point where a considerable number of unresponsive NS records reside. It can trigger high CPU usage in some resolver implementations that continually look in the cache for resolved NS records in that delegation. This can lead to degraded performance and eventually denial of service in orchestrated attacks. Unbound does not suffer from high CPU usage, but resources are still needed for resolving the malicious delegation. Unbound will keep trying to resolve the record until hard limits are reached. Based on the nature of the attack and the replies, different limits could be reached. From version 1.16.3 on, Unbound introduces fixes for better performance when under load, by cutting opportunistic queries for nameserver discovery and DNSKEY prefetching and limiting the number of times a delegation point can issue a cache lookup for missing records.","status":"published","published":"2022-09-26T13:41:46Z","modified":"2025-05-05T16:13:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:56.98956Z"}],"ghsa":[{"id":"GHSA-7mc5-x7xh-682h","title":"A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been...","description":"A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolving software. The NRDelegation Attack works by having a malicious delegation with a considerable number of non responsive nameservers. The attack starts by querying a resolver for a record that relies on those unresponsive nameservers. The attack can cause a resolver to spend a lot of time/resources resolving records under a malicious delegation point where a considerable number of unresponsive NS records reside. It can trigger high CPU usage in some resolver implementations that continually look in the cache for resolved NS records in that delegation. This can lead to degraded performance and eventually denial of service in orchestrated attacks. Unbound does not suffer from high CPU usage, but resources are still needed for resolving the malicious delegation. Unbound will keep trying to resolve the record until hard limits are reached. Based on the nature of the attack and the replies, different limits could be reached. From version 1.16.3 on, Unbound introduces fixes for better performance when under load, by cutting opportunistic queries for nameserver discovery and DNSKEY prefetching and limiting the number of times a delegation point can issue a cache lookup for missing records.","status":"published","published":"2022-09-27T00:00:21Z","modified":"2025-05-05T18:33:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:02:07.964163Z"}],"nvd":[{"id":"CVE-2022-3204","description":"A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolving software. The NRDelegation Attack works by having a malicious delegation with a considerable number of non responsive nameservers. The attack starts by querying a resolver for a record that relies on those unresponsive nameservers. The attack can cause a resolver to spend a lot of time/resources resolving records under a malicious delegation point where a considerable number of unresponsive NS records reside. It can trigger high CPU usage in some resolver implementations that continually look in the cache for resolved NS records in that delegation. This can lead to degraded performance and eventually denial of service in orchestrated attacks. Unbound does not suffer from high CPU usage, but resources are still needed for resolving the malicious delegation. Unbound will keep trying to resolve the record until hard limits are reached. Based on the nature of the attack and the replies, different limits could be reached. From version 1.16.3 on, Unbound introduces fixes for better performance when under load, by cutting opportunistic queries for nameserver discovery and DNSKEY prefetching and limiting the number of times a delegation point can issue a cache lookup for missing records.","status":"published","published":"2022-09-26T14:15:11.007Z","modified":"2026-06-17T04:59:04.183Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:07:28.501364Z"}],"osv":[{"id":"ALPINE-CVE-2022-3204","description":"A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolving software. The NRDelegation Attack works by having a malicious delegation with a considerable number of non responsive nameservers. The attack starts by querying a resolver for a record that relies on those unresponsive nameservers. The attack can cause a resolver to spend a lot of time/resources resolving records under a malicious delegation point where a considerable number of unresponsive NS records reside. It can trigger high CPU usage in some resolver implementations that continually look in the cache for resolved NS records in that delegation. This can lead to degraded performance and eventually denial of service in orchestrated attacks. Unbound does not suffer from high CPU usage, but resources are still needed for resolving the malicious delegation. Unbound will keep trying to resolve the record until hard limits are reached. Based on the nature of the attack and the replies, different limits could be reached. From version 1.16.3 on, Unbound introduces fixes for better performance when under load, by cutting opportunistic queries for nameserver discovery and DNSKEY prefetching and limiting the number of times a delegation point can issue a cache lookup for missing records.","status":"published","published":"2022-09-26T14:15:11.007Z","modified":"2026-11-03T07:18:33.443910025Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:51:12.284675Z"},{"id":"AZL-11033","title":"CVE-2022-3204 affecting package unbound for versions less than 1.16.3-1","description":"A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolving software. The NRDelegation Attack works by having a malicious delegation with a considerable number of non responsive nameservers. The attack starts by querying a resolver for a record that relies on those unresponsive nameservers. The attack can cause a resolver to spend a lot of time/resources resolving records under a malicious delegation point where a considerable number of unresponsive NS records reside. It can trigger high CPU usage in some resolver implementations that continually look in the cache for resolved NS records in that delegation. This can lead to degraded performance and eventually denial of service in orchestrated attacks. Unbound does not suffer from high CPU usage, but resources are still needed for resolving the malicious delegation. Unbound will keep trying to resolve the record until hard limits are reached. Based on the nature of the attack and the replies, different limits could be reached. From version 1.16.3 on, Unbound introduces fixes for better performance when under load, by cutting opportunistic queries for nameserver discovery and DNSKEY prefetching and limiting the number of times a delegation point can issue a cache lookup for missing records.","status":"published","published":"2022-09-26T14:15:11Z","modified":"2026-04-21T04:21:46.035611Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:02.044071Z"},{"id":"CVE-2022-3204","description":"A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolving software. The NRDelegation Attack works by having a malicious delegation with a considerable number of non responsive nameservers. The attack starts by querying a resolver for a record that relies on those unresponsive nameservers. The attack can cause a resolver to spend a lot of time/resources resolving records under a malicious delegation point where a considerable number of unresponsive NS records reside. It can trigger high CPU usage in some resolver implementations that continually look in the cache for resolved NS records in that delegation. This can lead to degraded performance and eventually denial of service in orchestrated attacks. Unbound does not suffer from high CPU usage, but resources are still needed for resolving the malicious delegation. Unbound will keep trying to resolve the record until hard limits are reached. Based on the nature of the attack and the replies, different limits could be reached. From version 1.16.3 on, Unbound introduces fixes for better performance when under load, by cutting opportunistic queries for nameserver discovery and DNSKEY prefetching and limiting the number of times a delegation point can issue a cache lookup for missing records.","status":"published","published":"2022-09-26T14:15:11.007Z","modified":"2026-10-24T10:30:29.960760265Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:25.860945Z"},{"id":"OESA-2022-1972","title":"unbound security update","description":"\r\n\r\nSecurity Fix(es):\r\n\r\nA vulnerability named \u0026apos;Non-Responsive Delegation Attack\u0026apos; (NRDelegation Attack) has been discovered in various DNS resolving software. The NRDelegation Attack works by having a malicious delegation with a considerable number of non responsive nameservers. The attack starts by querying a resolver for a record that relies on those unresponsive nameservers. The attack can cause a resolver to spend a lot of time/resources resolving records under a malicious delegation point where a considerable number of unresponsive NS records reside. It can trigger high CPU usage in some resolver implementations that continually look in the cache for resolved NS records in that delegation. This can lead to degraded performance and eventually denial of service in orchestrated attacks. Unbound does not suffer from high CPU usage, but resources are still needed for resolving the malicious delegation. Unbound will keep trying to resolve the record until hard limits are reached. Based on the nature of the attack and the replies, different limits could be reached. From version 1.16.3 on, Unbound introduces fixes for better performance when under load, by cutting opportunistic queries for nameserver discovery and DNSKEY prefetching and limiting the number of times a delegation point can issue a cache lookup for missing records.(CVE-2022-3204)","status":"published","published":"2022-09-30T11:05:17Z","modified":"2026-08-18T01:17:18.694906322Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"RHSA-2023:2370","title":"Red Hat Security Advisory: unbound security update","status":"published","published":"2024-09-16T09:20:23Z","modified":"2026-08-05T10:14:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:2771","title":"Red Hat Security Advisory: unbound security and bug fix update","status":"published","published":"2024-09-16T09:20:33Z","modified":"2026-08-05T10:14:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2024:2045","title":"Red Hat Security Advisory: unbound security update","status":"published","published":"2024-09-16T09:20:43Z","modified":"2026-08-05T10:18:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RLSA-2023:2771","title":"Moderate: unbound security and bug fix update","description":"The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. \n\nSecurity Fix(es):\n\n* unbound: NRDelegation attack leads to uncontrolled resource consumption (Non-Responsive Delegation Attack) (CVE-2022-3204)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.8 Release Notes linked from the References section.","status":"published","published":"2026-08-04T06:03:32.020117Z","modified":"2026-08-04T06:30:03.948487021Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"UBUNTU-CVE-2022-3204","description":"A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolving software. The NRDelegation Attack works by having a malicious delegation with a considerable number of non responsive nameservers. The attack starts by querying a resolver for a record that relies on those unresponsive nameservers. The attack can cause a resolver to spend a lot of time/resources resolving records under a malicious delegation point where a considerable number of unresponsive NS records reside. It can trigger high CPU usage in some resolver implementations that continually look in the cache for resolved NS records in that delegation. This can lead to degraded performance and eventually denial of service in orchestrated attacks. Unbound does not suffer from high CPU usage, but resources are still needed for resolving the malicious delegation. Unbound will keep trying to resolve the record until hard limits are reached. Based on the nature of the attack and the replies, different limits could be reached. From version 1.16.3 on, Unbound introduces fixes for better performance when under load, by cutting opportunistic queries for nameserver discovery and DNSKEY prefetching and limiting the number of times a delegation point can issue a cache lookup for missing records.","status":"published","published":"2022-09-26T14:15:00Z","modified":"2026-10-21T16:30:12.521096076Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:53.899276Z"},{"id":"ALSA-2023:2370","title":"Moderate: unbound security update","description":"The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. \n\nSecurity Fix(es):\n\n* unbound: NRDelegation attack leads to uncontrolled resource consumption (Non-Responsive Delegation Attack) (CVE-2022-3204)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-05-09T00:00:00Z","modified":"2026-10-29T11:30:55.939916308Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2023:2771","title":"Moderate: unbound security and bug fix update","description":"The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. \n\nSecurity Fix(es):\n\n* unbound: NRDelegation attack leads to uncontrolled resource consumption (Non-Responsive Delegation Attack) (CVE-2022-3204)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-05-16T00:00:00Z","modified":"2026-10-29T11:02:04.298833565Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"CLSA-2024-1725554505","title":"unbound: Fix of CVE-2022-3204","description":"- CVE-2022-3204: add max number of lookups in the cache for target nameserver names","status":"published","published":"2024-09-05T16:52:45Z","modified":"2026-06-01T00:33:18.026684208Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"DEBIAN-CVE-2022-3204","description":"A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolving software. The NRDelegation Attack works by having a malicious delegation with a considerable number of non responsive nameservers. The attack starts by querying a resolver for a record that relies on those unresponsive nameservers. The attack can cause a resolver to spend a lot of time/resources resolving records under a malicious delegation point where a considerable number of unresponsive NS records reside. It can trigger high CPU usage in some resolver implementations that continually look in the cache for resolved NS records in that delegation. This can lead to degraded performance and eventually denial of service in orchestrated attacks. Unbound does not suffer from high CPU usage, but resources are still needed for resolving the malicious delegation. Unbound will keep trying to resolve the record until hard limits are reached. Based on the nature of the attack and the replies, different limits could be reached. From version 1.16.3 on, Unbound introduces fixes for better performance when under load, by cutting opportunistic queries for nameserver discovery and DNSKEY prefetching and limiting the number of times a delegation point can issue a cache lookup for missing records.","status":"published","published":"2022-09-26T14:15:11.007Z","modified":"2026-11-03T06:02:36.178798531Z","updated_at":"2026-11-03T06:44:05.456691Z"},{"id":"DLA-3371-1","title":"unbound - security update","status":"published","published":"2023-03-29T00:00:00Z","modified":"2026-03-09T01:22:48.174814Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"MGASA-2022-0361","title":"Updated unbound packages fix security vulnerability","description":"Non-Responsive Delegation Attack. (CVE-2022-3204)\nImproves performance when under load, by cutting promiscuous queries for\nnameserver discovery and limiting the number of times a delegation point\ncan look in the cache for missing records.\n","status":"published","published":"2022-10-08T20:22:22Z","modified":"2026-04-16T04:44:15.992779208Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12368-1","title":"libunbound8-1.16.3-1.1 on GA media","description":"These are all security issues fixed in the libunbound8-1.16.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:33:09.188577Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"SUSE-SU-2024:1923-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\nunbound was updated to 1.20.0:\n\n* A lot of bugfixes and added features.\n  For a complete list take a look at the changelog located at:\n  /usr/share/doc/packages/unbound/Changelog or\n  https://www.nlnetlabs.nl/projects/unbound/download/\n\nSome Noteworthy Changes:\n\n* Removed DLV. The DLV has been decommisioned since unbound\n  1.5.4 and has been advised to stop using it since. The use of\n  dlv options displays a warning.\n* Remove EDNS lame procedure, do not re-query without EDNS after\n  timeout.\n* Add DNS over HTTPS\n* libunbound has been upgraded to major version 8\n\nSecurity Fixes:\n* CVE-2023-50387: DNSSEC verification complexity can be\n  exploited to exhaust CPU resources and stall DNS resolvers.  [bsc#1219823]\n* CVE-2023-50868: NSEC3 closest encloser proof can exhaust CPU.\n  [bsc#1219826]\n* CVE-2022-30698: Novel 'ghost domain names' attack by\n  introducing subdomain delegations.  [bsc#1202033]\n* CVE-2022-30699: Novel 'ghost domain names' attack by\n  updating almost expired delegation information.  [bsc#1202031]\n* CVE-2022-3204: NRDelegation attack leads to uncontrolled\n  resource consumption (Non-Responsive Delegation Attack).  [bsc#1203643]\n\nPackaging Changes:\n\n* Use prefixes instead of sudo in unbound.service\n* Remove no longer necessary BuildRequires: libfstrm-devel and\n  libprotobuf-c-devel\n","status":"published","published":"2024-06-04T11:50:47Z","modified":"2026-02-04T04:03:28.489965Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1991-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\nunbound was updated to 1.20.0:\n\n* A lot of bugfixes and added features.\n  For a complete list take a look at the changelog located at:\n  /usr/share/doc/packages/unbound/Changelog or\n  https://www.nlnetlabs.nl/projects/unbound/download/\n\nSome Noteworthy Changes:\n\n* Removed DLV. The DLV has been decommisioned since unbound\n  1.5.4 and has been advised to stop using it since. The use of\n  dlv options displays a warning.\n* Remove EDNS lame procedure, do not re-query without EDNS after\n  timeout.\n* Add DNS over HTTPS\n* libunbound has been upgraded to major version 8\n\nSecurity Fixes:\n* CVE-2023-50387: DNSSEC verification complexity can be\n  exploited to exhaust CPU resources and stall DNS resolvers.  [bsc#1219823]\n* CVE-2023-50868: NSEC3 closest encloser proof can exhaust CPU.\n  [bsc#1219826]\n* CVE-2022-30698: Novel 'ghost domain names' attack by\n  introducing subdomain delegations.  [bsc#1202033]\n* CVE-2022-30699: Novel 'ghost domain names' attack by\n  updating almost expired delegation information.  [bsc#1202031]\n* CVE-2022-3204: NRDelegation attack leads to uncontrolled\n  resource consumption (Non-Responsive Delegation Attack).  [bsc#1203643]\n\nPackaging Changes:\n\n* Use prefixes instead of sudo in unbound.service\n* Remove no longer necessary BuildRequires: libfstrm-devel and\n  libprotobuf-c-devel\n","status":"published","published":"2024-06-11T11:51:36Z","modified":"2026-02-04T02:59:27.128479Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1991-2","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\nunbound was updated to 1.20.0:\n\n* A lot of bugfixes and added features.\n  For a complete list take a look at the changelog located at:\n  /usr/share/doc/packages/unbound/Changelog or\n  https://www.nlnetlabs.nl/projects/unbound/download/\n\nSome Noteworthy Changes:\n\n* Removed DLV. The DLV has been decommisioned since unbound\n  1.5.4 and has been advised to stop using it since. The use of\n  dlv options displays a warning.\n* Remove EDNS lame procedure, do not re-query without EDNS after\n  timeout.\n* Add DNS over HTTPS\n* libunbound has been upgraded to major version 8\n\nSecurity Fixes:\n* CVE-2023-50387: DNSSEC verification complexity can be\n  exploited to exhaust CPU resources and stall DNS resolvers.  [bsc#1219823]\n* CVE-2023-50868: NSEC3 closest encloser proof can exhaust CPU.\n  [bsc#1219826]\n* CVE-2022-30698: Novel 'ghost domain names' attack by\n  introducing subdomain delegations.  [bsc#1202033]\n* CVE-2022-30699: Novel 'ghost domain names' attack by\n  updating almost expired delegation information.  [bsc#1202031]\n* CVE-2022-3204: NRDelegation attack leads to uncontrolled\n  resource consumption (Non-Responsive Delegation Attack).  [bsc#1203643]\n\nPackaging Changes:\n\n* Use prefixes instead of sudo in unbound.service\n* Remove no longer necessary BuildRequires: libfstrm-devel and\n  libprotobuf-c-devel\n","status":"published","published":"2024-06-11T11:51:51Z","modified":"2025-05-02T04:33:11.15542Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"USN-5732-1","title":"unbound vulnerability","description":"It was discovered that Unbound incorrectly handled delegations with a large\nnumber of non-responsive nameservers. A remote attacker could possibly use\nthis issue to cause Unbound to consume resources, leading to a denial of\nservice.\n","status":"published","published":"2022-11-17T17:38:45Z","modified":"2026-04-27T16:26:00.046707Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}