Every CVESearch/Get API key

CVE-2014-8602

iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining, which allows...

4.3 MediumFix available

CVE-2014-8602 is a medium vulnerability (CVSS 4.3) in Nlnetlabs Unbound, published December 10, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 32.2%, the 98th percentile. Fixed in unbound 1.4.22-3.

What does this mean?
Severity
4.3 MediumCVSS 2.0, NVD
Exploit chance
32.2%EPSS, 98th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
1.4.22-3unbound +26 more

Description

iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a large or infinite number of referrals.

Exploit likelihood

32.2%Up 30.8 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
unbound
Debian:12
before 1.4.22-3
1.4.22-3
unbound
Debian:13
before 1.4.22-3
1.4.22-3
unbound
Debian:14
before 1.4.22-3
1.4.22-3
unbound
Debian:6.0
before 1.4.6-1+squeeze4, plus listed versions
1.4.6-11.4.6-1+squeeze21.4.6-1+squeeze3
1.4.6-1+squeeze4
unbound
Debian:7
before 1.4.17-3+deb7u2, plus listed versions
1.4.17-31.4.17-3+deb7u1
1.4.17-3+deb7u2
unbound-debuginfo
Red Hat:enterprise_linux:7::client
before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound-devel
Red Hat:enterprise_linux:7::client
before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound-python
Red Hat:enterprise_linux:7::client
before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound
Red Hat:enterprise_linux:7::client
before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound-libs
Red Hat:enterprise_linux:7::client
before 0:1.4.20-26.el7
0:1.4.20-26.el7
Show 17 moreShow less
Affected packages
PackageAffectedFixed
unbound
Red Hat:enterprise_linux:7::computenode
before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound-debuginfo
Red Hat:enterprise_linux:7::computenode
before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound-devel
Red Hat:enterprise_linux:7::computenode
before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound-python
Red Hat:enterprise_linux:7::computenode
before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound-libs
Red Hat:enterprise_linux:7::computenode
before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound-debuginfo
Red Hat:enterprise_linux:7::server
before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound-devel
Red Hat:enterprise_linux:7::server
before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound-python
Red Hat:enterprise_linux:7::server
before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound
Red Hat:enterprise_linux:7::server
before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound-libs
Red Hat:enterprise_linux:7::server
before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound-debuginfo
Red Hat:enterprise_linux:7::workstation
before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound-devel
Red Hat:enterprise_linux:7::workstation
before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound-python
Red Hat:enterprise_linux:7::workstation
before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound
Red Hat:enterprise_linux:7::workstation
before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound-libs
Red Hat:enterprise_linux:7::workstation
before 0:1.4.20-26.el7
0:1.4.20-26.el7
unbound
Ubuntu:14.04:LTS
before 1.4.22-1ubuntu4.14.04.1, plus listed versions
1.4.20-11.4.21-11.4.21-1ubuntu11.4.21-1ubuntu21.4.22-1ubuntu11.4.22-1ubuntu21.4.22-1ubuntu31.4.22-1ubuntu4
1.4.22-1ubuntu4.14.04.1
unbound
openSUSE:Tumbleweed
before 1.5.10-1.1
1.5.10-1.1

What each source reports

NVD Score used4.3

iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a large or infinite number of referrals.

Record
CVE-2014-8602
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-399
Updated
2026-11-02
CVE ListNo score

iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a large or infinite number of referrals.

Record
CVE-2014-8602
Updated
2026-11-02
EUVDEUVD-2014-8439No score

iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a large or infinite number of referrals.

Record
EUVD-2014-8439
Updated
2026-11-03
GitHub AdvisoriesGHSA-rmpj-rcj8-qh82No score

iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining, which allows...

iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a large or infinite number of referrals.

Record
GHSA-rmpj-rcj8-qh82
Updated
2026-11-02
OSVNo score

iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a large or infinite number of referrals.

Record
CVE-2014-8602
Updated
2026-11-02
OSVDEBIAN-CVE-2014-8602No score

iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a large or infinite number of referrals.

Record
DEBIAN-CVE-2014-8602
Updated
2026-11-02
OSVopenSUSE-SU-2024:10121-1No score

libunbound-devel-mini-1.5.10-1.1 on GA media

These are all security issues fixed in the libunbound-devel-mini-1.5.10-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10121-1
Updated
2026-11-02
OSVUBUNTU-CVE-2014-8602No score

iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a large or infinite number of referrals.

Record
UBUNTU-CVE-2014-8602
Updated
2026-11-02
OSVUSN-2484-1No score

unbound vulnerability

Florian Maury discovered that Unbound incorrectly handled delegation. A remote attacker could possibly use this issue to cause Unbound to consume resources, resulting in a denial of service.

Record
USN-2484-1
Updated
2026-11-02

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 17 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open