Unscored severity · published Oct 13, 2009
CVE-2009-3602
Unbound before 1.3.4 does not properly verify signatures for NSEC3 records, which allows remote attackers to cause secure delegations to be downgraded via DNS spoofing or other…
–
CVSS
3%
EPSS
No
On KEV
Description
Unbound before 1.3.4 does not properly verify signatures for NSEC3 records, which allows remote attackers to cause secure delegations to be downgraded via DNS spoofing or other DNS-related attacks in conjunction with crafted delegation responses.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.0% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UN
Unbound · Nlnetlabs
through 1.3.3; 0.0; 0.1; 0.2; 0.3; 0.4; +19 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-3602
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-3602
osvdb.org
http://osvdb.org/58836
Vendor Advisory
http://secunia.com/advisories/36996
secunia.com
http://secunia.com/advisories/37913
Vendor Advisory
http://unbound.net/pipermail/unbound-users/2009-October/000852.html
www.debian.org
http://www.debian.org/security/2009/dsa-1963
www.openwall.com
http://www.openwall.com/lists/oss-security/2009/10/09/2
More from Unbound
10.0
CVE-2026-42960
Possible cache poisoning via promiscuous records for the authority section
9.8
CVE-2026-82717
CNAME synthesis could lead to heap corruption
9.8
CVE-2026-81642
Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY
9.8
CVE-2026-33278
Possible arbitrary code execution during DNSSEC validation
9.8
CVE-2019-25042
Unbound before 1.9.5 allows an out-of-bounds write via a compressed name in rdata_copy