CVE-2009-3602

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

2.98%

Published

Oct 13, 2009

Modified

Apr 22, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Unbound before 1.3.4 does not properly verify signatures for NSEC3 records, which allows remote attackers to cause secure delegations to be downgraded via DNS spoofing or other DNS-related attacks in conjunction with crafted delegation responses.

Weaknesses (CWE)

CWE-310

Affected Products (25)

nlnetlabs · unboundvulnerable

nlnetlabs · unbound

References (18)

http://osvdb.org/58836

http://secunia.com/advisories/36996

Vendor Advisory

http://secunia.com/advisories/37913

http://unbound.net/pipermail/unbound-users/2009-October/000852.html

Vendor Advisory

http://www.debian.org/security/2009/dsa-1963

http://www.openwall.com/lists/oss-security/2009/10/09/2

http://www.openwall.com/lists/oss-security/2009/10/09/3

http://www.vupen.com/english/advisories/2009/2875

KEV Catalog EPSS Scores Vendors All CVEs