Unbound before 1.4.13p2 attempts to free unallocated memory during processing of duplicate CNAME records in a signed zone, which allows remote DNS servers to cause a denial of service (daemon crash) via a crafted response.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0250 advisory.

    This advisory aggregates security fixes for the unbound SRPM in CIQ LTS 8.6. It addresses 14 CVEs:
    CVE-2011-4528, CVE-2014-8602, CVE-2023-50868, CVE-2020-12662, CVE-2019-18934, and 9 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1369 advisory.

    This advisory aggregates security fixes for the unbound SRPM in CIQ LTS 9.6. It addresses 28 CVEs:
    CVE-2026-42534, CVE-2026-32792, CVE-2011-4528, CVE-2014-8602, CVE-2025-11411, and 23 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0488 advisory.

    This advisory aggregates security fixes for the unbound SRPM in CIQ LTS 9.2. It addresses 12 CVEs:
    CVE-2011-4528, CVE-2014-8602, CVE-2019-16866, CVE-2023-50868, CVE-2020-12662, and 7 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201311-18 (Unbound: Denial of Service)

    Multiple vulnerabilities have been discovered in Unbound. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly cause a Denial of Service condition via       a specially crafted response.
  Workaround :

    There is no known workaround at this time.

According to its self-reported version number, the remote Unbound DNS resolver is affected by multiple denial of service vulnerabilities :

  - A denial of service vulnerability exists due to an     attempt to free unallocated memory during the processing     of duplicate CNAME records in a signed zone. An attacker     can exploit this, via a specially crafted response, to     cause a daemon crash, resulting in a denial of service     condition. (CVE-2011-4528)

  - A denial of service vulnerability exists due to improper     proof processing for NSEC3-signed zones. An attacker can     exploit this, via a malformed response that lacks     expected NSEC3 records, to cause a daemon crash,     resulting in a denial of service condition.
    (CVE-2011-4869)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that Unbound, a recursive DNS resolver, would crash when processing certain malformed DNS responses from authoritative DNS servers, leading to denial of service.

  - CVE-2011-4528     Unbound attempts to free unallocated memory during     processing of duplicate CNAME records in a signed zone.

  - CVE-2011-4869     Unbound does not properly process malformed responses     which lack expected NSEC3 records.

Security update for CVE-2011-4528 / VU#209659

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Unbound developer reports :

Unbound crashes when confronted with a non-standard response from a server for a domain. This domain produces duplicate RRs from a certain type and is DNSSEC signed. Unbound also crashes when confronted with a query that eventually, and under specific circumstances, resolves to a domain that misses expected NSEC3 records.

ID	Name	Product	Family	Type	Severity
356065	Rocky Linux 8.6 [CIQ] Security Update: python3-unbound / python3-unbound-debuginfo / unbound / etc Multiple Vulnerabilities (ciqsa-2026_0250)	Nessus	Rocky Linux Local Security Checks	Local	critical
354372	Rocky Linux 9.6 [CIQ] Security Update: python3-unbound / python3-unbound-debuginfo / unbound / etc Multiple Vulnerabilities (ciqsa-2026_1369)	Nessus	Rocky Linux Local Security Checks	Local	high
353828	Rocky Linux 9.2 [CIQ] Security Update: python3-unbound / python3-unbound-debuginfo / unbound / etc Multiple Vulnerabilities (ciqsa-2026_0488)	Nessus	Rocky Linux Local Security Checks	Local	high
71120	GLSA-201311-18 : Unbound: Denial of Service	Nessus	Gentoo Local Security Checks	Local	high
57574	Unbound < 1.4.14 / 1.4.13p2 Multiple DoS	Nessus	DNS	Remote	medium
57510	Debian DSA-2370-1 : unbound - several vulnerabilities	Nessus	Debian Local Security Checks	Local	high
57422	Fedora 15 : unbound-1.4.14-1.fc15 (2011-17337)	Nessus	Fedora Local Security Checks	Local	high
57421	Fedora 16 : unbound-1.4.14-1.fc16 (2011-17282)	Nessus	Fedora Local Security Checks	Local	high
57338	FreeBSD : unbound -- denial of service vulnerabilities from nonstandard redirection and denial of existence (7ba65bfd-2a40-11e1-b96e-00215af774f0)	Nessus	FreeBSD Local Security Checks	Local	medium

Detections

Analytics

CVE-2011-4528

high

Tenable Plugins

critical

high

high

high

medium

high

high

high

medium