Critical Security Update for Unbound: Addressing CVE-2024-33655 and CVE-2025-5994
Summary
DLA-4280-1: unbound - security update. Affects unbound versions < 1.13.1-1+deb11u5. Fixed in 1.13.1-1+deb11u5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Unbound is a validating, recursive, and caching DNS resolver designed to enhance the security and performance of DNS queries. It is widely used in various applications to ensure reliable domain name resolution. However, recent vulnerabilities have been identified that could potentially compromise its security, making it crucial for users to stay updated with the latest patches.
Vulnerability Detail
The vulnerabilities identified as CVE-2024-33655 and CVE-2025-5994 in Unbound stem from flaws in its handling of DNS queries. These vulnerabilities could allow an attacker to exploit the DNS resolver, leading to potential data leakage or denial of service. The issues arise from improper validation of DNS responses, which could be manipulated by malicious actors to disrupt service or gain unauthorized access to sensitive information.
How To Fix
Minimum fixed version
1.13.1-1+deb11u5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade unboundTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the DNS resolver by configuring firewall rules to limit incoming requests to trusted IP addresses only. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
The vulnerabilities CVE-2024-33655 and CVE-2025-5994 in Unbound pose significant security risks that can be mitigated by updating to the latest patched version. Users are encouraged to take immediate action to protect their systems and ensure the integrity of their DNS resolution services.
See every vulnerability recorded for unbound →
FAQ
These are identifiers for specific vulnerabilities found in the Unbound DNS resolver, which could lead to security breaches if not addressed.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
Implement firewall rules to restrict access to the DNS resolver as a temporary workaround until you can apply the update.
No, updating Unbound to the latest version is designed to enhance security without causing data loss.
Detailed information can be found in the official Debian security advisories and on the Unbound project website.
Related vulnerabilities
Recent vulnerabilities recorded for unbound.
