Critical Security Update for Unbound: CVE-2025-11411
Summary
DLA-4365-2: unbound - security update. Affects unbound versions < 1.13.1-1+deb11u7. Fixed in 1.13.1-1+deb11u7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Unbound is a validating, recursive, and caching DNS resolver that is widely used for its performance and security features. It helps in resolving domain names into IP addresses while providing DNSSEC support to ensure the authenticity of the responses. However, recent vulnerabilities have raised concerns about its security, necessitating timely updates to protect users.
Vulnerability Detail
The vulnerability identified as CVE-2025-11411 affects Unbound and could lead to potential security risks, including denial of service or data exposure. This issue arises from improper handling of certain DNS queries, which could be exploited by attackers to disrupt service or manipulate DNS responses. It is crucial for users to understand the implications of this vulnerability to safeguard their systems.
How To Fix
Minimum fixed version
1.13.1-1+deb11u7
This is the first release that contains the fix.
sudo apt-get install --only-upgrade unboundTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of the Unbound service by configuring firewall rules to restrict access to trusted IP addresses only. This can help mitigate the risk until the package is updated.
Conclusion
The vulnerability CVE-2025-11411 in Unbound poses significant security risks that require immediate attention. Users are strongly advised to update their Unbound installations to the latest patched version to ensure their systems remain secure. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for unbound →
FAQ
CVE-2025-11411 is a security vulnerability in the Unbound DNS resolver that could allow attackers to exploit the service, potentially leading to denial of service or data manipulation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failing to update Unbound could leave your system vulnerable to attacks that exploit this security flaw, potentially compromising your DNS resolution and overall network security.
Yes, Vulert provides a solution that monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
If an immediate update is not possible, consider implementing firewall rules to limit access to the Unbound service as a temporary workaround until the update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for unbound.
