What’s Vulnerable › Vulnerabilities

CVE-2014-8602

• Severity: medium (CVSS 4.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 32.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2014-12-11 · updated 2026-06-17
• Weakness: CWE-399

Description

iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a large or infinite number of referrals.

Affected products

• Canonical Ubuntu Linux: 14.04, 14.10
• Debian Linux: 7.0
• NLnet Labs Unbound: through 1.5.0

References

• http://cert.ssi.gouv.fr/site/CERTFR-2014-AVI-512/index.html
• http://unbound.net/downloads/patch_cve_2014_8602.diff
• http://www.debian.org/security/2014/dsa-3097
• http://www.kb.cert.org/vuls/id/264212
• http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
• http://www.securityfocus.com/bid/71589
• http://www.ubuntu.com/usn/USN-2484-1
• https://unbound.net/downloads/CVE-2014-8602.txt
• http://cert.ssi.gouv.fr/site/CERTFR-2014-AVI-512/index.html
• http://unbound.net/downloads/patch_cve_2014_8602.diff
• http://www.debian.org/security/2014/dsa-3097
• http://www.kb.cert.org/vuls/id/264212

Get alerted when CVE-2014-8602 or the next vulnerability affects your stack