CVE-2024-1931

Summary

CVE-2024-1931 is a denial-of-service vulnerability affecting Unbound versions 1.18.0 to 1.19.1. This issue arises when Unbound attempts to remove Explicitly Defined EDNS (EDE) records, leading to an infinite loop. The loop occurs when Unbound, in an effort to maintain EDE codes while fitting the response within the client's buffer size, checks a condition inadvertently, causing the code to loop endlessly. This vulnerability can only be triggered when the 'ede: yes' option is used, which is a non-default configuration. Unbound versions 1.19.2 and later include the fix, preventing the infinite loop from occurring.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.