CVE-2019-25036: High severity unbound vulnerability
DISPUTED Unbound before 1.9.5 allows an assertion failure and denial of service in synthcname. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-25036?
CVE-2019-25036 is a vulnerability in Unbound DNS software before version 1.9.5 that allows an assertion failure and denial of service in synth_cname.
Is CVE-2019-25036 considered a vulnerability?
Although the vendor disputes that this is a vulnerability, the code may still be vulnerable, resulting in denial of service in a running Unbound installation.
What is the severity level of CVE-2019-25036?
CVE-2019-25036 has a severity level of high with a CVSS score of 7.5.
What software is affected by CVE-2019-25036?
Unbound DNS software before version 1.9.5 and Debian Linux version 9.0 are affected by CVE-2019-25036.
How can I mitigate the risk of CVE-2019-25036?
Updating the Unbound DNS software to version 1.9.5 or higher is recommended to mitigate the risk of CVE-2019-25036.