# CVE-2024-8508: libunbound8: NLnet Labs Unbound up to and including version 1.21.0 contains avulnerability when handling replies with very large R...

CVE-2024-8508 is fixed in 17 products on 1 platform, first by libunbound2 1.6.7-1ubuntu2.6+esm3, released October 3, 2024. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2024-8508
- Priority: Routine
- CVSS: 5.3 (Medium)
- EPSS: 0.0080
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 3, 2024

## Description

NLnet Labs Unbound up to and including version 1.21.0 contains avulnerability when handling replies with very large RRsets that it needs toperform name compression for. Malicious upstreams responses with very largeRRsets can cause Unbound to spend a considerable time applying namecompression to downstream replies. This can lead to degraded performanceand eventually denial of service in well orchestrated attacks. Thevulnerability can be exploited by a malicious actor querying Unbound forthe specially crafted contents of a malicious zone with very large RRsets.Before Unbound replies to the query it will try to apply name compressionwhich was an unbounded operation that could lock the CPU until the wholepacket was complete. Unbound version 1.21.1 introduces a hard limit on thenumber of name compression calculations it is willing to do per packet.Packets that need more compression will result in semi-compressed packetsor truncated packets, even on TCP for huge messages, to avoid locking theCPU for long. This change should not affect normal DNS traffic.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | libunbound2 Ubuntu 18.04.6 LTS (bionic) | 1.6.7-1ubuntu2.6+esm3 | [libunbound2 1.6.7-1ubuntu2.6+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libunbound2-1.6.7-1ubuntu2.6-esm3.md) | Oct 3, 2024 |
| Linux | libunbound8 Ubuntu 20.04 LTS (focal) | 1.9.4-2ubuntu1.9 | [libunbound8 1.9.4-2ubuntu1.9](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libunbound8-1.9.4-2ubuntu1.9.md) | Oct 3, 2024 |
| Linux | libunbound8 Ubuntu 22.04.1 LTS (jammy) | 1.13.1-1ubuntu5.8 | [libunbound8 1.13.1-1ubuntu5.8](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libunbound8-1.13.1-1ubuntu5.8.md) | Oct 3, 2024 |
| Linux | libunbound8 Ubuntu 24.04.5 LTS (noble) | 1.19.2-1ubuntu3.3 | [libunbound8 1.19.2-1ubuntu3.3](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libunbound8-1.19.2-1ubuntu3.3.md) | Oct 3, 2024 |
| Linux | libunbound8 Ubuntu 24.10 (oracular) | 1.20.0-1ubuntu2.1 | [libunbound8 1.20.0-1ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-libunbound8-1.20.0-1ubuntu2.1.md) | Jan 16, 2026 |
| Linux | python-unbound Ubuntu 18.04.6 LTS (bionic) | 1.6.7-1ubuntu2.6+esm3 | [python-unbound 1.6.7-1ubuntu2.6+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python-unbound-1.6.7-1ubuntu2.6-esm3.md) | Oct 3, 2024 |
| Linux | python-unbound Ubuntu 20.04 LTS (focal) | 1.9.4-2ubuntu1.9 | [python-unbound 1.9.4-2ubuntu1.9](https://patchblox.com/security/data/fix/linux/ubuntu-focal-python-unbound-1.9.4-2ubuntu1.9.md) | Oct 3, 2024 |
| Linux | python3-unbound RHEL 8 | 0:1.16.2-5.8.el8_10 | [RHSA-2025:0837](https://patchblox.com/security/data/fix/linux/rhsa-2025-0837.md) | Jan 30, 2025 |
| Linux | python3-unbound RHEL 9 | 0:1.16.2-18.el9_6 | [RHSA-2025:8197](https://patchblox.com/security/data/fix/linux/rhsa-2025-8197.md) | May 27, 2025 |
| Linux | python3-unbound Ubuntu 18.04.6 LTS (bionic) | 1.6.7-1ubuntu2.6+esm3 | [python3-unbound 1.6.7-1ubuntu2.6+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python3-unbound-1.6.7-1ubuntu2.6-esm3.md) | Oct 3, 2024 |
| Linux | python3-unbound Ubuntu 20.04 LTS (focal) | 1.9.4-2ubuntu1.9 | [python3-unbound 1.9.4-2ubuntu1.9](https://patchblox.com/security/data/fix/linux/ubuntu-focal-python3-unbound-1.9.4-2ubuntu1.9.md) | Oct 3, 2024 |
| Linux | python3-unbound Ubuntu 22.04.1 LTS (jammy) | 1.13.1-1ubuntu5.8 | [python3-unbound 1.13.1-1ubuntu5.8](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-python3-unbound-1.13.1-1ubuntu5.8.md) | Oct 3, 2024 |
| Linux | python3-unbound Ubuntu 24.04.5 LTS (noble) | 1.19.2-1ubuntu3.3 | [python3-unbound 1.19.2-1ubuntu3.3](https://patchblox.com/security/data/fix/linux/ubuntu-noble-python3-unbound-1.19.2-1ubuntu3.3.md) | Oct 3, 2024 |
| Linux | python3-unbound Ubuntu 24.10 (oracular) | 1.20.0-1ubuntu2.1 | [python3-unbound 1.20.0-1ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-python3-unbound-1.20.0-1ubuntu2.1.md) | Jan 16, 2026 |
| Linux | python3-unbound almalinux 10 | 1.20.0-10.el10_0 | [ALSA-2025:8047](https://patchblox.com/security/data/fix/linux/alsa-2025-8047.md) | May 20, 2025 |
| Linux | python3-unbound almalinux 8 | 1.16.2-5.8.el8_10 | [ALSA-2025:0837](https://patchblox.com/security/data/fix/linux/alsa-2025-0837.md) | Jan 30, 2025 |
| Linux | python3-unbound almalinux 9 | 1.16.2-8.el9_5.1 | [ALSA-2024:11232](https://patchblox.com/security/data/fix/linux/alsa-2024-11232.md) | Dec 17, 2024 |
| Linux | python3-unbound amzn 2023 | 1.17.1-1.amzn2023.0.6 | [ALAS2023-2024-719](https://patchblox.com/security/data/fix/linux/alas2023-2024-719.md) | Oct 10, 2024 |
| Linux | python3-unbound ol 10 | 0:1.20.0-10.el10_0 | [ELSA-2025-8047](https://patchblox.com/security/data/fix/linux/elsa-2025-8047.md) | Jun 27, 2025 |
| Linux | python3-unbound ol 8 | 0:1.16.2-5.8.el8_10 | [ELSA-2025-0837](https://patchblox.com/security/data/fix/linux/elsa-2025-0837.md) | Jan 30, 2025 |
| Linux | python3-unbound ol 9 | 0:1.16.2-8.el9_5.1 | [ELSA-2024-11232](https://patchblox.com/security/data/fix/linux/elsa-2024-11232.md) | Dec 19, 2024 |
| Linux | python3-unbound-debuginfo amzn 2023 | 1.17.1-1.amzn2023.0.6 | [ALAS2023-2024-719](https://patchblox.com/security/data/fix/linux/alas2023-2024-719.md) | Oct 10, 2024 |
| Linux | unbound Debian 11.6 (bullseye) | 1.13.1-1+deb11u4 | [DLA-3952-1](https://patchblox.com/security/data/fix/linux/dla-3952-1.md) | Nov 14, 2024 |
| Linux | unbound Debian 12.15 (bookworm) | 1.17.1-2+deb12u3 | [DEBIAN-CVE-2024-8508](https://patchblox.com/security/data/fix/linux/debian-cve-2024-8508.md) | Oct 3, 2024 |
| Linux | unbound Debian 13.5 (trixie) | 1.21.1-1 | [DEBIAN-CVE-2024-8508](https://patchblox.com/security/data/fix/linux/debian-cve-2024-8508.md) | Oct 3, 2024 |
| Linux | unbound Debian 14 | 1.21.1-1 | [DEBIAN-CVE-2024-8508](https://patchblox.com/security/data/fix/linux/debian-cve-2024-8508.md) | Oct 3, 2024 |
| Linux | unbound RHEL 8 | 0:1.16.2-5.8.el8_10 | [RHSA-2025:0837](https://patchblox.com/security/data/fix/linux/rhsa-2025-0837.md) | Jan 30, 2025 |
| Linux | unbound RHEL 9 | 0:1.16.2-18.el9_6 | [RHSA-2025:8197](https://patchblox.com/security/data/fix/linux/rhsa-2025-8197.md) | May 27, 2025 |
| Linux | unbound Ubuntu 18.04.6 LTS (bionic) | 1.6.7-1ubuntu2.6+esm3 | [unbound 1.6.7-1ubuntu2.6+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-unbound-1.6.7-1ubuntu2.6-esm3.md) | Oct 3, 2024 |
| Linux | unbound Ubuntu 20.04 LTS (focal) | 1.9.4-2ubuntu1.9 | [unbound 1.9.4-2ubuntu1.9](https://patchblox.com/security/data/fix/linux/ubuntu-focal-unbound-1.9.4-2ubuntu1.9.md) | Oct 3, 2024 |
| Linux | unbound Ubuntu 22.04.1 LTS (jammy) | 1.13.1-1ubuntu5.8 | [unbound 1.13.1-1ubuntu5.8](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-unbound-1.13.1-1ubuntu5.8.md) | Oct 3, 2024 |
| Linux | unbound Ubuntu 24.04.5 LTS (noble) | 1.19.2-1ubuntu3.3 | [unbound 1.19.2-1ubuntu3.3](https://patchblox.com/security/data/fix/linux/ubuntu-noble-unbound-1.19.2-1ubuntu3.3.md) | Oct 3, 2024 |
| Linux | unbound Ubuntu 24.10 (oracular) | 1.20.0-1ubuntu2.1 | [unbound 1.20.0-1ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-unbound-1.20.0-1ubuntu2.1.md) | Jan 16, 2026 |
| Linux | unbound almalinux 10 | 1.20.0-10.el10_0 | [ALSA-2025:8047](https://patchblox.com/security/data/fix/linux/alsa-2025-8047.md) | May 20, 2025 |
| Linux | unbound almalinux 8 | 1.16.2-5.8.el8_10 | [ALSA-2025:0837](https://patchblox.com/security/data/fix/linux/alsa-2025-0837.md) | Jan 30, 2025 |
| Linux | unbound almalinux 9 | 1.16.2-8.el9_5.1 | [ALSA-2024:11232](https://patchblox.com/security/data/fix/linux/alsa-2024-11232.md) | Dec 17, 2024 |
| Linux | unbound amzn 2023 | 1.17.1-1.amzn2023.0.6 | [ALAS2023-2024-719](https://patchblox.com/security/data/fix/linux/alas2023-2024-719.md) | Oct 10, 2024 |
| Linux | unbound ol 10 | 0:1.20.0-10.el10_0 | [ELSA-2025-8047](https://patchblox.com/security/data/fix/linux/elsa-2025-8047.md) | Jun 27, 2025 |
| Linux | unbound ol 8 | 0:1.16.2-5.8.el8_10 | [ELSA-2025-0837](https://patchblox.com/security/data/fix/linux/elsa-2025-0837.md) | Jan 30, 2025 |
| Linux | unbound ol 9 | 0:1.16.2-8.el9_5.1 | [ELSA-2024-11232](https://patchblox.com/security/data/fix/linux/elsa-2024-11232.md) | Dec 19, 2024 |
| Linux | unbound opensuse-leap 15.6 | 1.20.0-150600.23.9.1 | [SUSE-SU-2024:3647-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3647-1.md) | Oct 16, 2024 |
| Linux | unbound rocky 10 | 0:1.20.0-10.el10_0 | [RLSA-2025:8047](https://patchblox.com/security/data/fix/linux/rlsa-2025-8047.md) | Oct 3, 2025 |
| Linux | unbound rocky 8 | 0:1.16.2-5.8.el8_10 | [RLSA-2025:0837](https://patchblox.com/security/data/fix/linux/rlsa-2025-0837.md) | Feb 13, 2025 |
| Linux | unbound rocky 9 | 0:1.16.2-18.el9_6 | [RLSA-2025:8197](https://patchblox.com/security/data/fix/linux/rlsa-2025-8197.md) | Oct 4, 2025 |
| Linux | unbound sles 15.6 | 1.20.0-150600.23.9.1 | [SUSE-SU-2024:3647-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3647-1.md) | Oct 16, 2024 |
| Linux | unbound-anchor Ubuntu 18.04.6 LTS (bionic) | 1.6.7-1ubuntu2.6+esm3 | [unbound-anchor 1.6.7-1ubuntu2.6+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-unbound-anchor-1.6.7-1ubuntu2.6-esm3.md) | Oct 3, 2024 |
| Linux | unbound-anchor Ubuntu 20.04 LTS (focal) | 1.9.4-2ubuntu1.9 | [unbound-anchor 1.9.4-2ubuntu1.9](https://patchblox.com/security/data/fix/linux/ubuntu-focal-unbound-anchor-1.9.4-2ubuntu1.9.md) | Oct 3, 2024 |
| Linux | unbound-anchor Ubuntu 22.04.1 LTS (jammy) | 1.13.1-1ubuntu5.8 | [unbound-anchor 1.13.1-1ubuntu5.8](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-unbound-anchor-1.13.1-1ubuntu5.8.md) | Oct 3, 2024 |
| Linux | unbound-anchor Ubuntu 24.04.5 LTS (noble) | 1.19.2-1ubuntu3.3 | [unbound-anchor 1.19.2-1ubuntu3.3](https://patchblox.com/security/data/fix/linux/ubuntu-noble-unbound-anchor-1.19.2-1ubuntu3.3.md) | Oct 3, 2024 |
| Linux | unbound-anchor Ubuntu 24.10 (oracular) | 1.20.0-1ubuntu2.1 | [unbound-anchor 1.20.0-1ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-unbound-anchor-1.20.0-1ubuntu2.1.md) | Jan 16, 2026 |
| Linux | unbound-anchor almalinux 10 | 1.20.0-10.el10_0 | [ALSA-2025:8047](https://patchblox.com/security/data/fix/linux/alsa-2025-8047.md) | May 20, 2025 |
| Linux | unbound-anchor amzn 2023 | 1.17.1-1.amzn2023.0.6 | [ALAS2023-2024-719](https://patchblox.com/security/data/fix/linux/alas2023-2024-719.md) | Oct 10, 2024 |
| Linux | unbound-anchor ol 10 | 0:1.20.0-10.el10_0 | [ELSA-2025-8047](https://patchblox.com/security/data/fix/linux/elsa-2025-8047.md) | Jun 27, 2025 |
| Linux | unbound-anchor-debuginfo amzn 2023 | 1.17.1-1.amzn2023.0.6 | [ALAS2023-2024-719](https://patchblox.com/security/data/fix/linux/alas2023-2024-719.md) | Oct 10, 2024 |
| Linux | unbound-debuginfo amzn 2023 | 1.17.1-1.amzn2023.0.6 | [ALAS2023-2024-719](https://patchblox.com/security/data/fix/linux/alas2023-2024-719.md) | Oct 10, 2024 |
| Linux | unbound-debugsource amzn 2023 | 1.17.1-1.amzn2023.0.6 | [ALAS2023-2024-719](https://patchblox.com/security/data/fix/linux/alas2023-2024-719.md) | Oct 10, 2024 |
| Linux | unbound-devel RHEL 8 | 0:1.16.2-5.8.el8_10 | [RHSA-2025:0837](https://patchblox.com/security/data/fix/linux/rhsa-2025-0837.md) | Jan 30, 2025 |
| Linux | unbound-devel RHEL 9 | 0:1.16.2-18.el9_6 | [RHSA-2025:8197](https://patchblox.com/security/data/fix/linux/rhsa-2025-8197.md) | May 27, 2025 |
| Linux | unbound-devel almalinux 10 | 1.20.0-10.el10_0 | [ALSA-2025:8047](https://patchblox.com/security/data/fix/linux/alsa-2025-8047.md) | May 20, 2025 |
| Linux | unbound-devel almalinux 8 | 1.16.2-5.8.el8_10 | [ALSA-2025:0837](https://patchblox.com/security/data/fix/linux/alsa-2025-0837.md) | Jan 30, 2025 |
| Linux | unbound-devel almalinux 9 | 1.16.2-8.el9_5.1 | [ALSA-2024:11232](https://patchblox.com/security/data/fix/linux/alsa-2024-11232.md) | Dec 17, 2024 |
| Linux | unbound-devel amzn 2023 | 1.17.1-1.amzn2023.0.6 | [ALAS2023-2024-719](https://patchblox.com/security/data/fix/linux/alas2023-2024-719.md) | Oct 10, 2024 |
| Linux | unbound-devel ol 10 | 0:1.20.0-10.el10_0 | [ELSA-2025-8047](https://patchblox.com/security/data/fix/linux/elsa-2025-8047.md) | Jun 27, 2025 |
| Linux | unbound-devel ol 8 | 0:1.16.2-5.8.el8_10 | [ELSA-2025-0837](https://patchblox.com/security/data/fix/linux/elsa-2025-0837.md) | Jan 30, 2025 |
| Linux | unbound-devel ol 9 | 0:1.16.2-8.el9_5.1 | [ELSA-2024-11232](https://patchblox.com/security/data/fix/linux/elsa-2024-11232.md) | Dec 19, 2024 |
| Linux | unbound-dracut RHEL 9 | 0:1.16.2-18.el9_6 | [RHSA-2025:8197](https://patchblox.com/security/data/fix/linux/rhsa-2025-8197.md) | May 27, 2025 |
| Linux | unbound-dracut almalinux 10 | 1.20.0-10.el10_0 | [ALSA-2025:8047](https://patchblox.com/security/data/fix/linux/alsa-2025-8047.md) | May 20, 2025 |
| Linux | unbound-dracut ol 10 | 0:1.20.0-10.el10_0 | [ELSA-2025-8047](https://patchblox.com/security/data/fix/linux/elsa-2025-8047.md) | Jun 27, 2025 |
| Linux | unbound-dracut ol 9 | 0:1.16.2-18.el9_6 | [ELSA-2025-8197](https://patchblox.com/security/data/fix/linux/elsa-2025-8197.md) | May 27, 2025 |
| Linux | unbound-host Ubuntu 18.04.6 LTS (bionic) | 1.6.7-1ubuntu2.6+esm3 | [unbound-host 1.6.7-1ubuntu2.6+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-unbound-host-1.6.7-1ubuntu2.6-esm3.md) | Oct 3, 2024 |
| Linux | unbound-host Ubuntu 20.04 LTS (focal) | 1.9.4-2ubuntu1.9 | [unbound-host 1.9.4-2ubuntu1.9](https://patchblox.com/security/data/fix/linux/ubuntu-focal-unbound-host-1.9.4-2ubuntu1.9.md) | Oct 3, 2024 |
| Linux | unbound-host Ubuntu 22.04.1 LTS (jammy) | 1.13.1-1ubuntu5.8 | [unbound-host 1.13.1-1ubuntu5.8](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-unbound-host-1.13.1-1ubuntu5.8.md) | Oct 3, 2024 |
| Linux | unbound-host Ubuntu 24.04.5 LTS (noble) | 1.19.2-1ubuntu3.3 | [unbound-host 1.19.2-1ubuntu3.3](https://patchblox.com/security/data/fix/linux/ubuntu-noble-unbound-host-1.19.2-1ubuntu3.3.md) | Oct 3, 2024 |
| Linux | unbound-host Ubuntu 24.10 (oracular) | 1.20.0-1ubuntu2.1 | [unbound-host 1.20.0-1ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-unbound-host-1.20.0-1ubuntu2.1.md) | Jan 16, 2026 |
| Linux | unbound-libs RHEL 8 | 0:1.16.2-5.8.el8_10 | [RHSA-2025:0837](https://patchblox.com/security/data/fix/linux/rhsa-2025-0837.md) | Jan 30, 2025 |
| Linux | unbound-libs RHEL 9 | 0:1.16.2-18.el9_6 | [RHSA-2025:8197](https://patchblox.com/security/data/fix/linux/rhsa-2025-8197.md) | May 27, 2025 |
| Linux | unbound-libs almalinux 10 | 1.20.0-10.el10_0 | [ALSA-2025:8047](https://patchblox.com/security/data/fix/linux/alsa-2025-8047.md) | May 20, 2025 |
| Linux | unbound-libs almalinux 8 | 1.16.2-5.8.el8_10 | [ALSA-2025:0837](https://patchblox.com/security/data/fix/linux/alsa-2025-0837.md) | Jan 30, 2025 |
| Linux | unbound-libs almalinux 9 | 1.16.2-8.el9_5.1 | [ALSA-2024:11232](https://patchblox.com/security/data/fix/linux/alsa-2024-11232.md) | Dec 17, 2024 |
| Linux | unbound-libs amzn 2023 | 1.17.1-1.amzn2023.0.6 | [ALAS2023-2024-719](https://patchblox.com/security/data/fix/linux/alas2023-2024-719.md) | Oct 10, 2024 |
| Linux | unbound-libs ol 10 | 0:1.20.0-10.el10_0 | [ELSA-2025-8047](https://patchblox.com/security/data/fix/linux/elsa-2025-8047.md) | Jun 27, 2025 |
| Linux | unbound-libs ol 8 | 0:1.16.2-5.8.el8_10 | [ELSA-2025-0837](https://patchblox.com/security/data/fix/linux/elsa-2025-0837.md) | Jan 30, 2025 |
| Linux | unbound-libs ol 9 | 0:1.16.2-8.el9_5.1 | [ELSA-2024-11232](https://patchblox.com/security/data/fix/linux/elsa-2024-11232.md) | Dec 19, 2024 |
| Linux | unbound-libs-debuginfo amzn 2023 | 1.17.1-1.amzn2023.0.6 | [ALAS2023-2024-719](https://patchblox.com/security/data/fix/linux/alas2023-2024-719.md) | Oct 10, 2024 |
| Linux | unbound-utils amzn 2023 | 1.17.1-1.amzn2023.0.6 | [ALAS2023-2024-719](https://patchblox.com/security/data/fix/linux/alas2023-2024-719.md) | Oct 10, 2024 |
| Linux | unbound-utils-debuginfo amzn 2023 | 1.17.1-1.amzn2023.0.6 | [ALAS2023-2024-719](https://patchblox.com/security/data/fix/linux/alas2023-2024-719.md) | Oct 10, 2024 |

---

Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.