CVE-2024-8508: NLnet Labs Unbound DNS DoS Vulnerability

CVE-2024-8508 Overview

CVE-2024-8508 affects NLnet Labs Unbound, a widely deployed validating, recursive, and caching DNS resolver. Versions up to and including 1.21.0 mishandle name compression when processing replies containing very large Resource Record sets (RRsets). A malicious upstream authoritative server can return crafted responses that force Unbound to perform unbounded name compression calculations before replying downstream. The resulting CPU exhaustion degrades resolver performance and can produce a denial of service under a coordinated attack. The issue is tracked under [CWE-606] (Unchecked Input for Loop Condition) and [CWE-1284] (Improper Validation of Specified Quantity in Input).

Critical Impact
Attackers who control an authoritative zone can force Unbound resolvers to lock CPU cycles on name compression, causing service degradation and potential denial of service for downstream DNS clients.

Affected Products

NLnet Labs Unbound versions up to and including 1.21.0
Debian GNU/Linux 11 (Bullseye) shipped Unbound packages
Downstream distributions and appliances embedding vulnerable Unbound builds

Discovery Timeline

2024-10-03 - CVE-2024-8508 published to the National Vulnerability Database
2024-10-04 - Public disclosure via the Openwall oss-security mailing list
2024-11 - Debian LTS security update announcement issued for affected packages
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8508

Vulnerability Analysis

Unbound applies DNS name compression to outgoing packets to reduce message size. When Unbound assembles a downstream reply, it iterates over the RRsets in the response and searches for repeated domain labels that can be replaced with compression pointers. This routine had no upper bound on the number of comparisons performed per packet.

An attacker who operates or controls an authoritative name server can craft a zone that returns replies containing very large RRsets with many similarly structured owner names. When a client queries Unbound for records in that zone, Unbound recursively fetches the response and then attempts to compress it before returning it to the client. The compression pass scales poorly with the number of names, monopolizing a CPU core until the packet is complete. Repeated queries amplify the effect and starve legitimate DNS resolution.

Root Cause

The root cause is an algorithmic complexity flaw in the name compression routine. The function lacked a hard limit on the number of compression comparisons per packet, allowing attacker-controlled input to drive the loop count. This aligns with [CWE-606] and [CWE-1284], where input quantity is not validated before being used to control iteration.

Attack Vector

Exploitation is remote and unauthenticated. A malicious actor hosts a zone containing very large RRsets and induces a target Unbound resolver to query records in that zone. Because Unbound performs compression on every outbound reply, the attacker does not need direct network access to the resolver, only the ability to make it resolve names from the malicious zone. The impact is limited to availability. Confidentiality and integrity are not affected.

No verified exploit code has been published. The vulnerability mechanism is described in the NLnet Labs advisory and the corresponding Openwall disclosure.

Detection Methods for CVE-2024-8508

Indicators of Compromise

Sustained high CPU utilization on the Unbound resolver process without a proportional increase in query volume from clients.
Increased latency, timeouts, or SERVFAIL responses returned to downstream DNS clients during targeted queries.
Recursive queries to unfamiliar authoritative zones producing unusually large UDP or TCP DNS responses.
Truncated (TC bit set) responses or fallbacks to TCP for queries against a small set of external domains.

Detection Strategies

Monitor Unbound performance counters, especially total.num.queries, mem.mod.iterator, and per-thread CPU time, for anomalies decoupled from client query rates.
Alert on outbound recursive queries returning responses that exceed typical RRset sizes for the queried record type.
Correlate DNS telemetry with process-level CPU metrics to identify sustained single-thread saturation on the resolver host.

Monitoring Recommendations

Ingest Unbound unbound-control stats output and host CPU metrics into a centralized analytics platform for baselining.
Log the authoritative servers contacted for recursive resolution and flag zones that repeatedly return oversized responses.
Establish alerts for repeated queries from the same client to unusual TLDs or newly registered domains that trigger large recursive fetches.

How to Mitigate CVE-2024-8508

Immediate Actions Required

Upgrade Unbound to version 1.21.1 or later, which enforces a hard limit on name compression calculations per packet.
Apply the corresponding Debian LTS security update on Debian 11 systems as documented in the Debian LTS announcement.
Inventory all recursive DNS resolvers, forwarders, and appliances that embed Unbound and confirm patched builds are deployed.

Patch Information

NLnet Labs released Unbound 1.21.1 to address CVE-2024-8508. The fix introduces a bounded number of name compression operations per response. When the limit is reached, Unbound returns semi-compressed or truncated packets rather than continuing to spend CPU cycles, including on TCP for very large messages. According to NLnet Labs, this change does not affect normal DNS traffic. See the NLnet Labs advisory for release details.

Workarounds

Restrict recursion to trusted client subnets using access-control to limit exposure to internal abuse.
Configure harden-large-queries: yes and review msg-buffer-size to constrain response handling where operationally feasible.
Apply rate limiting via ratelimit and per-client ip-ratelimit to slow attacker-driven query bursts against malicious zones.
Deploy resolver redundancy behind a load balancer so that CPU saturation of one instance does not eliminate DNS availability.

bash

# Example Unbound hardening options in unbound.conf
server:
    access-control: 10.0.0.0/8 allow
    access-control: 0.0.0.0/0 refuse
    harden-large-queries: yes
    ratelimit: 1000
    ip-ratelimit: 200