CVE-2009-3602

Unbound before 1.3.4 does not properly verify signatures for NSEC3 records, which allows remote attackers to cause secure delegations to be downgraded via DNS spoofing or other DNS-related attacks in conjunction with crafted delegation responses.

• CWE-310

• http://osvdb.org/58836
• http://secunia.com/advisories/36996Vendor Advisory
• http://secunia.com/advisories/37913
• http://unbound.net/pipermail/unbound-users/2009-October/000852.htmlVendor Advisory
• http://www.debian.org/security/2009/dsa-1963
• http://www.openwall.com/lists/oss-security/2009/10/09/2
• http://www.openwall.com/lists/oss-security/2009/10/09/3
• http://www.vupen.com/english/advisories/2009/2875Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53729
• http://osvdb.org/58836
• http://secunia.com/advisories/36996Vendor Advisory
• http://secunia.com/advisories/37913
• http://unbound.net/pipermail/unbound-users/2009-October/000852.htmlVendor Advisory
• http://www.debian.org/security/2009/dsa-1963
• http://www.openwall.com/lists/oss-security/2009/10/09/2
• http://www.openwall.com/lists/oss-security/2009/10/09/3
• http://www.vupen.com/english/advisories/2009/2875Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53729

Published

Oct 13, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-3596JoxTechnology Ajox Poll does not properly restrict access to…
• CVE-2009-3597Digitaldesign CMS 0.1 stores sensitive information under the…
• CVE-2009-3598Cross-site scripting (XSS) vulnerability in survey_result.ph…
• CVE-2009-3599Cross-site scripting (XSS) vulnerability in single_winner1.p…
• CVE-2009-3600HUBScript 1.0 allows remote attackers to obtain configuratio…
• CVE-2009-3601Cross-site scripting (XSS) vulnerability in demo_page.php in…
• CVE-2009-3603Integer overflow in the SplashBitmap::SplashBitmap function …
• CVE-2009-3604The Splash::drawImage function in Splash.cc in Xpdf 2.x and …
• CVE-2009-3605Multiple integer overflows in Poppler 0.10.5 and earlier all…
• CVE-2009-3606Integer overflow in the PSOutputDev::doImageL1Sep function i…
• CVE-2009-3607Integer overflow in the create_surface_from_thumbnail_data f…
• CVE-2009-3608Integer overflow in the ObjectStream::ObjectStream function …