CVE-2019-25035 — unbound: out-of-bounds write in sldns_bget_token_par

Back Back to CVE browser

CRITICAL

unbound: out-of-bounds write in sldns_bget_token_par

Published Apr 27, 2021

9.8

CRITICAL

CVSS 3.1

EPSS 2.04%

Description

Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited

Affected products

Red Hat Enterprise Linux 8

unbound-0:1.7.3-15.el8

Fixed · RHSA-2021:1853
Red Hat Enterprise Linux 8.2 Extended Update Support

unbound-0:1.7.3-12.el8_2

Fixed · RHSA-2022:0632
Red Hat Enterprise Linux 6

unbound

Out of support scope
Red Hat Enterprise Linux 7

unbound

Out of support scope
Red Hat Enterprise Linux 9

unbound

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 8	unbound-0:1.7.3-15.el8	Fixed	RHSA-2021:1853
Red Hat Enterprise Linux 8.2 Extended Update Support	unbound-0:1.7.3-12.el8_2	Fixed	RHSA-2022:0632
Red Hat Enterprise Linux 6	unbound	Out of support scope	n/a
Red Hat Enterprise Linux 7	unbound	Out of support scope	n/a
Red Hat Enterprise Linux 9	unbound	Not affected	n/a

Remediation

Red Hat statement

There is no available reproducer or proof of concept for this issue, nor it was ever proven the out-of-bounds write can happen in practice. Indeed in the original report this issue was considered one that might not be triggered and for this reason its Impact is Moderate. Upstream has also disputed this CVE.

Metrics

2.04% 0.02037

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.02037

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (17 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	2.04% (0.02037)	80.39th	v5 (v2026.06.15)
Jun 15, 2026	2.04% (0.02037)	78.52th	v5 (v2026.06.15)
Mar 17, 2025	0.21% (0.00209)	41.33th	v4 (v2025.03.14)
Dec 12, 2024	0.31% (0.00311)	70.93th	v3 (v2023.03.01)
May 14, 2024	0.31% (0.00311)	69.90th	v3 (v2023.03.01)
Jan 11, 2024	0.22% (0.00219)	59.85th	v3 (v2023.03.01)
Dec 22, 2023	0.20% (0.00199)	57.69th	v3 (v2023.03.01)
Mar 7, 2023	0.20% (0.00196)	55.67th	v3 (v2023.03.01)
Mar 6, 2023	0.95% (0.00954)	36.37th	v2 (v2022.01.01)
Sep 2, 2022	0.95% (0.00954)	34.50th	v2 (v2022.01.01)
Apr 1, 2022	0.95% (0.00954)	32.50th	v2 (v2022.01.01)
Feb 4, 2022	0.95% (0.00954)	16.28th	v2 (v2022.01.01)
Feb 3, 2022	0.83% (0.00833)	24.58th	v1
Jan 6, 2022	0.83% (0.00833)	23.96th	v1
Sep 1, 2021	0.83% (0.00833)	57.50th	v1
May 7, 2021	0.83% (0.00833)	0.00th	v1
Apr 27, 2021	0.42% (0.00416)	0.00th	v1

Weaknesses (1)

CWE-787

Out-of-bounds Write

References (7)

https://access.redhat.com/security/cve/CVE-2019-25035
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1954780
Issue Tracking
https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-25035
https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/
x_refsource_MISCNot ApplicableThird Party Advisory
https://security.netapp.com/advisory/ntap-20210507-0007/
x_refsource_CONFIRMThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2019-25035

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2019-25035		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1954780		Issue Tracking
https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-25035
https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/		x_refsource_MISCNot ApplicableThird Party Advisory
https://security.netapp.com/advisory/ntap-20210507-0007/		x_refsource_CONFIRMThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2019-25035