CVE-2024-1931

A vulnerability was found in Unbound. The issue arises due to a flaw in the handling of Extended DNS Error (EDE) records when the 'ede: yes' option is enabled, a non-default configuration. Specifically, an unchecked condition in the code can trigger an infinite loop when attempting to trim the text fields of EDE records to fit within the client's buffer size. This vulnerability could potentially lead to denial of service (DoS) as the infinite loop consumes system resources, impacting the availability of the Unbound DNS resolver.

The vulnerability present in Unbound, while posing a risk of denial of service, is assessed as having a Moderate severity level from a technical perspective. The severity is primarily attributed to the potential for exploitation under specific conditions, namely when the 'ede: yes' option is enabled, which is not the default configuration. Additionally, the vulnerability manifests in a limited scenario where responses containing Extended DNS Error (EDE) records exceed the client's buffer size. While the issue can result in an infinite loop and consequent denial of service, its impact is constrained to situations where these specific conditions align.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.