CVE-2024-1488 is a high severity (CVSS 8.0) flaw in Unbound caused by incorrect default permissions. A process that can connect over localhost to port 8953 can change the running resolver's configuration. Red Hat shipped security updates, and its advisory rates it Important. Apply your distribution's update.
What's affected
The record lists the Unbound package for Fedora and several Red Hat Enterprise Linux products, including CodeReady Linux Builder. Red Hat released several errata for it, among them RHSA-2024:1750 for Red Hat Enterprise Linux 9, published on 10 April 2024.
Red Hat's advisory labels the update Important. The record scores it 8.0 High. These are different rating scales and they do not conflict, but both are worth quoting. The record's description says "any process", while the Red Hat text says "unprivileged local process". Read it as a local attack that needs a way to run code on the host.
How to check if you're exposed
On a Red Hat family system, read the package version and its change log for the CVE:
rpm -q unbound
rpm -q --changelog unbound | grep CVE-2024-1488
If the change log mentions the CVE, your build has the fix. Also check whether the remote control interface is enabled in the Unbound configuration, and what address it listens on.
To check a whole codebase at once, run the free in-browser dependency scan at gold.safeguard.sh/scan. You can also look up the CVE in the Gold directory, and use reachability analysis to see whether your code calls the affected path.
What to do now
- List hosts that run Unbound, including appliances and containers.
- Install the vendor update for your distribution from the relevant Red Hat erratum or Fedora package update.
- Restart the service after updating.
- Review the Unbound configuration for the control interface and keep it on a protected socket.
- Check forwarder settings against what you expect.
Why it matters
The class is CWE-276, incorrect default permissions. A control channel that should be limited to the resolver's own group was reachable by other local processes.
With control access, an attacker can change where queries are forwarded. That allows observation of every query the resolver forwards, and in some cases it can disrupt name resolution entirely. Because DNS sits under everything else, small config changes can have wide effects. The record's KEV flag is false.
Quick check
Does the attacker need to be on the host?
Yes. The attack is by a process that can connect over localhost to the control port.
Which port is involved?
The record names port 8953.
Sources
Last reviewed: 19 October 2026.
