Every CVE Search/ Get API key

CVE-2026-44608

Use after free and crash under special conditions in RPZ code

4.6 MediumFix available

NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met (multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers) it could result in heap use-after-free and eventual crash. An adversary can exploit the vulnerability if conditions are first met on a vulnerable Unbound, i.e., multi-threaded, an RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers and an ongoing XFR for that RPZ zone. Local RPZ files do not trigger the vulnerability. If the timing is right and an XFR happens at the same time another thread needs to read that RPZ zone, the reader may not hold the lock long enough and the thread applying the XFR may free objects that the reader is about to walk causing the use-after-free. Unbound 1.25.1 contains a patch with a fix to the locking code.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.26%Up 0.2 points since May 20, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.6

Use after free and crash under special conditions in RPZ code

NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met (multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers) it could result in heap use-after-free and eventual crash. An adversary can exploit the vulnerability if conditions are first met on a vulnerable Unbound, i.e., multi-threaded, an RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers and an ongoing XFR for that RPZ zone. Local RPZ files do not trigger the vulnerability. If the timing is right and an XFR happens at the same time another thread needs to read that RPZ zone, the reader may not hold the lock long enough and the thread applying the XFR may free objects that the reader is about to walk causing the use-after-free. Unbound 1.25.1 contains a patch with a fix to the locking code.

Record
CVE-2026-44608
CVSS 4.0
4.6 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
Weakness
CWE-413
Updated
2026-11-02
EUVDEUVD-2026-31087 4.6

NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met (multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers) it could result in heap use-after-free and eventual crash. An adversary can exploit the vulnerability if conditions are first met on a vulnerable Unbound, i.e., multi-threaded, an RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers and an ongoing XFR for that RPZ zone. Local RPZ files do not trigger the vulnerability. If the timing is right and an XFR happens at the same time another thread needs to read that RPZ zone, the reader may not hold the lock long enough and the thread applying the XFR may free objects that the reader is about to walk causing the use-after-free. Unbound 1.25.1 contains a patch with a fix to the locking code.

Record
EUVD-2026-31087
CVSS 4.0
4.6 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
Updated
2026-11-02
GitHub AdvisoriesGHSA-fx8q-9cm5-75v9 4.6

NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency...

NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met (multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers) it could result in heap use-after-free and eventual crash. An adversary can exploit the vulnerability if conditions are first met on a vulnerable Unbound, i.e., multi-threaded, an RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers and an ongoing XFR for that RPZ zone. Local RPZ files do not trigger the vulnerability. If the timing is right and an XFR happens at the same time another thread needs to read that RPZ zone, the reader may not hold the lock long enough and the thread applying the XFR may free objects that the reader is about to walk causing the use-after-free. Unbound 1.25.1 contains a patch with a fix to the locking code.

Record
GHSA-fx8q-9cm5-75v9
CVSS 4.0
4.6 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-413
Updated
2026-11-02
NVD 4.6

NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met (multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers) it could result in heap use-after-free and eventual crash. An adversary can exploit the vulnerability if conditions are first met on a vulnerable Unbound, i.e., multi-threaded, an RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers and an ongoing XFR for that RPZ zone. Local RPZ files do not trigger the vulnerability. If the timing is right and an XFR happens at the same time another thread needs to read that RPZ zone, the reader may not hold the lock long enough and the thread applying the XFR may free objects that the reader is about to walk causing the use-after-free. Unbound 1.25.1 contains a patch with a fix to the locking code.

Record
CVE-2026-44608
CVSS 4.0
4.6 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-413
Updated
2026-11-02
OSVALPINE-CVE-2026-44608 5.9

NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met (multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers) it could result in heap use-after-free and eventual crash. An adversary can exploit the vulnerability if conditions are first met on a vulnerable Unbound, i.e., multi-threaded, an RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers and an ongoing XFR for that RPZ zone. Local RPZ files do not trigger the vulnerability. If the timing is right and an XFR happens at the same time another thread needs to read that RPZ zone, the reader may not hold the lock long enough and the thread applying the XFR may free objects that the reader is about to walk causing the use-after-free. Unbound 1.25.1 contains a patch with a fix to the locking code.

Record
ALPINE-CVE-2026-44608
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 5.9

NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met (multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers) it could result in heap use-after-free and eventual crash. An adversary can exploit the vulnerability if conditions are first met on a vulnerable Unbound, i.e., multi-threaded, an RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers and an ongoing XFR for that RPZ zone. Local RPZ files do not trigger the vulnerability. If the timing is right and an XFR happens at the same time another thread needs to read that RPZ zone, the reader may not hold the lock long enough and the thread applying the XFR may free objects that the reader is about to walk causing the use-after-free. Unbound 1.25.1 contains a patch with a fix to the locking code.

Record
CVE-2026-44608
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 15 moreShow less
OSVDEBIAN-CVE-2026-44608 5.9

NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met (multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers) it could result in heap use-after-free and eventual crash. An adversary can exploit the vulnerability if conditions are first met on a vulnerable Unbound, i.e., multi-threaded, an RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers and an ongoing XFR for that RPZ zone. Local RPZ files do not trigger the vulnerability. If the timing is right and an XFR happens at the same time another thread needs to read that RPZ zone, the reader may not hold the lock long enough and the thread applying the XFR may free objects that the reader is about to walk causing the use-after-free. Unbound 1.25.1 contains a patch with a fix to the locking code.

Record
DEBIAN-CVE-2026-44608
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-2607 7.5

unbound security update

Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn't make custom builds or provide specific features to paying customers only.

Security Fix(es):

NLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service vulnerability when compiled with DNSCrypt support ('--enable-dnscrypt'). A bad DNSCrypt query could underflow Unbound's DNSCrypt packet reading procedure that may lead to heap overflow. A malicious actor can exploit the vulnerability with a single bad DNSCrypt query that its decrypted plaintext consists entirely of '0x00' bytes and does not contain the expected '0x80' marker. Unbound would then start reading more bytes than necessary until it finds a non-'0x00' byte. Based on the underlying memory allocator and the memory layout, it could lead to heap overflow while reading followed by a crash. Likelihood of a crash is low, since it relies heavily on the underlying memory allocator and the memory layout. If the heap overflow does not happen, Unbound's later packet checks will deny the packet. Unbound 1.25.1 contains a patch with a fix to bound reading in the given buffer space.(CVE-2026-32792)

NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.(CVE-2026-40622)

NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could defeat its purpose and degrade resolution performance. Retransmits of the same query could renew the age of slow running queries and not allow the jostle logic to see them as aged and potential targets for replacement with new queries. An adversary who can query a vulnerable Unbound and who can control a domain name server that replies slowly and/or maliciously to Unbound's queries can exploit the vulnerability and degrade the resolution performance of Unbound. When Unbound's 'num-queries-per-thread' reaches its limit, the jostle logic kicks in. When a new query comes in, half of the available queries that are also slow to resolve are candidates for replacement. The vulnerability then happens because duplicate queries that need resolution would skew the aging result by using the timestamp of the latest duplicate query instead of the original one that started the resolution effort. Cache and local data response performance remains unaffected. Coordinated attacks could raise this to a denial of resolution service. Unbound 1.25.1 contains a patch with a fix to attach an initial, non-updatable start time for incoming queries that allow the jostle logic to work as intended.(CVE-2026-42534)

NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code…

Record
OESA-2026-2607
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVOESA-2026-2608 7.5

unbound security update

Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn't make custom builds or provide specific features to paying customers only.

Security Fix(es):

NLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service vulnerability when compiled with DNSCrypt support ('--enable-dnscrypt'). A bad DNSCrypt query could underflow Unbound's DNSCrypt packet reading procedure that may lead to heap overflow. A malicious actor can exploit the vulnerability with a single bad DNSCrypt query that its decrypted plaintext consists entirely of '0x00' bytes and does not contain the expected '0x80' marker. Unbound would then start reading more bytes than necessary until it finds a non-'0x00' byte. Based on the underlying memory allocator and the memory layout, it could lead to heap overflow while reading followed by a crash. Likelihood of a crash is low, since it relies heavily on the underlying memory allocator and the memory layout. If the heap overflow does not happen, Unbound's later packet checks will deny the packet. Unbound 1.25.1 contains a patch with a fix to bound reading in the given buffer space.(CVE-2026-32792)

NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.(CVE-2026-40622)

NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could defeat its purpose and degrade resolution performance. Retransmits of the same query could renew the age of slow running queries and not allow the jostle logic to see them as aged and potential targets for replacement with new queries. An adversary who can query a vulnerable Unbound and who can control a domain name server that replies slowly and/or maliciously to Unbound's queries can exploit the vulnerability and degrade the resolution performance of Unbound. When Unbound's 'num-queries-per-thread' reaches its limit, the jostle logic kicks in. When a new query comes in, half of the available queries that are also slow to resolve are candidates for replacement. The vulnerability then happens because duplicate queries that need resolution would skew the aging result by using the timestamp of the latest duplicate query instead of the original one that started the resolution effort. Cache and local data response performance remains unaffected. Coordinated attacks could raise this to a denial of resolution service. Unbound 1.25.1 contains a patch with a fix to attach an initial, non-updatable start time for incoming queries that allow the jostle logic to work as intended.(CVE-2026-42534)

NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code…

Record
OESA-2026-2608
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:19752 8.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:19752
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-44608 4.6

NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met (multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers) it could result in heap use-after-free and eventual crash. An adversary can exploit the vulnerability if conditions are first met on a vulnerable Unbound, i.e., multi-threaded, an RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers and an ongoing XFR for that RPZ zone. Local RPZ files do not trigger the vulnerability. If the timing is right and an XFR happens at the same time another thread needs to read that RPZ zone, the reader may not hold the lock long enough and the thread applying the XFR may free objects that the reader is about to walk causing the use-after-free. Unbound 1.25.1 contains a patch with a fix to the locking code.

Record
UBUNTU-CVE-2026-44608
CVSS 4.0
4.6 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-87024 No score

CVE-2026-44608 affecting package unbound for versions less than 1.25.1-1

NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met (multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers) it could result in heap use-after-free and eventual crash. An adversary can exploit the vulnerability if conditions are first met on a vulnerable Unbound, i.e., multi-threaded, an RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers and an ongoing XFR for that RPZ zone. Local RPZ files do not trigger the vulnerability. If the timing is right and an XFR happens at the same time another thread needs to read that RPZ zone, the reader may not hold the lock long enough and the thread applying the XFR may free objects that the reader is about to walk causing the use-after-free. Unbound 1.25.1 contains a patch with a fix to the locking code.

Record
AZL-87024
Updated
2026-11-02
OSVCLSA-2026-1780068958 No score

unbound: Fix of 3 CVEs

  • CVE-2026-41292: cap parsed incoming EDNS options at 100 to prevent per-thread parse stalls under crafted long-option-list queries
  • CVE-2026-42944: de-duplicate NSID/Padding EDNS options at parse time to prevent heap overflow during EDNS encoding in attach_edns_record
  • CVE-2026-44608: hold the auth-zone read lock across nsip/nsdname trigger application in rpz_callback_from_iterator_module to avoid use-after-free under concurrent RPZ XFR reload
Record
CLSA-2026-1780068958
Updated
2026-11-02
OSVopenSUSE-SU-2026:10903-1 No score

libunbound8-1.25.1-1.1 on GA media

These are all security issues fixed in the libunbound8-1.25.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10903-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21083-1 No score

Security update for unbound

This update for unbound fixes the following issues

  • CVE-2026-32792: Packet of death with DNSCrypt (bsc#1265583).
  • CVE-2026-33278: Possible remote code execution during DNSSEC validation (bsc#1265587).
  • CVE-2026-40622: "Ghost domain name" variant (bsc#1265581).
  • CVE-2026-41292: Parsing a long list of incoming EDNS options degrades performance (bsc#1265580).
  • CVE-2026-42534: Jostle logic bypass degrades resolution performance (bsc#1265585).
  • CVE-2026-42923: Degradation of service with unbounded NSEC3 hash calculations (bsc#1265589).
  • CVE-2026-42944: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (bsc#1265578).
  • CVE-2026-42959: Crash during DNSSEC validation of malicious content (bsc#1265586).
  • CVE-2026-42960: Possible cache poisoning attack while following delegation (bsc#1265588).
  • CVE-2026-44390: Unbounded name compression in certain cases causes degradation of service (bsc#1265584).
  • CVE-2026-44608: Use after free and crash in RPZ code (bsc#1265582).
Record
openSUSE-SU-2026:21083-1
Updated
2026-11-02
OSVSUSE-SU-2026:21874-1 No score

Security update for unbound

This update for unbound fixes the following issues

  • CVE-2026-32792: Packet of death with DNSCrypt (bsc#1265583).
  • CVE-2026-33278: Possible remote code execution during DNSSEC validation (bsc#1265587).
  • CVE-2026-40622: "Ghost domain name" variant (bsc#1265581).
  • CVE-2026-41292: Parsing a long list of incoming EDNS options degrades performance (bsc#1265580).
  • CVE-2026-42534: Jostle logic bypass degrades resolution performance (bsc#1265585).
  • CVE-2026-42923: Degradation of service with unbounded NSEC3 hash calculations (bsc#1265589).
  • CVE-2026-42944: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (bsc#1265578).
  • CVE-2026-42959: Crash during DNSSEC validation of malicious content (bsc#1265586).
  • CVE-2026-42960: Possible cache poisoning attack while following delegation (bsc#1265588).
  • CVE-2026-44390: Unbounded name compression in certain cases causes degradation of service (bsc#1265584).
  • CVE-2026-44608: Use after free and crash in RPZ code (bsc#1265582).
Record
SUSE-SU-2026:21874-1
Updated
2026-11-02
OSVSUSE-SU-2026:21913-1 No score

Security update for unbound

This update for unbound fixes the following issues

  • CVE-2026-32792: Packet of death with DNSCrypt (bsc#1265583).
  • CVE-2026-33278: Possible remote code execution during DNSSEC validation (bsc#1265587).
  • CVE-2026-40622: "Ghost domain name" variant (bsc#1265581).
  • CVE-2026-41292: Parsing a long list of incoming EDNS options degrades performance (bsc#1265580).
  • CVE-2026-42534: Jostle logic bypass degrades resolution performance (bsc#1265585).
  • CVE-2026-42923: Degradation of service with unbounded NSEC3 hash calculations (bsc#1265589).
  • CVE-2026-42944: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (bsc#1265578).
  • CVE-2026-42959: Crash during DNSSEC validation of malicious content (bsc#1265586).
  • CVE-2026-42960: Possible cache poisoning attack while following delegation (bsc#1265588).
  • CVE-2026-44390: Unbounded name compression in certain cases causes degradation of service (bsc#1265584).
  • CVE-2026-44608: Use after free and crash in RPZ code (bsc#1265582).
Record
SUSE-SU-2026:21913-1
Updated
2026-11-02
OSVSUSE-SU-2026:22160-1 No score

Security update for unbound

This update for unbound fixes the following issues

  • CVE-2026-32792: Packet of death with DNSCrypt (bsc#1265583).
  • CVE-2026-33278: Possible remote code execution during DNSSEC validation (bsc#1265587).
  • CVE-2026-40622: "Ghost domain name" variant (bsc#1265581).
  • CVE-2026-41292: Parsing a long list of incoming EDNS options degrades performance (bsc#1265580).
  • CVE-2026-42534: Jostle logic bypass degrades resolution performance (bsc#1265585).
  • CVE-2026-42923: Degradation of service with unbounded NSEC3 hash calculations (bsc#1265589).
  • CVE-2026-42944: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (bsc#1265578).
  • CVE-2026-42959: Crash during DNSSEC validation of malicious content (bsc#1265586).
  • CVE-2026-42960: Possible cache poisoning attack while following delegation (bsc#1265588).
  • CVE-2026-44390: Unbounded name compression in certain cases causes degradation of service (bsc#1265584).
  • CVE-2026-44608: Use after free and crash in RPZ code (bsc#1265582).
Record
SUSE-SU-2026:22160-1
Updated
2026-11-02
OSVSUSE-SU-2026:22213-1 No score

Security update for unbound

This update for unbound fixes the following issues

  • CVE-2026-32792: Packet of death with DNSCrypt (bsc#1265583).
  • CVE-2026-33278: Possible remote code execution during DNSSEC validation (bsc#1265587).
  • CVE-2026-40622: "Ghost domain name" variant (bsc#1265581).
  • CVE-2026-41292: Parsing a long list of incoming EDNS options degrades performance (bsc#1265580).
  • CVE-2026-42534: Jostle logic bypass degrades resolution performance (bsc#1265585).
  • CVE-2026-42923: Degradation of service with unbounded NSEC3 hash calculations (bsc#1265589).
  • CVE-2026-42944: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (bsc#1265578).
  • CVE-2026-42959: Crash during DNSSEC validation of malicious content (bsc#1265586).
  • CVE-2026-42960: Possible cache poisoning attack while following delegation (bsc#1265588).
  • CVE-2026-44390: Unbounded name compression in certain cases causes degradation of service (bsc#1265584).
  • CVE-2026-44608: Use after free and crash in RPZ code (bsc#1265582).
Record
SUSE-SU-2026:22213-1
Updated
2026-11-02
OSVSUSE-SU-2026:2281-1 No score

Security update for unbound

This update for unbound fixes the following issues

  • CVE-2026-32792: Packet of death with DNSCrypt (bsc#1265583).
  • CVE-2026-33278: Possible remote code execution during DNSSEC validation (bsc#1265587).
  • CVE-2026-40622: 'Ghost domain name' variant (bsc#1265581).
  • CVE-2026-41292: Parsing a long list of incoming EDNS options degrades performance (bsc#1265580).
  • CVE-2026-42534: Jostle logic bypass degrades resolution performance (bsc#1265585).
  • CVE-2026-42923: Degradation of service with unbounded NSEC3 hash calculations (bsc#1265589).
  • CVE-2026-42944: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (bsc#1265578).
  • CVE-2026-42959: Crash during DNSSEC validation of malicious content (bsc#1265586).
  • CVE-2026-42960: Possible cache poisoning attack while following delegation (bsc#1265588).
  • CVE-2026-44390: Unbounded name compression in certain cases causes degradation of service (bsc#1265584).
  • CVE-2026-44608: Use after free and crash in RPZ code (bsc#1265582).
Record
SUSE-SU-2026:2281-1
Updated
2026-11-02
OSVSUSE-SU-2026:2369-1 No score

Security update for unbound

This update for unbound fixes the following issues

  • CVE-2026-32792: Packet of death with DNSCrypt (bsc#1265583).
  • CVE-2026-33278: Possible remote code execution during DNSSEC validation (bsc#1265587).
  • CVE-2026-40622: 'Ghost domain name' variant (bsc#1265581).
  • CVE-2026-41292: Parsing a long list of incoming EDNS options degrades performance (bsc#1265580).
  • CVE-2026-42534: Jostle logic bypass degrades resolution performance (bsc#1265585).
  • CVE-2026-42923: Degradation of service with unbounded NSEC3 hash calculations (bsc#1265589).
  • CVE-2026-42944: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (bsc#1265578).
  • CVE-2026-42959: Crash during DNSSEC validation of malicious content (bsc#1265586).
  • CVE-2026-42960: Possible cache poisoning attack while following delegation (bsc#1265588).
  • CVE-2026-44390: Unbounded name compression in certain cases causes degradation of service (bsc#1265584).
  • CVE-2026-44608: Use after free and crash in RPZ code (bsc#1265582).
Record
SUSE-SU-2026:2369-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
unbound
Alpine:v3.22
 1.14.0 up to 1.25.2-r0
1.25.2-r0
unbound
Alpine:v3.23
 1.14.0 up to 1.25.2-r0
1.25.2-r0
unbound
Alpine:v3.24
 1.14.0 up to 1.25.1-r0
1.25.1-r0
unbound
Azure Linux:3
 before 1.25.1-1
1.25.1-1
python3-unbound
TuxCare:AlmaLinux:9.6
 before 1.16.2-19.el9_6.1.tuxcare.els5
1.16.2-19.el9_6.1.tuxcare.els5
unbound
TuxCare:AlmaLinux:9.6
 before 1.16.2-19.el9_6.1.tuxcare.els5
1.16.2-19.el9_6.1.tuxcare.els5
unbound-devel
TuxCare:AlmaLinux:9.6
 before 1.16.2-19.el9_6.1.tuxcare.els5
1.16.2-19.el9_6.1.tuxcare.els5
unbound-dracut
TuxCare:AlmaLinux:9.6
 before 1.16.2-19.el9_6.1.tuxcare.els5
1.16.2-19.el9_6.1.tuxcare.els5
unbound-libs
TuxCare:AlmaLinux:9.6
 before 1.16.2-19.el9_6.1.tuxcare.els5
1.16.2-19.el9_6.1.tuxcare.els5
unbound
Debian:12
 All versions, plus listed versions
1.17.1-21.17.1-2+deb12u11.17.1-2+deb12u21.17.1-2+deb12u31.17.1-2+deb12u4
Show 21 moreShow less
1.17.1-2+loong641.18.0-11.18.0-21.19.1-11.19.2-11.20.0-11.21.1-11.22.0-11.22.0-21.23.1-11.24.0-11.24.0-21.24.1-11.24.1-21.24.2-11.25.0-11.25.1-11.25.2-11.26.0-11.26.0-21.26.1-1
 None known
Show 30 moreShow less
Affected packages
PackageAffectedFixed
unbound
Debian:13
 before 1.22.0-2+deb13u3, plus listed versions
1.22.0-21.22.0-2+deb13u11.22.0-2+deb13u2
1.22.0-2+deb13u3
unbound
Debian:14
 before 1.25.1-1, plus listed versions
1.22.0-21.23.1-11.24.0-11.24.0-21.24.1-11.24.1-21.24.2-11.25.0-1
1.25.1-1
unbound
openEuler:24.03-LTS-SP1
 before 1.17.1-17.oe2403sp1
1.17.1-17.oe2403sp1
unbound
openEuler:24.03-LTS-SP3
 before 1.17.1-17.oe2403sp3
1.17.1-17.oe2403sp3
python3-unbound
Red Hat:hummingbird:1
 before 0:1.25.1-0.1.hum1
0:1.25.1-0.1.hum1
unbound
Red Hat:hummingbird:1
 before 0:1.25.1-0.1.hum1
0:1.25.1-0.1.hum1
unbound-anchor
Red Hat:hummingbird:1
 before 0:1.25.1-0.1.hum1
0:1.25.1-0.1.hum1
unbound-devel
Red Hat:hummingbird:1
 before 0:1.25.1-0.1.hum1
0:1.25.1-0.1.hum1
unbound-dracut
Red Hat:hummingbird:1
 before 0:1.25.1-0.1.hum1
0:1.25.1-0.1.hum1
unbound-libs
Red Hat:hummingbird:1
 before 0:1.25.1-0.1.hum1
0:1.25.1-0.1.hum1
unbound-munin
Red Hat:hummingbird:1
 before 0:1.25.1-0.1.hum1
0:1.25.1-0.1.hum1
unbound-utils
Red Hat:hummingbird:1
 before 0:1.25.1-0.1.hum1
0:1.25.1-0.1.hum1
unbound
SUSE:Linux Enterprise Server 16.0
 before 1.24.1-160000.2.1
1.24.1-160000.2.1
unbound
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 1.24.1-160000.2.1
1.24.1-160000.2.1
unbound
SUSE:Linux Micro 6.2
 before 1.24.1-160000.2.1
1.24.1-160000.2.1
unbound
SUSE:Linux Enterprise Micro 5.5
 before 1.20.0-150100.10.25.1
1.20.0-150100.10.25.1
unbound
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 1.20.0-150100.10.25.1
1.20.0-150100.10.25.1
unbound
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 1.20.0-150100.10.25.1
1.20.0-150100.10.25.1
unbound
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 1.20.0-150100.10.25.1
1.20.0-150100.10.25.1
unbound
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 1.20.0-150100.10.25.1
1.20.0-150100.10.25.1
unbound
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 1.20.0-150100.10.25.1
1.20.0-150100.10.25.1
unbound
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 1.20.0-150100.10.25.1
1.20.0-150100.10.25.1
unbound
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 1.20.0-150100.10.25.1
1.20.0-150100.10.25.1
unbound
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 1.20.0-150100.10.25.1
1.20.0-150100.10.25.1
unbound
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.4.22-1ubuntu61.5.7-1ubuntu11.5.7-1ubuntu21.5.8-1ubuntu11.5.8-1ubuntu1.1
Show 5 moreShow less
1.5.8-1ubuntu1.1+esm11.5.8-1ubuntu1.1+esm21.5.8-1ubuntu1.1+esm31.5.8-1ubuntu1.1+esm41.5.8-1ubuntu1.1+esm5
 None known
unbound
Ubuntu:24.04:LTS
 before 1.19.2-1ubuntu3.8, plus listed versions
1.17.1-21.18.0-2ubuntu11.18.0-2ubuntu21.19.1-1ubuntu11.19.2-1ubuntu1
Show 8 moreShow less
1.19.2-1ubuntu31.19.2-1ubuntu3.11.19.2-1ubuntu3.21.19.2-1ubuntu3.31.19.2-1ubuntu3.41.19.2-1ubuntu3.51.19.2-1ubuntu3.61.19.2-1ubuntu3.7
1.19.2-1ubuntu3.8
unbound
Ubuntu:25.10
 before 1.22.0-2ubuntu2.3, plus listed versions
1.22.0-1ubuntu11.22.0-2ubuntu11.22.0-2ubuntu21.22.0-2ubuntu2.11.22.0-2ubuntu2.2
1.22.0-2ubuntu2.3
unbound
Ubuntu:26.04:LTS
 before 1.24.2-1ubuntu2.1, plus listed versions
1.22.0-2ubuntu21.22.0-2ubuntu41.24.2-1ubuntu11.24.2-1ubuntu2
1.24.2-1ubuntu2.1
unbound
openSUSE:Tumbleweed
 before 1.25.1-1.1
1.25.1-1.1
unbound
openSUSE:Leap 16.0
 before 1.24.1-160000.2.1
1.24.1-160000.2.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-44608 is a medium vulnerability (CVSS 4.6) in Nlnet Labs Unbound, published May 20, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. Fixed in unbound 1.25.2-r0.

References

Show 57 moreShow less
This page doesn't list everything

Left out here: the rest of 2 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open