CVE-2026-85501

Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn't make custom builds or provide specific features to paying customers only.

Security Fix(es):

In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb (CVE-2024-33655). A malicious actor can exploit this by controlling an authoritative zone with short TTL, so cached entries expire quickly. Each 'slow' query, one the attacker's authoritative never answers, is followed by one query for an expired cached name, which is answered immediately via the 'serve-expired' path and decrements the counter twice. This second query was named 'pump'. By alternating slow queries and pumps, the attacker keeps the per-client counter at or below the configured 'wait-limit' indefinitely, and can hold an arbitrary number of pending queries from a single source IP, up to the global mesh quota (num-queries-per-thread); eventually bypassing one of the counter measures introduced for DNSBomb (CVE-2024-33655). This vulnerability is present on the 'serve-expired' code path.(CVE-2026-77860)

In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check failed, the tampered data are reloaded on startup and available until ZONEMD verification concludes again. If verification fails, the data is not served any more but still persists on disk for future reloads.(CVE-2026-77955)

NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. During failure code paths (i.e., RPZ drop query, jostle due to heavy traffic), a dropped DoH stream brings down the whole DoH session and does not account properly for other DoH streams in the same session. This leads to use-after-free in those code paths. If the prerequisites are satisfied (possible RPZ drop or heavy client traffic), a malicious actor can trigger the vulnerability with a single DoH connection and the appropriate traffic. Impact is limited as the reads are not user controlled and the use-after-free leads to early returns. However, a hardened allocator can catch the use-after-free and controllably terminate the process resulting to denial of service.(CVE-2026-82720)

Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested…

Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn't make custom builds or provide specific features to paying customers only.

Security Fix(es):

In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb (CVE-2024-33655). A malicious actor can exploit this by controlling an authoritative zone with short TTL, so cached entries expire quickly. Each 'slow' query, one the attacker's authoritative never answers, is followed by one query for an expired cached name, which is answered immediately via the 'serve-expired' path and decrements the counter twice. This second query was named 'pump'. By alternating slow queries and pumps, the attacker keeps the per-client counter at or below the configured 'wait-limit' indefinitely, and can hold an arbitrary number of pending queries from a single source IP, up to the global mesh quota (num-queries-per-thread); eventually bypassing one of the counter measures introduced for DNSBomb (CVE-2024-33655). This vulnerability is present on the 'serve-expired' code path.(CVE-2026-77860)

In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check failed, the tampered data are reloaded on startup and available until ZONEMD verification concludes again. If verification fails, the data is not served any more but still persists on disk for future reloads.(CVE-2026-77955)

NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. During failure code paths (i.e., RPZ drop query, jostle due to heavy traffic), a dropped DoH stream brings down the whole DoH session and does not account properly for other DoH streams in the same session. This leads to use-after-free in those code paths. If the prerequisites are satisfied (possible RPZ drop or heavy client traffic), a malicious actor can trigger the vulnerability with a single DoH connection and the appropriate traffic. Impact is limited as the reads are not user controlled and the use-after-free leads to early returns. However, a hardened allocator can catch the use-after-free and controllably terminate the process resulting to denial of service.(CVE-2026-82720)

Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested…

Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn't make custom builds or provide specific features to paying customers only.

Security Fix(es):

In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb (CVE-2024-33655). A malicious actor can exploit this by controlling an authoritative zone with short TTL, so cached entries expire quickly. Each 'slow' query, one the attacker's authoritative never answers, is followed by one query for an expired cached name, which is answered immediately via the 'serve-expired' path and decrements the counter twice. This second query was named 'pump'. By alternating slow queries and pumps, the attacker keeps the per-client counter at or below the configured 'wait-limit' indefinitely, and can hold an arbitrary number of pending queries from a single source IP, up to the global mesh quota (num-queries-per-thread); eventually bypassing one of the counter measures introduced for DNSBomb (CVE-2024-33655). This vulnerability is present on the 'serve-expired' code path.(CVE-2026-77860)

In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check failed, the tampered data are reloaded on startup and available until ZONEMD verification concludes again. If verification fails, the data is not served any more but still persists on disk for future reloads.(CVE-2026-77955)

NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. During failure code paths (i.e., RPZ drop query, jostle due to heavy traffic), a dropped DoH stream brings down the whole DoH session and does not account properly for other DoH streams in the same session. This leads to use-after-free in those code paths. If the prerequisites are satisfied (possible RPZ drop or heavy client traffic), a malicious actor can trigger the vulnerability with a single DoH connection and the appropriate traffic. Impact is limited as the reads are not user controlled and the use-after-free leads to early returns. However, a hardened allocator can catch the use-after-free and controllably terminate the process resulting to denial of service.(CVE-2026-82720)

Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested…

Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn't make custom builds or provide specific features to paying customers only.

Security Fix(es):

In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb (CVE-2024-33655). A malicious actor can exploit this by controlling an authoritative zone with short TTL, so cached entries expire quickly. Each 'slow' query, one the attacker's authoritative never answers, is followed by one query for an expired cached name, which is answered immediately via the 'serve-expired' path and decrements the counter twice. This second query was named 'pump'. By alternating slow queries and pumps, the attacker keeps the per-client counter at or below the configured 'wait-limit' indefinitely, and can hold an arbitrary number of pending queries from a single source IP, up to the global mesh quota (num-queries-per-thread); eventually bypassing one of the counter measures introduced for DNSBomb (CVE-2024-33655). This vulnerability is present on the 'serve-expired' code path.(CVE-2026-77860)

In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check failed, the tampered data are reloaded on startup and available until ZONEMD verification concludes again. If verification fails, the data is not served any more but still persists on disk for future reloads.(CVE-2026-77955)

NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. During failure code paths (i.e., RPZ drop query, jostle due to heavy traffic), a dropped DoH stream brings down the whole DoH session and does not account properly for other DoH streams in the same session. This leads to use-after-free in those code paths. If the prerequisites are satisfied (possible RPZ drop or heavy client traffic), a malicious actor can trigger the vulnerability with a single DoH connection and the appropriate traffic. Impact is limited as the reads are not user controlled and the use-after-free leads to early returns. However, a hardened allocator can catch the use-after-free and controllably terminate the process resulting to denial of service.(CVE-2026-82720)

Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested…

Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested domains, this results in significant computational overhead. NsecTrap, where responses with excessive invalid NSEC records compel the resolver to validate each one. AdditionalTrap, where Unbound by default would try to DNSSEC validate the ADDITIONAL section as well. This can be exploited to waste validation resources by malicious users.

Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested domains, this results in significant computational overhead. NsecTrap, where responses with excessive invalid NSEC records compel the resolver to validate each one. AdditionalTrap, where Unbound by default would try to DNSSEC validate the ADDITIONAL section as well. This can be exploited to waste validation resources by malicious users.

• CVE-2026-82720: pop each reply off the mesh reply list before it is dropped or answered, detach the tcp_req_info and DoH stream references and clear the h2 stream mesh states when a DoH session is dropped, so an RPZ drop or jostled query can no longer leave a dangling DoH stream reference that is used after free
• CVE-2026-77955: do not serve or write to disk a zonemd-check zone while its ZONEMD verification is still pending; the zonefile write is deferred to the ZONEMD callback and done only if the zone verified
• CVE-2026-85501: bound the DNSSEC work per validation (ReTrap): add the val-validation-attempts and val-hash-attempts limits (default 32), limit DNSKEY/RRSIG and DS key-tag matches and NSEC/NSEC3 records checked, shorten oversized referral DS RRsets, stop validator restarts once the limits are hit, and require only the answer and authority sections to be secure; the built-in val-clean-additional default is now no, the shipped unbound.conf keeps val-clean-additional: yes

• CVE-2026-81634: bounds-check the scratch buffer in rrset_canonical() and rrset_canonicalize_to_buffer() before writing the RRSIG rdata, the first canonical owner name and each RR's rdata, so a large rrset can no longer be written past the end of the buffer
• CVE-2026-80225: cap the number of pipelined TCP/DoT queries drained per event-loop visit in tcp_req_info_read_again() and tcp_more_read_again() and defer the remainder via a zero-delay timer, so one connection can no longer starve the other file descriptors
• CVE-2026-85501: bound the DNSSEC validation work per query (ReTrap): add the val-validation-attempts and val-hash-attempts limits (default 32), limit DNSKEY/RRSIG and DS key-tag matches and the NSEC/NSEC3 records checked per message, shorten oversized referral DS RRsets, stop validator restarts once the limits are hit, and require only the answer and authority sections to be secure; the built-in val-clean-additional default is now no, the shipped unbound.conf keeps val-clean-additional: yes

• CVE-2026-85501: bound the DNSSEC validation work per query (ReTrap): add the val-validation-attempts and val-hash-attempts limits (default 32), limit DNSKEY/RRSIG and DS key-tag matches and the NSEC/NSEC3 records checked per message, shorten oversized referral DS RRsets, stop validator restarts once the limits are hit, and require only the answer and authority sections to be secure; the built-in val-clean-additional default is now no, the shipped unbound.conf keeps val-clean-additional: yes

• CVE-2026-81642: fix heap buffer overflow when digesting DNSKEY
• CVE-2026-81634: add the missing first owner name and signature length bounds checks to rrset_canonical(), preventing a heap buffer overflow during RRset canonicalisation
• CVE-2026-82717: restore the packet buffer position on malformed names in pkt_dname_len() and bound the copy lengths in rdata_copy(), preventing heap corruption on the CNAME synthesis error path
• CVE-2026-85501: bound DNSSEC validation work per query: key-tag matches capped at 256, NSEC/NSEC3 verifications at 8 per message, new val-validation-attempts and val-hash-attempts options (default 32), oversized referral DS RRsets shortened to 20, and val-clean-additional now defaults to no

Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY Possible heap buffer overflow during DNSSEC canonicalization CNAME synthesis could lead to heap corruption Possible ZONEMD verification bypass window Use-after-free in DoQ stream output buffer on reset re-transmission Possible degradation of service from continuous queries on the same TCP/DoT connection Use-after-free in DoH stream cleanup code path Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC 'serve-expired' can bypass Unbound 'wait-limit' Remote DNS-over-QUIC denial of service due to 'quic-size' budget bypass Packet of death for DNSCrypt over TCP Cross-zone wildcard cache poisoning via RRSIG.labels manipulation 'dns-error-reporting: yes' leads to stack buffer overflow Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abruptly terminated 'max-global-quota' reset by DNSSEC validation restarts Possible heap use-after-free in an error path when a DoT forwarded query is jostled out 'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL BOGUS configured primary hostname accepted for XFR in auth/rpz zones Date: Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush Possible cache poisoning attack by mapping source port population per thread Memory corruption could lead to crash and denial of service 'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash Packet of death for a DNSCrypt misconfigured Unbound Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2 Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path DNS Cookie bypass when combined with proxy-protocol use Privacy/configuration issue when adding local data in views through 'unbound-control' Possible arbitrary code execution during DNSSEC validation Heap overflow with multiple NSID, COOKIE, PADDING EDNS options Crash during DNSSEC validation of malicious content Date: Packet of death with DNSCrypt Another "ghost domain names" attack variant Long list of incoming EDNS options degrades performance Jostle logic bypass degrades resolution performance Degradation of service with unbounded NSEC3 hash calculations Possible cache poisoning via promiscuous records for the authority section Unbounded name compression in certain cases causes degradation of service Use after free and crash under special conditions in RPZ code Possible domain hijacking via promiscuous records in the authority section Cache poisoning via the ECS-enabled Rebirthday Attack Unbounded name compression could lead to Denial of Service Unbound vulnerable to the "DNSBomb" pulsing DoS amplification attack Denial of service when trimming EDE text on positive replies DNSSEC verification complexity can be exploited to exhaust CPU resources and stall DNS resolvers NSEC3 closest encloser proof can exhaust CPU Non-Responsive Delegation Attack Novel "ghost domain names" attack by updating almost expired delegation information Novel "ghost domain names" attack by introducing subdomain delegations Local symlink attack Vulnerability in Domain Parse NXNSAttack Vulnerability in IPSEC module Vulnerability in parsing NOTIFY queries Vulnerability in the processing of wildcard synthesized NSEC…

These are all security issues fixed in the libunbound8-1.26.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for unbound fixes the following issues:

• CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' (bsc#1280403).
• CVE-2026-77955: Possible ZONEMD verification bypass window (bsc#1280404).
• CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission (bsc#1280405).
• CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection (bsc#1280406).
• CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization (bsc#1280409).
• CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (bsc#1280411).
• CVE-2026-82717: CNAME synthesis could lead to heap corruption (bsc#1280412).
• CVE-2026-82720: Use-after-free in DoH stream cleanup code path (bsc#1280413).
• CVE-2026-85501: Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC (bsc#1280414).

Changes for unbound:

• Update to 1.26.1:

• Update icannbundle.pem certificates in unbound-anchor, valid for 2009-2029 and 2025-2045
• Add max-transfer-size and max-transfer-time options to limit auth-zone and rpz transfer size and time, default disabled
• Overload local_data_remove in unbound-control to also remove specific records
• Add local-zone types block_aaaa, block_a_wdata and block_aaaa_wdata; fix respip+dns64 to use original A records instead of ones already modified by respip
• ipsecmod hook script now needs to start with '#!/bin/sh', it is executed with execv instead of system for security
• Server now continues to start if a secondary zone fails to load from its zonefile, or if a primary zonefile is missing; $INCLUDE is no longer allowed in secondary zone zonefiles
• Auth-zone and RPZ zones now drop out-of-zone content on load
• Primary hostname for zone transfers can now use CNAME(s)
• Fix windows 64bit build for libssp dependency
• Update IANA portlist
• Fix heap out-of-bounds write via size_t-to-int truncation in setup_if()/outside_network_create() for large num_ports values
• Fix to clean up log ids after a failure to start a worker thread
• Relax assertions after the TTL 0 handling change in cachedb and packet_rrset_copy_region
• Fix val_find_DS to check the result of packet_rrset_copy_region before using it
• Fix that dns64 answers check the AAAA query is DNSSEC validated, improving RFC6147 conformance
• Fix allocation-failure hardening of rrset cache wildcard storage and canonical NSEC owner replacement
• Fix DNSSEC validation and DNSKEY size calculation for noncanonical RSA DNSKEYs with leading zeroes
• Fix mixed class referrals to use the query class
• Fix serve-expired responses from cachedb to not store bogus data
• Fix lame server detection for selfpointed glue records
• Fix cleanup of DoH sessions when the same query is on multiple streams
• Fix for signed same-owner CNAME and ordinary RRset responses
• Fix mesh new client/callback to roll back added address, tcp mesh state and callback on initialization failure
• Fix autotrust state-file line overflow that could give a hold-down bypass
• Fix to limit the DSNS per-label walk in the iterator
• Fix that the ratelimit is decremented on successful referrals
• Fix msgencode insert_query assertion for a local_alias
• Fix to reset the tcp-timeout before applying a load based reduction
• Fix to correctly decrement per-netblock tcp connection limits
• Fix, in depth, for respip rewrite of dns64 responses
• Fix that dns64 with subnetcache does not write ECS scoped answers to the global cache
• Fix ipset module name-too-long checks and race conditions on the local name buffer and socket close
• Fix validator to cap the number of ANY RRsets it validates and shorten the wait timer
• Fix race condition causing segfault when starting threads
• Fix header_seen detection for trust anchor files to detect the id line
• Fix heap use-after-free in class response processing when at least two distinct classes are…

This update for unbound fixes the following issues:

• CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' (bsc#1280403).
• CVE-2026-77955: Possible ZONEMD verification bypass window (bsc#1280404).
• CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission (bsc#1280405).
• CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection (bsc#1280406).
• CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization (bsc#1280409).
• CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (bsc#1280411).
• CVE-2026-82717: CNAME synthesis could lead to heap corruption (bsc#1280412).
• CVE-2026-82720: Use-after-free in DoH stream cleanup code path (bsc#1280413).
• CVE-2026-85501: Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC (bsc#1280414).

Changes for unbound:

• Update to 1.26.1:

• Update icannbundle.pem certificates in unbound-anchor, valid for 2009-2029 and 2025-2045
• Add max-transfer-size and max-transfer-time options to limit auth-zone and rpz transfer size and time, default disabled
• Overload local_data_remove in unbound-control to also remove specific records
• Add local-zone types block_aaaa, block_a_wdata and block_aaaa_wdata; fix respip+dns64 to use original A records instead of ones already modified by respip
• ipsecmod hook script now needs to start with '#!/bin/sh', it is executed with execv instead of system for security
• Server now continues to start if a secondary zone fails to load from its zonefile, or if a primary zonefile is missing; $INCLUDE is no longer allowed in secondary zone zonefiles
• Auth-zone and RPZ zones now drop out-of-zone content on load
• Primary hostname for zone transfers can now use CNAME(s)
• Fix windows 64bit build for libssp dependency
• Update IANA portlist
• Fix heap out-of-bounds write via size_t-to-int truncation in setup_if()/outside_network_create() for large num_ports values
• Fix to clean up log ids after a failure to start a worker thread
• Relax assertions after the TTL 0 handling change in cachedb and packet_rrset_copy_region
• Fix val_find_DS to check the result of packet_rrset_copy_region before using it
• Fix that dns64 answers check the AAAA query is DNSSEC validated, improving RFC6147 conformance
• Fix allocation-failure hardening of rrset cache wildcard storage and canonical NSEC owner replacement
• Fix DNSSEC validation and DNSKEY size calculation for noncanonical RSA DNSKEYs with leading zeroes
• Fix mixed class referrals to use the query class
• Fix serve-expired responses from cachedb to not store bogus data
• Fix lame server detection for selfpointed glue records
• Fix cleanup of DoH sessions when the same query is on multiple streams
• Fix for signed same-owner CNAME and ordinary RRset responses
• Fix mesh new client/callback to roll back added address, tcp mesh state and callback on initialization failure
• Fix autotrust state-file line overflow that could give a hold-down bypass
• Fix to limit the DSNS per-label walk in the iterator
• Fix that the ratelimit is decremented on successful referrals
• Fix msgencode insert_query assertion for a local_alias
• Fix to reset the tcp-timeout before applying a load based reduction
• Fix to correctly decrement per-netblock tcp connection limits
• Fix, in depth, for respip rewrite of dns64 responses
• Fix that dns64 with subnetcache does not write ECS scoped answers to the global cache
• Fix ipset module name-too-long checks and race conditions on the local name buffer and socket close
• Fix validator to cap the number of ANY RRsets it validates and shorten the wait timer
• Fix race condition causing segfault when starting threads
• Fix header_seen detection for trust anchor files to detect the id line
• Fix heap use-after-free in class response processing when at least two distinct classes are…

This update for unbound fixes the following issues:

• CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' (bsc#1280403).
• CVE-2026-77955: Possible ZONEMD verification bypass window (bsc#1280404).
• CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission (bsc#1280405).
• CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection (bsc#1280406).
• CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization (bsc#1280409).
• CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (bsc#1280411).
• CVE-2026-82717: CNAME synthesis could lead to heap corruption (bsc#1280412).
• CVE-2026-82720: Use-after-free in DoH stream cleanup code path (bsc#1280413).
• CVE-2026-85501: Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC (bsc#1280414).

Changes for unbound:

• Update to 1.26.1:

• Update icannbundle.pem certificates in unbound-anchor, valid for 2009-2029 and 2025-2045
• Add max-transfer-size and max-transfer-time options to limit auth-zone and rpz transfer size and time, default disabled
• Overload local_data_remove in unbound-control to also remove specific records
• Add local-zone types block_aaaa, block_a_wdata and block_aaaa_wdata; fix respip+dns64 to use original A records instead of ones already modified by respip
• ipsecmod hook script now needs to start with '#!/bin/sh', it is executed with execv instead of system for security
• Server now continues to start if a secondary zone fails to load from its zonefile, or if a primary zonefile is missing; $INCLUDE is no longer allowed in secondary zone zonefiles
• Auth-zone and RPZ zones now drop out-of-zone content on load
• Primary hostname for zone transfers can now use CNAME(s)
• Fix windows 64bit build for libssp dependency
• Update IANA portlist
• Fix heap out-of-bounds write via size_t-to-int truncation in setup_if()/outside_network_create() for large num_ports values
• Fix to clean up log ids after a failure to start a worker thread
• Relax assertions after the TTL 0 handling change in cachedb and packet_rrset_copy_region
• Fix val_find_DS to check the result of packet_rrset_copy_region before using it
• Fix that dns64 answers check the AAAA query is DNSSEC validated, improving RFC6147 conformance
• Fix allocation-failure hardening of rrset cache wildcard storage and canonical NSEC owner replacement
• Fix DNSSEC validation and DNSKEY size calculation for noncanonical RSA DNSKEYs with leading zeroes
• Fix mixed class referrals to use the query class
• Fix serve-expired responses from cachedb to not store bogus data
• Fix lame server detection for selfpointed glue records
• Fix cleanup of DoH sessions when the same query is on multiple streams
• Fix for signed same-owner CNAME and ordinary RRset responses
• Fix mesh new client/callback to roll back added address, tcp mesh state and callback on initialization failure
• Fix autotrust state-file line overflow that could give a hold-down bypass
• Fix to limit the DSNS per-label walk in the iterator
• Fix that the ratelimit is decremented on successful referrals
• Fix msgencode insert_query assertion for a local_alias
• Fix to reset the tcp-timeout before applying a load based reduction
• Fix to correctly decrement per-netblock tcp connection limits
• Fix, in depth, for respip rewrite of dns64 responses
• Fix that dns64 with subnetcache does not write ECS scoped answers to the global cache
• Fix ipset module name-too-long checks and race conditions on the local name buffer and socket close
• Fix validator to cap the number of ANY RRsets it validates and shorten the wait timer
• Fix race condition causing segfault when starting threads
• Fix header_seen detection for trust anchor files to detect the id line
• Fix heap use-after-free in class response processing when at least two distinct classes are…

This update for unbound fixes the following issues:

• CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' (bsc#1280403).
• CVE-2026-77955: Possible ZONEMD verification bypass window (bsc#1280404).
• CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission (bsc#1280405).
• CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection (bsc#1280406).
• CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization (bsc#1280409).
• CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (bsc#1280411).
• CVE-2026-82717: CNAME synthesis could lead to heap corruption (bsc#1280412).
• CVE-2026-82720: Use-after-free in DoH stream cleanup code path (bsc#1280413).
• CVE-2026-85501: Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC (bsc#1280414).

Changes for unbound:

• Update to 1.26.1:

• Update icannbundle.pem certificates in unbound-anchor, valid for 2009-2029 and 2025-2045
• Add max-transfer-size and max-transfer-time options to limit auth-zone and rpz transfer size and time, default disabled
• Overload local_data_remove in unbound-control to also remove specific records
• Add local-zone types block_aaaa, block_a_wdata and block_aaaa_wdata; fix respip+dns64 to use original A records instead of ones already modified by respip
• ipsecmod hook script now needs to start with '#!/bin/sh', it is executed with execv instead of system for security
• Server now continues to start if a secondary zone fails to load from its zonefile, or if a primary zonefile is missing; $INCLUDE is no longer allowed in secondary zone zonefiles
• Auth-zone and RPZ zones now drop out-of-zone content on load
• Primary hostname for zone transfers can now use CNAME(s)
• Fix windows 64bit build for libssp dependency
• Update IANA portlist
• Fix heap out-of-bounds write via size_t-to-int truncation in setup_if()/outside_network_create() for large num_ports values
• Fix to clean up log ids after a failure to start a worker thread
• Relax assertions after the TTL 0 handling change in cachedb and packet_rrset_copy_region
• Fix val_find_DS to check the result of packet_rrset_copy_region before using it
• Fix that dns64 answers check the AAAA query is DNSSEC validated, improving RFC6147 conformance
• Fix allocation-failure hardening of rrset cache wildcard storage and canonical NSEC owner replacement
• Fix DNSSEC validation and DNSKEY size calculation for noncanonical RSA DNSKEYs with leading zeroes
• Fix mixed class referrals to use the query class
• Fix serve-expired responses from cachedb to not store bogus data
• Fix lame server detection for selfpointed glue records
• Fix cleanup of DoH sessions when the same query is on multiple streams
• Fix for signed same-owner CNAME and ordinary RRset responses
• Fix mesh new client/callback to roll back added address, tcp mesh state and callback on initialization failure
• Fix autotrust state-file line overflow that could give a hold-down bypass
• Fix to limit the DSNS per-label walk in the iterator
• Fix that the ratelimit is decremented on successful referrals
• Fix msgencode insert_query assertion for a local_alias
• Fix to reset the tcp-timeout before applying a load based reduction
• Fix to correctly decrement per-netblock tcp connection limits
• Fix, in depth, for respip rewrite of dns64 responses
• Fix that dns64 with subnetcache does not write ECS scoped answers to the global cache
• Fix ipset module name-too-long checks and race conditions on the local name buffer and socket close
• Fix validator to cap the number of ANY RRsets it validates and shorten the wait timer
• Fix race condition causing segfault when starting threads
• Fix header_seen detection for trust anchor files to detect the id line
• Fix heap use-after-free in class response processing when at least two distinct classes are…

This update for unbound fixes the following issues:

• CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' (bsc#1280403).
• CVE-2026-77955: Possible ZONEMD verification bypass window (bsc#1280404).
• CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission (bsc#1280405).
• CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection (bsc#1280406).
• CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization (bsc#1280409).
• CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (bsc#1280411).
• CVE-2026-82717: CNAME synthesis could lead to heap corruption (bsc#1280412).
• CVE-2026-82720: Use-after-free in DoH stream cleanup code path (bsc#1280413).
• CVE-2026-85501: Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC (bsc#1280414).

Changes for unbound:

• Update to 1.26.1:

• Update icannbundle.pem certificates in unbound-anchor, valid for 2009-2029 and 2025-2045
• Add max-transfer-size and max-transfer-time options to limit auth-zone and rpz transfer size and time, default disabled
• Overload local_data_remove in unbound-control to also remove specific records
• Add local-zone types block_aaaa, block_a_wdata and block_aaaa_wdata; fix respip+dns64 to use original A records instead of ones already modified by respip
• ipsecmod hook script now needs to start with '#!/bin/sh', it is executed with execv instead of system for security
• Server now continues to start if a secondary zone fails to load from its zonefile, or if a primary zonefile is missing; $INCLUDE is no longer allowed in secondary zone zonefiles
• Auth-zone and RPZ zones now drop out-of-zone content on load
• Primary hostname for zone transfers can now use CNAME(s)
• Fix windows 64bit build for libssp dependency
• Update IANA portlist
• Fix heap out-of-bounds write via size_t-to-int truncation in setup_if()/outside_network_create() for large num_ports values
• Fix to clean up log ids after a failure to start a worker thread
• Relax assertions after the TTL 0 handling change in cachedb and packet_rrset_copy_region
• Fix val_find_DS to check the result of packet_rrset_copy_region before using it
• Fix that dns64 answers check the AAAA query is DNSSEC validated, improving RFC6147 conformance
• Fix allocation-failure hardening of rrset cache wildcard storage and canonical NSEC owner replacement
• Fix DNSSEC validation and DNSKEY size calculation for noncanonical RSA DNSKEYs with leading zeroes
• Fix mixed class referrals to use the query class
• Fix serve-expired responses from cachedb to not store bogus data
• Fix lame server detection for selfpointed glue records
• Fix cleanup of DoH sessions when the same query is on multiple streams
• Fix for signed same-owner CNAME and ordinary RRset responses
• Fix mesh new client/callback to roll back added address, tcp mesh state and callback on initialization failure
• Fix autotrust state-file line overflow that could give a hold-down bypass
• Fix to limit the DSNS per-label walk in the iterator
• Fix that the ratelimit is decremented on successful referrals
• Fix msgencode insert_query assertion for a local_alias
• Fix to reset the tcp-timeout before applying a load based reduction
• Fix to correctly decrement per-netblock tcp connection limits
• Fix, in depth, for respip rewrite of dns64 responses
• Fix that dns64 with subnetcache does not write ECS scoped answers to the global cache
• Fix ipset module name-too-long checks and race conditions on the local name buffer and socket close
• Fix validator to cap the number of ANY RRsets it validates and shorten the wait timer
• Fix race condition causing segfault when starting threads
• Fix header_seen detection for trust anchor files to detect the id line
• Fix heap use-after-free in class response processing when at least two distinct classes are…

This update for unbound fixes the following issues:

• CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' (bsc#1280403).
• CVE-2026-77955: Possible ZONEMD verification bypass window (bsc#1280404).
• CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission (bsc#1280405).
• CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection (bsc#1280406).
• CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization (bsc#1280409).
• CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (bsc#1280411).
• CVE-2026-82717: CNAME synthesis could lead to heap corruption (bsc#1280412).
• CVE-2026-82720: Use-after-free in DoH stream cleanup code path (bsc#1280413).
• CVE-2026-85501: Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC (bsc#1280414).

Changes for libunbound-devel-mini:

• Updated to version 1.26.1

Changes for unbound:

• Updated to version 1.26.1

This update for unbound fixes the following issues:

• CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' (bsc#1280403).
• CVE-2026-77955: Possible ZONEMD verification bypass window (bsc#1280404).
• CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission (bsc#1280405).
• CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection (bsc#1280406).
• CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization (bsc#1280409).
• CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (bsc#1280411).
• CVE-2026-82717: CNAME synthesis could lead to heap corruption (bsc#1280412).
• CVE-2026-82720: Use-after-free in DoH stream cleanup code path (bsc#1280413).
• CVE-2026-85501: Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC (bsc#1280414).

Changes for libunbound-devel-mini:

• Updated to version 1.26.1

Changes for unbound:

• Updated to version 1.26.1

It was discovered that Unbound incorrectly handled certain TCP connections. A remote attacker could possibly use this issue to cause Unbound to consume resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-80225)

It was discovered that Unbound incorrectly handled certain DNS responses. A remote attacker could possibly use this issue to crash Unbound, resulting in a denial of service. (CVE-2026-81634)

It was discovered that Unbound incorrectly handled certain DNS responses during DNSSEC validation. A remote attacker could possibly use this issue to cause Unbound to consume resources, leading to a denial of service. (CVE-2026-85501)

It was discovered that Unbound incorrectly handled outgoing network ports. A remote attacker could possibly use this issue to crash Unbound, resulting in a denial of service. (CVE-2026-50252)

It was discovered that Unbound incorrectly handled certain DNSCrypt packets. A remote attacker could possibly use this issue to crash Unbound, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS and Ubuntu 18.04 LTS. (CVE-2026-40691)

It was discovered that Unbound incorrectly handled certain cached DNS responses. A remote attacker could possibly use this issue to poison Unbound's cache. This issue only affected Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-44690)

It was discovered that Unbound incorrectly handled certain DNS-over-QUIC connections. A remote attacker could possibly use this issue to cause Unbound to consume resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-32665)

It was discovered that Unbound incorrectly handled certain EDNS options. A remote attacker could possibly use this issue to crash Unbound, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-55973)

Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered that Unbound incorrectly handled validating DNSSEC messages. A remote attacker could possibly use this issue to cause Unbound to consume resources, leading to a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 16.04 LTS and Ubuntu 14.04 LTS. (CVE-2023-50387)

It was discovered that Unbound incorrectly handled preparing an NSEC3 closest encloser proof. A remote attacker could possibly use this issue to cause Unbound to consume resources, leading to a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 16.04 LTS and Ubuntu 14.04 LTS. (CVE-2023-50868)