CVE-2026-40622

NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.

Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn't make custom builds or provide specific features to paying customers only.

Security Fix(es):

NLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service vulnerability when compiled with DNSCrypt support ('--enable-dnscrypt'). A bad DNSCrypt query could underflow Unbound's DNSCrypt packet reading procedure that may lead to heap overflow. A malicious actor can exploit the vulnerability with a single bad DNSCrypt query that its decrypted plaintext consists entirely of '0x00' bytes and does not contain the expected '0x80' marker. Unbound would then start reading more bytes than necessary until it finds a non-'0x00' byte. Based on the underlying memory allocator and the memory layout, it could lead to heap overflow while reading followed by a crash. Likelihood of a crash is low, since it relies heavily on the underlying memory allocator and the memory layout. If the heap overflow does not happen, Unbound's later packet checks will deny the packet. Unbound 1.25.1 contains a patch with a fix to bound reading in the given buffer space.(CVE-2026-32792)

NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.(CVE-2026-40622)

NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could defeat its purpose and degrade resolution performance. Retransmits of the same query could renew the age of slow running queries and not allow the jostle logic to see them as aged and potential targets for replacement with new queries. An adversary who can query a vulnerable Unbound and who can control a domain name server that replies slowly and/or maliciously to Unbound's queries can exploit the vulnerability and degrade the resolution performance of Unbound. When Unbound's 'num-queries-per-thread' reaches its limit, the jostle logic kicks in. When a new query comes in, half of the available queries that are also slow to resolve are candidates for replacement. The vulnerability then happens because duplicate queries that need resolution would skew the aging result by using the timestamp of the latest duplicate query instead of the original one that started the resolution effort. Cache and local data response performance remains unaffected. Coordinated attacks could raise this to a denial of resolution service. Unbound 1.25.1 contains a patch with a fix to attach an initial, non-updatable start time for incoming queries that allow the jostle logic to work as intended.(CVE-2026-42534)

NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code…

Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn't make custom builds or provide specific features to paying customers only.

Security Fix(es):

NLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service vulnerability when compiled with DNSCrypt support ('--enable-dnscrypt'). A bad DNSCrypt query could underflow Unbound's DNSCrypt packet reading procedure that may lead to heap overflow. A malicious actor can exploit the vulnerability with a single bad DNSCrypt query that its decrypted plaintext consists entirely of '0x00' bytes and does not contain the expected '0x80' marker. Unbound would then start reading more bytes than necessary until it finds a non-'0x00' byte. Based on the underlying memory allocator and the memory layout, it could lead to heap overflow while reading followed by a crash. Likelihood of a crash is low, since it relies heavily on the underlying memory allocator and the memory layout. If the heap overflow does not happen, Unbound's later packet checks will deny the packet. Unbound 1.25.1 contains a patch with a fix to bound reading in the given buffer space.(CVE-2026-32792)

NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.(CVE-2026-40622)

NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could defeat its purpose and degrade resolution performance. Retransmits of the same query could renew the age of slow running queries and not allow the jostle logic to see them as aged and potential targets for replacement with new queries. An adversary who can query a vulnerable Unbound and who can control a domain name server that replies slowly and/or maliciously to Unbound's queries can exploit the vulnerability and degrade the resolution performance of Unbound. When Unbound's 'num-queries-per-thread' reaches its limit, the jostle logic kicks in. When a new query comes in, half of the available queries that are also slow to resolve are candidates for replacement. The vulnerability then happens because duplicate queries that need resolution would skew the aging result by using the timestamp of the latest duplicate query instead of the original one that started the resolution effort. Cache and local data response performance remains unaffected. Coordinated attacks could raise this to a denial of resolution service. Unbound 1.25.1 contains a patch with a fix to attach an initial, non-updatable start time for incoming queries that allow the jostle logic to work as intended.(CVE-2026-42534)

NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code…

Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn't make custom builds or provide specific features to paying customers only.

Security Fix(es):

NLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service vulnerability when compiled with DNSCrypt support ('--enable-dnscrypt'). A bad DNSCrypt query could underflow Unbound's DNSCrypt packet reading procedure that may lead to heap overflow. A malicious actor can exploit the vulnerability with a single bad DNSCrypt query that its decrypted plaintext consists entirely of '0x00' bytes and does not contain the expected '0x80' marker. Unbound would then start reading more bytes than necessary until it finds a non-'0x00' byte. Based on the underlying memory allocator and the memory layout, it could lead to heap overflow while reading followed by a crash. Likelihood of a crash is low, since it relies heavily on the underlying memory allocator and the memory layout. If the heap overflow does not happen, Unbound's later packet checks will deny the packet. Unbound 1.25.1 contains a patch with a fix to bound reading in the given buffer space.(CVE-2026-32792)

NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.(CVE-2026-40622)

NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could defeat its purpose and degrade resolution performance. Retransmits of the same query could renew the age of slow running queries and not allow the jostle logic to see them as aged and potential targets for replacement with new queries. An adversary who can query a vulnerable Unbound and who can control a domain name server that replies slowly and/or maliciously to Unbound's queries can exploit the vulnerability and degrade the resolution performance of Unbound. When Unbound's 'num-queries-per-thread' reaches its limit, the jostle logic kicks in. When a new query comes in, half of the available queries that are also slow to resolve are candidates for replacement. The vulnerability then happens because duplicate queries that need resolution would skew the aging result by using the timestamp of the latest duplicate query instead of the original one that started the resolution effort. Cache and local data response performance remains unaffected. Coordinated attacks could raise this to a denial of resolution service. Unbound 1.25.1 contains a patch with a fix to attach an initial, non-updatable start time for incoming queries that allow the jostle logic to work as intended.(CVE-2026-42534)

NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code…

Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn't make custom builds or provide specific features to paying customers only.

Security Fix(es):

NLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service vulnerability when compiled with DNSCrypt support ('--enable-dnscrypt'). A bad DNSCrypt query could underflow Unbound's DNSCrypt packet reading procedure that may lead to heap overflow. A malicious actor can exploit the vulnerability with a single bad DNSCrypt query that its decrypted plaintext consists entirely of '0x00' bytes and does not contain the expected '0x80' marker. Unbound would then start reading more bytes than necessary until it finds a non-'0x00' byte. Based on the underlying memory allocator and the memory layout, it could lead to heap overflow while reading followed by a crash. Likelihood of a crash is low, since it relies heavily on the underlying memory allocator and the memory layout. If the heap overflow does not happen, Unbound's later packet checks will deny the packet. Unbound 1.25.1 contains a patch with a fix to bound reading in the given buffer space.(CVE-2026-32792)

NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.(CVE-2026-40622)

NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could defeat its purpose and degrade resolution performance. Retransmits of the same query could renew the age of slow running queries and not allow the jostle logic to see them as aged and potential targets for replacement with new queries. An adversary who can query a vulnerable Unbound and who can control a domain name server that replies slowly and/or maliciously to Unbound's queries can exploit the vulnerability and degrade the resolution performance of Unbound. When Unbound's 'num-queries-per-thread' reaches its limit, the jostle logic kicks in. When a new query comes in, half of the available queries that are also slow to resolve are candidates for replacement. The vulnerability then happens because duplicate queries that need resolution would skew the aging result by using the timestamp of the latest duplicate query instead of the original one that started the resolution effort. Cache and local data response performance remains unaffected. Coordinated attacks could raise this to a denial of resolution service. Unbound 1.25.1 contains a patch with a fix to attach an initial, non-updatable start time for incoming queries that allow the jostle logic to work as intended.(CVE-2026-42534)

NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code…

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

• unbound: Unbound: Denial of Service via excessive EDNS options (CVE-2026-41292)

• unbound: Unbound: Cache manipulation via 'ghost domain names' attack (CVE-2026-40622)

• unbound: Unbound: Denial of Service due to excessive resource consumption with large DNS Resource Record Sets (CVE-2026-44390)

• unbound: Unbound: Denial of Service due to degraded resolution performance in jostle logic (CVE-2026-42534)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

• unbound: Unbound: Denial of Service via excessive EDNS options (CVE-2026-41292)

• unbound: Unbound: Cache manipulation via 'ghost domain names' attack (CVE-2026-40622)

• unbound: Unbound: Denial of Service due to excessive resource consumption with large DNS Resource Record Sets (CVE-2026-44390)

• unbound: Unbound: Denial of Service due to degraded resolution performance in jostle logic (CVE-2026-42534)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

• unbound: Unbound: Denial of Service via excessive EDNS options (CVE-2026-41292)

• unbound: Unbound: Cache manipulation via 'ghost domain names' attack (CVE-2026-40622)

• unbound: Unbound: Denial of Service due to excessive resource consumption with large DNS Resource Record Sets (CVE-2026-44390)

• unbound: Unbound: Denial of Service due to degraded resolution performance in jostle logic (CVE-2026-42534)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2026-40622 in the unbound package for Root:Debian:11. Multiple fixed versions available.

NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

• unbound: Unbound: Denial of Service via excessive EDNS options (CVE-2026-41292)
• unbound: Unbound: Cache manipulation via 'ghost domain names' attack (CVE-2026-40622)
• unbound: Unbound: Denial of Service due to excessive resource consumption with large DNS Resource Record Sets (CVE-2026-44390)
• unbound: Unbound: Denial of Service due to degraded resolution performance in jostle logic (CVE-2026-42534)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

• unbound: Unbound: Denial of Service via excessive EDNS options (CVE-2026-41292)
• unbound: Unbound: Cache manipulation via 'ghost domain names' attack (CVE-2026-40622)
• unbound: Unbound: Denial of Service due to excessive resource consumption with large DNS Resource Record Sets (CVE-2026-44390)
• unbound: Unbound: Denial of Service due to degraded resolution performance in jostle logic (CVE-2026-42534)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

• unbound: Unbound: Denial of Service via excessive EDNS options (CVE-2026-41292)
• unbound: Unbound: Cache manipulation via 'ghost domain names' attack (CVE-2026-40622)
• unbound: Unbound: Denial of Service due to excessive resource consumption with large DNS Resource Record Sets (CVE-2026-44390)
• unbound: Unbound: Denial of Service due to degraded resolution performance in jostle logic (CVE-2026-42534)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.

• CVE-2026-40622: clamp NS RRset TTL to the cached value in the higher-trust branch of need_to_update_rrset() to prevent the "ghost domain" variant where an attacker-controlled higher-trust NS response revives a revoked delegation.

• CVE-2026-42960: prevent cache poisoning via promiscuous additional-section records by marking glue only for NS RRsets in the authority section [ELSCVE-130594]
• CVE-2026-42944: fix heap overflow and crash with multiple NSID and PADDING EDNS options by deduplicating options and adding bounds checks in attach_edns_record_max_msg_sz [ELSCVE-130649]
• CVE-2026-41292: cap parsed EDNS options at MAX_PARSED_EDNS_OPTIONS (100) to prevent DoS via long option lists [ELSCVE-130636]
• CVE-2026-42959: fix out-of-bounds write in val_fill_reply by indexing the destination array with chase->ns_numrrsets instead of orig->ns_numrrsets [ELSCVE-130615]
• CVE-2026-40622: prevent ghost-domain TTL extension by clamping newd->ttl to cached->ttl in the higher-trust branch of need_to_update_rrset [ELSCVE-129354]

• CVE-2026-40622: clamp NS RRset TTL to the cached value in the higher-trust branch of need_to_update_rrset() to prevent the "ghost domain" variant where an attacker-controlled higher-trust NS response revives a revoked delegation.

• CVE-2025-5994: do not cache non-ECS answers to ECS queries in the subnet cache (Rebirthday attack)
• CVE-2026-40622: limit the TTL of a higher-trust NS rrset replacing a cached delegation (ghost domain)
• CVE-2026-50106: treat an unsigned parent denial of an island trust anchor as bogus
• CVE-2026-96405: add a per-packet budget for name decompression pointers
• CVE-2026-109125: clear pending queries on a port when the unwanted-reply threshold is hit
• CVE-2026-35501: fix NSEC-not-at-apex parent-side key lookup for island trust anchors

• CVE-2025-5994: do not cache non-ECS answers to ECS queries in the subnet cache (Rebirthday attack)
• CVE-2026-40622: limit the TTL of a higher-trust NS rrset replacing a cached delegation (ghost domain)
• CVE-2026-50106: treat an unsigned parent denial of an island trust anchor as bogus
• CVE-2026-96405: add a per-packet budget for name decompression pointers
• CVE-2026-109125: clear pending queries on a port when the unwanted-reply threshold is hit
• CVE-2026-35501: fix NSEC-not-at-apex parent-side key lookup for island trust anchors

Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY Possible heap buffer overflow during DNSSEC canonicalization CNAME synthesis could lead to heap corruption Possible ZONEMD verification bypass window Use-after-free in DoQ stream output buffer on reset re-transmission Possible degradation of service from continuous queries on the same TCP/DoT connection Use-after-free in DoH stream cleanup code path Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC 'serve-expired' can bypass Unbound 'wait-limit' Remote DNS-over-QUIC denial of service due to 'quic-size' budget bypass Packet of death for DNSCrypt over TCP Cross-zone wildcard cache poisoning via RRSIG.labels manipulation 'dns-error-reporting: yes' leads to stack buffer overflow Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abruptly terminated 'max-global-quota' reset by DNSSEC validation restarts Possible heap use-after-free in an error path when a DoT forwarded query is jostled out 'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL BOGUS configured primary hostname accepted for XFR in auth/rpz zones Date: Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush Possible cache poisoning attack by mapping source port population per thread Memory corruption could lead to crash and denial of service 'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash Packet of death for a DNSCrypt misconfigured Unbound Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2 Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path DNS Cookie bypass when combined with proxy-protocol use Privacy/configuration issue when adding local data in views through 'unbound-control' Possible arbitrary code execution during DNSSEC validation Heap overflow with multiple NSID, COOKIE, PADDING EDNS options Crash during DNSSEC validation of malicious content Date: Packet of death with DNSCrypt Another "ghost domain names" attack variant Long list of incoming EDNS options degrades performance Jostle logic bypass degrades resolution performance Degradation of service with unbounded NSEC3 hash calculations Possible cache poisoning via promiscuous records for the authority section Unbounded name compression in certain cases causes degradation of service Use after free and crash under special conditions in RPZ code Possible domain hijacking via promiscuous records in the authority section Cache poisoning via the ECS-enabled Rebirthday Attack Unbounded name compression could lead to Denial of Service Unbound vulnerable to the "DNSBomb" pulsing DoS amplification attack Denial of service when trimming EDE text on positive replies DNSSEC verification complexity can be exploited to exhaust CPU resources and stall DNS resolvers NSEC3 closest encloser proof can exhaust CPU Non-Responsive Delegation Attack Novel "ghost domain names" attack by updating almost expired delegation information Novel "ghost domain names" attack by introducing subdomain delegations Local symlink attack Vulnerability in Domain Parse NXNSAttack Vulnerability in IPSEC module Vulnerability in parsing NOTIFY queries Vulnerability in the processing of wildcard synthesized NSEC…

These are all security issues fixed in the libunbound8-1.25.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for unbound fixes the following issues

• CVE-2026-32792: Packet of death with DNSCrypt (bsc#1265583).
• CVE-2026-33278: Possible remote code execution during DNSSEC validation (bsc#1265587).
• CVE-2026-40622: "Ghost domain name" variant (bsc#1265581).
• CVE-2026-41292: Parsing a long list of incoming EDNS options degrades performance (bsc#1265580).
• CVE-2026-42534: Jostle logic bypass degrades resolution performance (bsc#1265585).
• CVE-2026-42923: Degradation of service with unbounded NSEC3 hash calculations (bsc#1265589).
• CVE-2026-42944: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (bsc#1265578).
• CVE-2026-42959: Crash during DNSSEC validation of malicious content (bsc#1265586).
• CVE-2026-42960: Possible cache poisoning attack while following delegation (bsc#1265588).
• CVE-2026-44390: Unbounded name compression in certain cases causes degradation of service (bsc#1265584).
• CVE-2026-44608: Use after free and crash in RPZ code (bsc#1265582).

This update for unbound fixes the following issues:

Update to version 1.25.2.

Security issues fixed:

• CVE-2026-14586: DoS via assertion in libngtcp2 for DNS-over-QUIC environments with high concurrency (bsc#1271879).
• CVE-2026-32665: Remote DNS-over-QUIC denial of service due to quic-size budget bypass (bsc#1271873).
• CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).
• CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries (bsc#1271891).
• CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records (bsc#1271892).
• CVE-2026-44621: Libunbound applications configured with unwanted-reply-threshold could eventually be abruptly terminated (bsc#1271876).
• CVE-2026-44687: Off-by-one error in harden-below-nxdomain logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN (bsc#1271893).
• CVE-2026-44690: Cross-zone wildcard cache poisoning via RRSIG.labels manipulation (bsc#1271877).
• CVE-2026-46582: Replay of a wildcard rrset as another piece of data triggers poisoning in the server expired reply path (bsc#1271894).
• CVE-2026-50045: max-global-quota bypass via single client queries for a deeply nested name under a DNSSEC-signed parent (bsc#1271878).
• CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).
• CVE-2026-50243: response-ip/rpz can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).
• CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).
• CVE-2026-50251: Attacker supplied 0.0.0.0/:: glue triggers defensive full-cache flush (bsc#1271883).
• CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).
• CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with answer-cookie:yes is used (bsc#1271895).
• CVE-2026-55708: Privacy/configuration issue when adding local data in views through unbound-control (bsc#1271896).
• CVE-2026-55717: serve-expired-client-timeout and response-ip CNAME redirect could lead to a crash (bsc#1271886).
• CVE-2026-55973: DoS due to stack overflow triggered crash when dns-error-reporting: yes is set (bsc#1271874).
• CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).
• CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in libngtcp2 (bsc#1271888).
• CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name (bsc#1271889).
• CVE-2026-56444: Degradation of resolution service when discard-timeout and serve-expired-client-timeout are combined in unusual configuration (bsc#1271890).

Other updates and bugfixes:

• Version 1.25.2:
  • Features:
    • TTL behavior changes: cached records reaching TTL 0 are expired; TTL 0 upstream answers are no longer cached by cachedb; serve-expired-reply-ttl is now capped by the original TTL value; TTL decoding updated to adhere to RFC 8767 section 4
    • Add new statistics: num.queries.replyaddr_limit and requestlist.current.replies
    • Add 'log-thread-id' configuration option to log the system-wide Linux thread ID for easier debugging
    • Add ECC-GOST12 support per RFC 9558 (available as contrib/gost12.patch)
    • Allow synthesized DNAME TTL=0 to be served from cache within a 1-second grace period, reducing recursion for TTL=0 DNAMEs (RFC 2308)
    • Fix DoT/DoH/DoQ to reload certificates on config reload without requiring a full restart; fast_reload now supports changes to tls-service-key, tls-service-pem and tls-cert-bundle
    • Allow ip@port notation in control-interface configuration
    • Add iter-scrub-rrsig option (default: 8) to limit the number of …

This update for unbound fixes the following issues

• CVE-2026-32792: Packet of death with DNSCrypt (bsc#1265583).
• CVE-2026-33278: Possible remote code execution during DNSSEC validation (bsc#1265587).
• CVE-2026-40622: "Ghost domain name" variant (bsc#1265581).
• CVE-2026-41292: Parsing a long list of incoming EDNS options degrades performance (bsc#1265580).
• CVE-2026-42534: Jostle logic bypass degrades resolution performance (bsc#1265585).
• CVE-2026-42923: Degradation of service with unbounded NSEC3 hash calculations (bsc#1265589).
• CVE-2026-42944: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (bsc#1265578).
• CVE-2026-42959: Crash during DNSSEC validation of malicious content (bsc#1265586).
• CVE-2026-42960: Possible cache poisoning attack while following delegation (bsc#1265588).
• CVE-2026-44390: Unbounded name compression in certain cases causes degradation of service (bsc#1265584).
• CVE-2026-44608: Use after free and crash in RPZ code (bsc#1265582).

This update for unbound fixes the following issues

• CVE-2026-32792: Packet of death with DNSCrypt (bsc#1265583).
• CVE-2026-33278: Possible remote code execution during DNSSEC validation (bsc#1265587).
• CVE-2026-40622: "Ghost domain name" variant (bsc#1265581).
• CVE-2026-41292: Parsing a long list of incoming EDNS options degrades performance (bsc#1265580).
• CVE-2026-42534: Jostle logic bypass degrades resolution performance (bsc#1265585).
• CVE-2026-42923: Degradation of service with unbounded NSEC3 hash calculations (bsc#1265589).
• CVE-2026-42944: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (bsc#1265578).
• CVE-2026-42959: Crash during DNSSEC validation of malicious content (bsc#1265586).
• CVE-2026-42960: Possible cache poisoning attack while following delegation (bsc#1265588).
• CVE-2026-44390: Unbounded name compression in certain cases causes degradation of service (bsc#1265584).
• CVE-2026-44608: Use after free and crash in RPZ code (bsc#1265582).

This update for unbound fixes the following issues

• CVE-2026-32792: Packet of death with DNSCrypt (bsc#1265583).
• CVE-2026-33278: Possible remote code execution during DNSSEC validation (bsc#1265587).
• CVE-2026-40622: "Ghost domain name" variant (bsc#1265581).
• CVE-2026-41292: Parsing a long list of incoming EDNS options degrades performance (bsc#1265580).
• CVE-2026-42534: Jostle logic bypass degrades resolution performance (bsc#1265585).
• CVE-2026-42923: Degradation of service with unbounded NSEC3 hash calculations (bsc#1265589).
• CVE-2026-42944: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (bsc#1265578).
• CVE-2026-42959: Crash during DNSSEC validation of malicious content (bsc#1265586).
• CVE-2026-42960: Possible cache poisoning attack while following delegation (bsc#1265588).
• CVE-2026-44390: Unbounded name compression in certain cases causes degradation of service (bsc#1265584).
• CVE-2026-44608: Use after free and crash in RPZ code (bsc#1265582).

This update for unbound fixes the following issues

• CVE-2026-32792: Packet of death with DNSCrypt (bsc#1265583).
• CVE-2026-33278: Possible remote code execution during DNSSEC validation (bsc#1265587).
• CVE-2026-40622: "Ghost domain name" variant (bsc#1265581).
• CVE-2026-41292: Parsing a long list of incoming EDNS options degrades performance (bsc#1265580).
• CVE-2026-42534: Jostle logic bypass degrades resolution performance (bsc#1265585).
• CVE-2026-42923: Degradation of service with unbounded NSEC3 hash calculations (bsc#1265589).
• CVE-2026-42944: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (bsc#1265578).
• CVE-2026-42959: Crash during DNSSEC validation of malicious content (bsc#1265586).
• CVE-2026-42960: Possible cache poisoning attack while following delegation (bsc#1265588).
• CVE-2026-44390: Unbounded name compression in certain cases causes degradation of service (bsc#1265584).
• CVE-2026-44608: Use after free and crash in RPZ code (bsc#1265582).

This update for unbound fixes the following issues

• CVE-2026-32792: Packet of death with DNSCrypt (bsc#1265583).
• CVE-2026-33278: Possible remote code execution during DNSSEC validation (bsc#1265587).
• CVE-2026-40622: 'Ghost domain name' variant (bsc#1265581).
• CVE-2026-41292: Parsing a long list of incoming EDNS options degrades performance (bsc#1265580).
• CVE-2026-42534: Jostle logic bypass degrades resolution performance (bsc#1265585).
• CVE-2026-42923: Degradation of service with unbounded NSEC3 hash calculations (bsc#1265589).
• CVE-2026-42944: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (bsc#1265578).
• CVE-2026-42959: Crash during DNSSEC validation of malicious content (bsc#1265586).
• CVE-2026-42960: Possible cache poisoning attack while following delegation (bsc#1265588).
• CVE-2026-44390: Unbounded name compression in certain cases causes degradation of service (bsc#1265584).
• CVE-2026-44608: Use after free and crash in RPZ code (bsc#1265582).

This update for unbound fixes the following issues:

Update to version 1.25.2.

Security issues fixed:

• CVE-2026-14586: DoS via assertion in libngtcp2 for DNS-over-QUIC environments with high concurrency (bsc#1271879).
• CVE-2026-32665: Remote DNS-over-QUIC denial of service due to quic-size budget bypass (bsc#1271873).
• CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).
• CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries (bsc#1271891).
• CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records (bsc#1271892).
• CVE-2026-44621: Libunbound applications configured with unwanted-reply-threshold could eventually be abruptly terminated (bsc#1271876).
• CVE-2026-44687: Off-by-one error in harden-below-nxdomain logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN (bsc#1271893).
• CVE-2026-44690: Cross-zone wildcard cache poisoning via RRSIG.labels manipulation (bsc#1271877).
• CVE-2026-46582: Replay of a wildcard rrset as another piece of data triggers poisoning in the server expired reply path (bsc#1271894).
• CVE-2026-50045: max-global-quota bypass via single client queries for a deeply nested name under a DNSSEC-signed parent (bsc#1271878).
• CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).
• CVE-2026-50243: response-ip/rpz can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).
• CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).
• CVE-2026-50251: Attacker supplied 0.0.0.0/:: glue triggers defensive full-cache flush (bsc#1271883).
• CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).
• CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with answer-cookie:yes is used (bsc#1271895).
• CVE-2026-55708: Privacy/configuration issue when adding local data in views through unbound-control (bsc#1271896).
• CVE-2026-55717: serve-expired-client-timeout and response-ip CNAME redirect could lead to a crash (bsc#1271886).
• CVE-2026-55973: DoS due to stack overflow triggered crash when dns-error-reporting: yes is set (bsc#1271874).
• CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).
• CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in libngtcp2 (bsc#1271888).
• CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name (bsc#1271889).
• CVE-2026-56444: Degradation of resolution service when discard-timeout and serve-expired-client-timeout are combined in unusual configuration (bsc#1271890).

Other updates and bugfixes:

• Version 1.25.2:
  • Features:
    • TTL behavior changes: cached records reaching TTL 0 are expired; TTL 0 upstream answers are no longer cached by cachedb; serve-expired-reply-ttl is now capped by the original TTL value; TTL decoding updated to adhere to RFC 8767 section 4
    • Add new statistics: num.queries.replyaddr_limit and requestlist.current.replies
    • Add 'log-thread-id' configuration option to log the system-wide Linux thread ID for easier debugging
    • Add ECC-GOST12 support per RFC 9558 (available as contrib/gost12.patch)
    • Allow synthesized DNAME TTL=0 to be served from cache within a 1-second grace period, reducing recursion for TTL=0 DNAMEs (RFC 2308)
    • Fix DoT/DoH/DoQ to reload certificates on config reload without requiring a full restart; fast_reload now supports changes to tls-service-key, tls-service-pem and tls-cert-bundle
    • Allow ip@port notation in control-interface configuration
    • Add iter-scrub-rrsig option (default: 8) to limit the number of …

This update for unbound fixes the following issues:

Update to version 1.25.2.

Security issues fixed:

• CVE-2026-14586: DoS via assertion in libngtcp2 for DNS-over-QUIC environments with high concurrency (bsc#1271879).
• CVE-2026-32665: Remote DNS-over-QUIC denial of service due to quic-size budget bypass (bsc#1271873).
• CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).
• CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries (bsc#1271891).
• CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records (bsc#1271892).
• CVE-2026-44621: Libunbound applications configured with unwanted-reply-threshold could eventually be abruptly terminated (bsc#1271876).
• CVE-2026-44687: Off-by-one error in harden-below-nxdomain logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN (bsc#1271893).
• CVE-2026-44690: Cross-zone wildcard cache poisoning via RRSIG.labels manipulation (bsc#1271877).
• CVE-2026-46582: Replay of a wildcard rrset as another piece of data triggers poisoning in the server expired reply path (bsc#1271894).
• CVE-2026-50045: max-global-quota bypass via single client queries for a deeply nested name under a DNSSEC-signed parent (bsc#1271878).
• CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).
• CVE-2026-50243: response-ip/rpz can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).
• CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).
• CVE-2026-50251: Attacker supplied 0.0.0.0/:: glue triggers defensive full-cache flush (bsc#1271883).
• CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).
• CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with answer-cookie:yes is used (bsc#1271895).
• CVE-2026-55708: Privacy/configuration issue when adding local data in views through unbound-control (bsc#1271896).
• CVE-2026-55717: serve-expired-client-timeout and response-ip CNAME redirect could lead to a crash (bsc#1271886).
• CVE-2026-55973: DoS due to stack overflow triggered crash when dns-error-reporting: yes is set (bsc#1271874).
• CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).
• CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in libngtcp2 (bsc#1271888).
• CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name (bsc#1271889).
• CVE-2026-56444: Degradation of resolution service when discard-timeout and serve-expired-client-timeout are combined in unusual configuration (bsc#1271890).

Other updates and bugfixes:

• Version 1.25.2:
  • Features:
    • TTL behavior changes: cached records reaching TTL 0 are expired; TTL 0 upstream answers are no longer cached by cachedb; serve-expired-reply-ttl is now capped by the original TTL value; TTL decoding updated to adhere to RFC 8767 section 4
    • Add new statistics: num.queries.replyaddr_limit and requestlist.current.replies
    • Add 'log-thread-id' configuration option to log the system-wide Linux thread ID for easier debugging
    • Add ECC-GOST12 support per RFC 9558 (available as contrib/gost12.patch)
    • Allow synthesized DNAME TTL=0 to be served from cache within a 1-second grace period, reducing recursion for TTL=0 DNAMEs (RFC 2308)
    • Fix DoT/DoH/DoQ to reload certificates on config reload without requiring a full restart; fast_reload now supports changes to tls-service-key, tls-service-pem and tls-cert-bundle
    • Allow ip@port notation in control-interface configuration
    • Add iter-scrub-rrsig option (default: 8) to limit the number of …

This update for unbound fixes the following issues:

Update to version 1.25.2.

Security issues fixed:

• CVE-2026-14586: DoS via assertion in libngtcp2 for DNS-over-QUIC environments with high concurrency (bsc#1271879).
• CVE-2026-32665: Remote DNS-over-QUIC denial of service due to quic-size budget bypass (bsc#1271873).
• CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).
• CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries (bsc#1271891).
• CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records (bsc#1271892).
• CVE-2026-44621: Libunbound applications configured with unwanted-reply-threshold could eventually be abruptly terminated (bsc#1271876).
• CVE-2026-44687: Off-by-one error in harden-below-nxdomain logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN (bsc#1271893).
• CVE-2026-44690: Cross-zone wildcard cache poisoning via RRSIG.labels manipulation (bsc#1271877).
• CVE-2026-46582: Replay of a wildcard rrset as another piece of data triggers poisoning in the server expired reply path (bsc#1271894).
• CVE-2026-50045: max-global-quota bypass via single client queries for a deeply nested name under a DNSSEC-signed parent (bsc#1271878).
• CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).
• CVE-2026-50243: response-ip/rpz can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).
• CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).
• CVE-2026-50251: Attacker supplied 0.0.0.0/:: glue triggers defensive full-cache flush (bsc#1271883).
• CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).
• CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with answer-cookie:yes is used (bsc#1271895).
• CVE-2026-55708: Privacy/configuration issue when adding local data in views through unbound-control (bsc#1271896).
• CVE-2026-55717: serve-expired-client-timeout and response-ip CNAME redirect could lead to a crash (bsc#1271886).
• CVE-2026-55973: DoS due to stack overflow triggered crash when dns-error-reporting: yes is set (bsc#1271874).
• CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).
• CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in libngtcp2 (bsc#1271888).
• CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name (bsc#1271889).
• CVE-2026-56444: Degradation of resolution service when discard-timeout and serve-expired-client-timeout are combined in unusual configuration (bsc#1271890).

Other updates and bugfixes:

• Version 1.25.2:
  • Features:
    • TTL behavior changes: cached records reaching TTL 0 are expired; TTL 0 upstream answers are no longer cached by cachedb; serve-expired-reply-ttl is now capped by the original TTL value; TTL decoding updated to adhere to RFC 8767 section 4
    • Add new statistics: num.queries.replyaddr_limit and requestlist.current.replies
    • Add 'log-thread-id' configuration option to log the system-wide Linux thread ID for easier debugging
    • Add ECC-GOST12 support per RFC 9558 (available as contrib/gost12.patch)
    • Allow synthesized DNAME TTL=0 to be served from cache within a 1-second grace period, reducing recursion for TTL=0 DNAMEs (RFC 2308)
    • Fix DoT/DoH/DoQ to reload certificates on config reload without requiring a full restart; fast_reload now supports changes to tls-service-key, tls-service-pem and tls-cert-bundle
    • Allow ip@port notation in control-interface configuration
    • Add iter-scrub-rrsig option (default: 8) to limit the number of …

This update for unbound fixes the following issues:

Update to version 1.25.2.

Security issues fixed:

• CVE-2026-14586: DoS via assertion in libngtcp2 for DNS-over-QUIC environments with high concurrency (bsc#1271879).
• CVE-2026-32665: Remote DNS-over-QUIC denial of service due to quic-size budget bypass (bsc#1271873).
• CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).
• CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries (bsc#1271891).
• CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records (bsc#1271892).
• CVE-2026-44621: Libunbound applications configured with unwanted-reply-threshold could eventually be abruptly terminated (bsc#1271876).
• CVE-2026-44687: Off-by-one error in harden-below-nxdomain logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN (bsc#1271893).
• CVE-2026-44690: Cross-zone wildcard cache poisoning via RRSIG.labels manipulation (bsc#1271877).
• CVE-2026-46582: Replay of a wildcard rrset as another piece of data triggers poisoning in the server expired reply path (bsc#1271894).
• CVE-2026-50045: max-global-quota bypass via single client queries for a deeply nested name under a DNSSEC-signed parent (bsc#1271878).
• CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).
• CVE-2026-50243: response-ip/rpz can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).
• CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).
• CVE-2026-50251: Attacker supplied 0.0.0.0/:: glue triggers defensive full-cache flush (bsc#1271883).
• CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).
• CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with answer-cookie:yes is used (bsc#1271895).
• CVE-2026-55708: Privacy/configuration issue when adding local data in views through unbound-control (bsc#1271896).
• CVE-2026-55717: serve-expired-client-timeout and response-ip CNAME redirect could lead to a crash (bsc#1271886).
• CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).
• CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in libngtcp2 (bsc#1271888).
• CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name (bsc#1271889).
• CVE-2026-56444: Degradation of resolution service when discard-timeout and serve-expired-client-timeout are combined in unusual configuration (bsc#1271890).

Other updates and bugfixes:

• Version 1.25.2:
  • For a complete list of additional changes see the changelog at https://nlnetlabs.nl/projects/unbound/download/.
• Update unbound.keyring.

This update for unbound fixes the following issues:

Update to version 1.25.2.

Security issues fixed:

• CVE-2026-14586: DoS via assertion in libngtcp2 for DNS-over-QUIC environments with high concurrency (bsc#1271879).
• CVE-2026-32665: Remote DNS-over-QUIC denial of service due to quic-size budget bypass (bsc#1271873).
• CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).
• CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries (bsc#1271891).
• CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records (bsc#1271892).
• CVE-2026-44621: Libunbound applications configured with unwanted-reply-threshold could eventually be abruptly terminated (bsc#1271876).
• CVE-2026-44687: Off-by-one error in harden-below-nxdomain logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN (bsc#1271893).
• CVE-2026-44690: Cross-zone wildcard cache poisoning via RRSIG.labels manipulation (bsc#1271877).
• CVE-2026-46582: Replay of a wildcard rrset as another piece of data triggers poisoning in the server expired reply path (bsc#1271894).
• CVE-2026-50045: max-global-quota bypass via single client queries for a deeply nested name under a DNSSEC-signed parent (bsc#1271878).
• CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).
• CVE-2026-50243: response-ip/rpz can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).
• CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).
• CVE-2026-50251: Attacker supplied 0.0.0.0/:: glue triggers defensive full-cache flush (bsc#1271883).
• CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).
• CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with answer-cookie:yes is used (bsc#1271895).
• CVE-2026-55708: Privacy/configuration issue when adding local data in views through unbound-control (bsc#1271896).
• CVE-2026-55717: serve-expired-client-timeout and response-ip CNAME redirect could lead to a crash (bsc#1271886).
• CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).
• CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in libngtcp2 (bsc#1271888).
• CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name (bsc#1271889).
• CVE-2026-56444: Degradation of resolution service when discard-timeout and serve-expired-client-timeout are combined in unusual configuration (bsc#1271890).

Other updates and bugfixes:

• Version 1.25.2:
  • For a complete list of additional changes see the changelog at https://nlnetlabs.nl/projects/unbound/download/.
• Update unbound.keyring.

This update for unbound fixes the following issues

• CVE-2026-32792: Packet of death with DNSCrypt (bsc#1265583).
• CVE-2026-33278: Possible remote code execution during DNSSEC validation (bsc#1265587).
• CVE-2026-40622: 'Ghost domain name' variant (bsc#1265581).
• CVE-2026-41292: Parsing a long list of incoming EDNS options degrades performance (bsc#1265580).
• CVE-2026-42534: Jostle logic bypass degrades resolution performance (bsc#1265585).
• CVE-2026-42923: Degradation of service with unbounded NSEC3 hash calculations (bsc#1265589).
• CVE-2026-42944: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (bsc#1265578).
• CVE-2026-42959: Crash during DNSSEC validation of malicious content (bsc#1265586).
• CVE-2026-42960: Possible cache poisoning attack while following delegation (bsc#1265588).
• CVE-2026-44390: Unbounded name compression in certain cases causes degradation of service (bsc#1265584).
• CVE-2026-44608: Use after free and crash in RPZ code (bsc#1265582).

This update for unbound fixes the following issues:

Update to version 1.25.2.

Security issues fixed:

• CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).
• CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records (bsc#1271892).
• CVE-2026-44621: Libunbound applications configured with unwanted-reply-threshold could eventually be abruptly terminated (bsc#1271876).
• CVE-2026-44687: Off-by-one error in harden-below-nxdomain logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN (bsc#1271893).
• CVE-2026-44690: Cross-zone wildcard cache poisoning via RRSIG.labels manipulation (bsc#1271877).
• CVE-2026-46582: Replay of a wildcard rrset as another piece of data triggers poisoning in the server expired reply path (bsc#1271894).
• CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).
• CVE-2026-50243: response-ip/rpz can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).
• CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).
• CVE-2026-50251: Attacker supplied 0.0.0.0/:: glue triggers defensive full-cache flush (bsc#1271883).
• CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).
• CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with answer-cookie:yes is used (bsc#1271895).
• CVE-2026-55708: Privacy/configuration issue when adding local data in views through unbound-control (bsc#1271896).
• CVE-2026-55717: serve-expired-client-timeout and response-ip CNAME redirect could lead to a crash (bsc#1271886).
• CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).
• CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name (bsc#1271889).
• CVE-2026-56444: Degradation of resolution service when discard-timeout and serve-expired-client-timeout are combined in unusual configuration (bsc#1271890).

Other updates and bugfixes:

• Version 1.25.2:
  • For a complete list of additional changes see the changelog at https://nlnetlabs.nl/projects/unbound/download/
• Update unbound.keyring.