Every CVE Search/ Get API key

CVE-2026-50252

Possible cache poisoning attack by mapping source port population per thread

5.7 MediumFix available

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined. The vulnerability arises when the load balancing policy is consistent with respect to the incoming source UDP port and IP address while heavily depending on the incoming source UDP port as a randomization source. When the SO_REUSEPORT configuration option is enabled ('so-reuseport: yes') in Unbound (by default), it meets these conditions, making it vulnerable for DNS cache poisoning attacks. Upon startup, Unbound randomly partitions the available UDP source port space into disjoint subsets of (almost) equal size, assigning each subset to a specific worker thread. When an incoming DNS query is received, the kernel’s SO_REUSEPORT load balancing mechanism deterministically assigns the query to a socket associated with a particular thread. All outgoing DNS queries generated during the resolution of that request use source ports selected exclusively from the port subset assigned to the corresponding thread. Since these port subsets are disjoint across threads, the source port observed in a resolver’s outgoing query to an authoritative name server serves as a reliable indicator of the worker thread that processed the original client query. A malicious actor can acquire the mapping between incoming UDP source ports (for a given fixed source IP address) and Unbound worker threads and leverage it to conduct DNS cache poisoning attacks by effectively lowering the random port population per thread.

Attack profile

How easy it is to exploit

Attack vector
Adjacent network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.17%Unchanged since Jul 23, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.7

Possible cache poisoning attack by mapping source port population per thread

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined. The vulnerability arises when the load balancing policy is consistent with respect to the incoming source UDP port and IP address while heavily depending on the incoming source UDP port as a randomization source. When the SO_REUSEPORT configuration option is enabled ('so-reuseport: yes') in Unbound (by default), it meets these conditions, making it vulnerable for DNS cache poisoning attacks. Upon startup, Unbound randomly partitions the available UDP source port space into disjoint subsets of (almost) equal size, assigning each subset to a specific worker thread. When an incoming DNS query is received, the kernel’s SO_REUSEPORT load balancing mechanism deterministically assigns the query to a socket associated with a particular thread. All outgoing DNS queries generated during the resolution of that request use source ports selected exclusively from the port subset assigned to the corresponding thread. Since these port subsets are disjoint across threads, the source port observed in a resolver’s outgoing query to an authoritative name server serves as a reliable indicator of the worker thread that processed the original client query. A malicious actor can acquire the mapping between incoming UDP source ports (for a given fixed source IP address) and Unbound worker threads and leverage it to conduct DNS cache poisoning attacks by effectively lowering the random port population per thread.

Record
CVE-2026-50252
CVSS 4.0
5.7 MediumCVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:H/E:P/U:Amber
Weakness
CWE-349
Updated
2026-11-02
EUVDEUVD-2026-47676 5.7

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined. The vulnerability arises when the load balancing policy is consistent with respect to the incoming source UDP port and IP address while heavily depending on the incoming source UDP port as a randomization source. When the SO_REUSEPORT configuration option is enabled ('so-reuseport: yes') in Unbound (by default), it meets these conditions, making it vulnerable for DNS cache poisoning attacks. Upon startup, Unbound randomly partitions the available UDP source port space into disjoint subsets of (almost) equal size, assigning each subset to a specific worker thread. When an incoming DNS query is received, the kernel’s SO_REUSEPORT load balancing mechanism deterministically assigns the query to a socket associated with a particular thread. All outgoing DNS queries generated during the resolution of that request use source ports selected exclusively from the port subset assigned to the corresponding thread. Since these port subsets are disjoint across threads, the source port observed in a resolver’s outgoing query to an authoritative name server serves as a reliable indicator of the worker thread that processed the original client query. A malicious actor can acquire the mapping between incoming UDP source ports (for a given fixed source IP address) and Unbound worker threads and leverage it to conduct DNS cache poisoning attacks by effectively lowering the random port population per thread.

Record
EUVD-2026-47676
CVSS 4.0
5.7 MediumCVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:H/E:P/U:Amber
Updated
2026-11-02
GitHub AdvisoriesGHSA-jfgc-mgqq-r573 5.7

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and...

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined. The vulnerability arises when the load balancing policy is consistent with respect to the incoming source UDP port and IP address while heavily depending on the incoming source UDP port as a randomization source. When the SO_REUSEPORT configuration option is enabled ('so-reuseport: yes') in Unbound (by default), it meets these conditions, making it vulnerable for DNS cache poisoning attacks. Upon startup, Unbound randomly partitions the available UDP source port space into disjoint subsets of (almost) equal size, assigning each subset to a specific worker thread. When an incoming DNS query is received, the kernel’s SO_REUSEPORT load balancing mechanism deterministically assigns the query to a socket associated with a particular thread. All outgoing DNS queries generated during the resolution of that request use source ports selected exclusively from the port subset assigned to the corresponding thread. Since these port subsets are disjoint across threads, the source port observed in a resolver’s outgoing query to an authoritative name server serves as a reliable indicator of the worker thread that processed the original client query. A malicious actor can acquire the mapping between incoming UDP source ports (for a given fixed source IP address) and Unbound worker threads and leverage it to conduct DNS cache poisoning attacks by effectively lowering the random port population per thread.

Record
GHSA-jfgc-mgqq-r573
CVSS 4.0
5.7 MediumCVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
CVSS 3.1
9.3 CriticalCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Weakness
CWE-349
Updated
2026-11-02
NVD 5.7

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined. The vulnerability arises when the load balancing policy is consistent with respect to the incoming source UDP port and IP address while heavily depending on the incoming source UDP port as a randomization source. When the SO_REUSEPORT configuration option is enabled ('so-reuseport: yes') in Unbound (by default), it meets these conditions, making it vulnerable for DNS cache poisoning attacks. Upon startup, Unbound randomly partitions the available UDP source port space into disjoint subsets of (almost) equal size, assigning each subset to a specific worker thread. When an incoming DNS query is received, the kernel’s SO_REUSEPORT load balancing mechanism deterministically assigns the query to a socket associated with a particular thread. All outgoing DNS queries generated during the resolution of that request use source ports selected exclusively from the port subset assigned to the corresponding thread. Since these port subsets are disjoint across threads, the source port observed in a resolver’s outgoing query to an authoritative name server serves as a reliable indicator of the worker thread that processed the original client query. A malicious actor can acquire the mapping between incoming UDP source ports (for a given fixed source IP address) and Unbound worker threads and leverage it to conduct DNS cache poisoning attacks by effectively lowering the random port population per thread.

Record
CVE-2026-50252
CVSS 4.0
5.7 MediumCVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
CVSS 3.1
9.3 CriticalCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Weakness
CWE-349
Updated
2026-11-02
OSVALPINE-CVE-2026-50252 9.3

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined. The vulnerability arises when the load balancing policy is consistent with respect to the incoming source UDP port and IP address while heavily depending on the incoming source UDP port as a randomization source. When the SO_REUSEPORT configuration option is enabled ('so-reuseport: yes') in Unbound (by default), it meets these conditions, making it vulnerable for DNS cache poisoning attacks. Upon startup, Unbound randomly partitions the available UDP source port space into disjoint subsets of (almost) equal size, assigning each subset to a specific worker thread. When an incoming DNS query is received, the kernel’s SO_REUSEPORT load balancing mechanism deterministically assigns the query to a socket associated with a particular thread. All outgoing DNS queries generated during the resolution of that request use source ports selected exclusively from the port subset assigned to the corresponding thread. Since these port subsets are disjoint across threads, the source port observed in a resolver’s outgoing query to an authoritative name server serves as a reliable indicator of the worker thread that processed the original client query. A malicious actor can acquire the mapping between incoming UDP source ports (for a given fixed source IP address) and Unbound worker threads and leverage it to conduct DNS cache poisoning attacks by effectively lowering the random port population per thread.

Record
ALPINE-CVE-2026-50252
CVSS 3.1
9.3 CriticalCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Updated
2026-11-02
OSV 9.3

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined. The vulnerability arises when the load balancing policy is consistent with respect to the incoming source UDP port and IP address while heavily depending on the incoming source UDP port as a randomization source. When the SO_REUSEPORT configuration option is enabled ('so-reuseport: yes') in Unbound (by default), it meets these conditions, making it vulnerable for DNS cache poisoning attacks. Upon startup, Unbound randomly partitions the available UDP source port space into disjoint subsets of (almost) equal size, assigning each subset to a specific worker thread. When an incoming DNS query is received, the kernel’s SO_REUSEPORT load balancing mechanism deterministically assigns the query to a socket associated with a particular thread. All outgoing DNS queries generated during the resolution of that request use source ports selected exclusively from the port subset assigned to the corresponding thread. Since these port subsets are disjoint across threads, the source port observed in a resolver’s outgoing query to an authoritative name server serves as a reliable indicator of the worker thread that processed the original client query. A malicious actor can acquire the mapping between incoming UDP source ports (for a given fixed source IP address) and Unbound worker threads and leverage it to conduct DNS cache poisoning attacks by effectively lowering the random port population per thread.

Record
CVE-2026-50252
CVSS 3.1
9.3 CriticalCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Updated
2026-11-02
Show 35 moreShow less
OSVDEBIAN-CVE-2026-50252 9.3

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined. The vulnerability arises when the load balancing policy is consistent with respect to the incoming source UDP port and IP address while heavily depending on the incoming source UDP port as a randomization source. When the SO_REUSEPORT configuration option is enabled ('so-reuseport: yes') in Unbound (by default), it meets these conditions, making it vulnerable for DNS cache poisoning attacks. Upon startup, Unbound randomly partitions the available UDP source port space into disjoint subsets of (almost) equal size, assigning each subset to a specific worker thread. When an incoming DNS query is received, the kernel’s SO_REUSEPORT load balancing mechanism deterministically assigns the query to a socket associated with a particular thread. All outgoing DNS queries generated during the resolution of that request use source ports selected exclusively from the port subset assigned to the corresponding thread. Since these port subsets are disjoint across threads, the source port observed in a resolver’s outgoing query to an authoritative name server serves as a reliable indicator of the worker thread that processed the original client query. A malicious actor can acquire the mapping between incoming UDP source ports (for a given fixed source IP address) and Unbound worker threads and leverage it to conduct DNS cache poisoning attacks by effectively lowering the random port population per thread.

Record
DEBIAN-CVE-2026-50252
CVSS 3.1
9.3 CriticalCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-3232 9.3

unbound security update

Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn't make custom builds or provide specific features to paying customers only.

Security Fix(es):

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined. The vulnerability arises when the load balancing policy is consistent with respect to the incoming source UDP port and IP address while heavily depending on the incoming source UDP port as a randomization source. When the SO_REUSEPORT configuration option is enabled ('so-reuseport: yes') in Unbound (by default), it meets these conditions, making it vulnerable for DNS cache poisoning attacks. Upon startup, Unbound randomly partitions the available UDP source port space into disjoint subsets of (almost) equal size, assigning each subset to a specific worker thread. When an incoming DNS query is received, the kernel’s SO_REUSEPORT load balancing mechanism deterministically assigns the query to a socket associated with a particular thread. All outgoing DNS queries generated during the resolution of that request use source ports selected exclusively from the port subset assigned to the corresponding thread. Since these port subsets are disjoint across threads, the source port observed in a resolver’s outgoing query to an authoritative name server serves as a reliable indicator of the worker thread that processed the original client query. A malicious actor can acquire the mapping between incoming UDP source ports (for a given fixed source IP address) and Unbound worker threads and leverage it to conduct DNS cache poisoning attacks by effectively lowering the random port population per thread.(CVE-2026-50252)

Record
OESA-2026-3232
CVSS 3.1
9.3 CriticalCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:43588 8.6

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:43588
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:68291 6.5

Red Hat Security Advisory: unbound security update

Record
RHSA-2026:68291
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:68292 6.5

Red Hat Security Advisory: unbound security update

Record
RHSA-2026:68292
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:69120 6.5

Red Hat Security Advisory: unbound security update

Record
RHSA-2026:69120
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:68291 6.5

Moderate: unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

  • unbound: Unbound: DNS cache poisoning via UDP source port predictability (CVE-2026-50252)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:68291
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:68292 6.5

Moderate: unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

  • unbound: Unbound: DNS cache poisoning via UDP source port predictability (CVE-2026-50252)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:68292
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:69120 6.5

Moderate: unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

  • unbound: Unbound: DNS cache poisoning via UDP source port predictability (CVE-2026-50252)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:69120
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-50252 5.7

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined. The vulnerability arises when the load balancing policy is consistent with respect to the incoming source UDP port and IP address while heavily depending on the incoming source UDP port as a randomization source. When the SO_REUSEPORT configuration option is enabled ('so-reuseport: yes') in Unbound (by default), it meets these conditions, making it vulnerable for DNS cache poisoning attacks. Upon startup, Unbound randomly partitions the available UDP source port space into disjoint subsets of (almost) equal size, assigning each subset to a specific worker thread. When an incoming DNS query is received, the kernel’s SO_REUSEPORT load balancing mechanism deterministically assigns the query to a socket associated with a particular thread. All outgoing DNS queries generated during the resolution of that request use source ports selected exclusively from the port subset assigned to the corresponding thread. Since these port subsets are disjoint across threads, the source port observed in a resolver’s outgoing query to an authoritative name server serves as a reliable indicator of the worker thread that processed the original client query. A malicious actor can acquire the mapping between incoming UDP source ports (for a given fixed source IP address) and Unbound worker threads and leverage it to conduct DNS cache poisoning attacks by effectively lowering the random port population per thread.

Record
UBUNTU-CVE-2026-50252
CVSS 4.0
5.7 MediumCVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:H/E:P/U:Amber
CVSS 3.1
9.3 CriticalCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Updated
2026-11-02
OSVALSA-2026:68291 No score

Moderate: unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

  • unbound: Unbound: DNS cache poisoning via UDP source port predictability (CVE-2026-50252)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:68291
Updated
2026-11-02
OSVALSA-2026:68292 No score

Moderate: unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

  • unbound: Unbound: DNS cache poisoning via UDP source port predictability (CVE-2026-50252)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:68292
Updated
2026-11-02
OSVALSA-2026:69120 No score

Moderate: unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

  • unbound: Unbound: DNS cache poisoning via UDP source port predictability (CVE-2026-50252)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:69120
Updated
2026-11-02
OSVAZL-92982 No score

CVE-2026-50252 affecting package unbound for versions less than 1.25.2-1

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined. The vulnerability arises when the load balancing policy is consistent with respect to the incoming source UDP port and IP address while heavily depending on the incoming source UDP port as a randomization source. When the SO_REUSEPORT configuration option is enabled ('so-reuseport: yes') in Unbound (by default), it meets these conditions, making it vulnerable for DNS cache poisoning attacks. Upon startup, Unbound randomly partitions the available UDP source port space into disjoint subsets of (almost) equal size, assigning each subset to a specific worker thread. When an incoming DNS query is received, the kernel’s SO_REUSEPORT load balancing mechanism deterministically assigns the query to a socket associated with a particular thread. All outgoing DNS queries generated during the resolution of that request use source ports selected exclusively from the port subset assigned to the corresponding thread. Since these port subsets are disjoint across threads, the source port observed in a resolver’s outgoing query to an authoritative name server serves as a reliable indicator of the worker thread that processed the original client query. A malicious actor can acquire the mapping between incoming UDP source ports (for a given fixed source IP address) and Unbound worker threads and leverage it to conduct DNS cache poisoning attacks by effectively lowering the random port population per thread.

Record
AZL-92982
Updated
2026-11-02
OSVCLSA-2026-1785241157 No score

unbound: Fix of CVE-2026-50252

  • CVE-2026-50252: draw outgoing UDP ports from a shared randomized pool so a source port can no longer be mapped to a worker thread for cache poisoning
Record
CLSA-2026-1785241157
Updated
2026-11-02
OSVCLSA-2026-1785241895 No score

unbound: Fix of CVE-2026-50252

  • CVE-2026-50252: draw outgoing UDP ports from a shared randomized pool so a source port can no longer be mapped to a worker thread for cache poisoning
Record
CLSA-2026-1785241895
Updated
2026-11-02
OSVCLSA-2026-1785409943 No score

unbound: Fix of CVE-2026-50252

  • CVE-2026-50252: DNS cache poisoning via per-thread source port partitioning; with 'so-reuseport: yes' and multiple threads the outgoing source port revealed the worker thread, lowering effective port entropy
Record
CLSA-2026-1785409943
Updated
2026-11-02
OSVCLSA-2026-1785410023 No score

unbound: Fix of CVE-2026-50252

  • CVE-2026-50252: DNS cache poisoning via per-thread source port partitioning; with 'so-reuseport: yes' and multiple threads the outgoing source port revealed the worker thread, lowering effective port entropy
Record
CLSA-2026-1785410023
Updated
2026-11-02
OSVCLSA-2026-1785412633 No score

unbound: Fix of CVE-2026-50252

  • CVE-2026-50252: DNS cache poisoning via per-thread source port partitioning; with 'so-reuseport: yes' and multiple threads the outgoing source port revealed the worker thread, lowering effective port entropy
Record
CLSA-2026-1785412633
Updated
2026-11-02
OSVCLSA-2026-1786008652 No score

unbound: Fix of CVE-2026-50252

  • CVE-2026-50252: draw outgoing UDP ports from a shared randomized pool so a source port can no longer be mapped to a worker thread for cache poisoning
Record
CLSA-2026-1786008652
Updated
2026-11-02
OSVMGASA-2026-0316 No score

Updated unbound packages fix security vulnerabilities

Unbound packages updated to version 1.25.2 which incorporates a number of security and bug fixes.

Record
MGASA-2026-0316
Updated
2026-11-02
OSVMGASA-2026-0451 No score

Updated unbound packages fixes security vulnerabilities

Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY Possible heap buffer overflow during DNSSEC canonicalization CNAME synthesis could lead to heap corruption Possible ZONEMD verification bypass window Use-after-free in DoQ stream output buffer on reset re-transmission Possible degradation of service from continuous queries on the same TCP/DoT connection Use-after-free in DoH stream cleanup code path Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC 'serve-expired' can bypass Unbound 'wait-limit' Remote DNS-over-QUIC denial of service due to 'quic-size' budget bypass Packet of death for DNSCrypt over TCP Cross-zone wildcard cache poisoning via RRSIG.labels manipulation 'dns-error-reporting: yes' leads to stack buffer overflow Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abruptly terminated 'max-global-quota' reset by DNSSEC validation restarts Possible heap use-after-free in an error path when a DoT forwarded query is jostled out 'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL BOGUS configured primary hostname accepted for XFR in auth/rpz zones Date: Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush Possible cache poisoning attack by mapping source port population per thread Memory corruption could lead to crash and denial of service 'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash Packet of death for a DNSCrypt misconfigured Unbound Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2 Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path DNS Cookie bypass when combined with proxy-protocol use Privacy/configuration issue when adding local data in views through 'unbound-control' Possible arbitrary code execution during DNSSEC validation Heap overflow with multiple NSID, COOKIE, PADDING EDNS options Crash during DNSSEC validation of malicious content Date: Packet of death with DNSCrypt Another "ghost domain names" attack variant Long list of incoming EDNS options degrades performance Jostle logic bypass degrades resolution performance Degradation of service with unbounded NSEC3 hash calculations Possible cache poisoning via promiscuous records for the authority section Unbounded name compression in certain cases causes degradation of service Use after free and crash under special conditions in RPZ code Possible domain hijacking via promiscuous records in the authority section Cache poisoning via the ECS-enabled Rebirthday Attack Unbounded name compression could lead to Denial of Service Unbound vulnerable to the "DNSBomb" pulsing DoS amplification attack Denial of service when trimming EDE text on positive replies DNSSEC verification complexity can be exploited to exhaust CPU resources and stall DNS resolvers NSEC3 closest encloser proof can exhaust CPU Non-Responsive Delegation Attack Novel "ghost domain names" attack by updating almost expired delegation information Novel "ghost domain names" attack by introducing subdomain delegations Local symlink attack Vulnerability in Domain Parse NXNSAttack Vulnerability in IPSEC module Vulnerability in parsing NOTIFY queries Vulnerability in the processing of wildcard synthesized NSEC…

Record
MGASA-2026-0451
Updated
2026-11-02
OSVopenSUSE-SU-2026:11380-1 No score

libunbound8-1.25.2-1.1 on GA media

These are all security issues fixed in the libunbound8-1.25.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11380-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21550-1 No score

Security update for unbound

This update for unbound fixes the following issues:

Update to version 1.25.2.

Security issues fixed:

  • CVE-2026-14586: DoS via assertion in libngtcp2 for DNS-over-QUIC environments with high concurrency (bsc#1271879).
  • CVE-2026-32665: Remote DNS-over-QUIC denial of service due to quic-size budget bypass (bsc#1271873).
  • CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).
  • CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries (bsc#1271891).
  • CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records (bsc#1271892).
  • CVE-2026-44621: Libunbound applications configured with unwanted-reply-threshold could eventually be abruptly terminated (bsc#1271876).
  • CVE-2026-44687: Off-by-one error in harden-below-nxdomain logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN (bsc#1271893).
  • CVE-2026-44690: Cross-zone wildcard cache poisoning via RRSIG.labels manipulation (bsc#1271877).
  • CVE-2026-46582: Replay of a wildcard rrset as another piece of data triggers poisoning in the server expired reply path (bsc#1271894).
  • CVE-2026-50045: max-global-quota bypass via single client queries for a deeply nested name under a DNSSEC-signed parent (bsc#1271878).
  • CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).
  • CVE-2026-50243: response-ip/rpz can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).
  • CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).
  • CVE-2026-50251: Attacker supplied 0.0.0.0/:: glue triggers defensive full-cache flush (bsc#1271883).
  • CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).
  • CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with answer-cookie:yes is used (bsc#1271895).
  • CVE-2026-55708: Privacy/configuration issue when adding local data in views through unbound-control (bsc#1271896).
  • CVE-2026-55717: serve-expired-client-timeout and response-ip CNAME redirect could lead to a crash (bsc#1271886).
  • CVE-2026-55973: DoS due to stack overflow triggered crash when dns-error-reporting: yes is set (bsc#1271874).
  • CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).
  • CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in libngtcp2 (bsc#1271888).
  • CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name (bsc#1271889).
  • CVE-2026-56444: Degradation of resolution service when discard-timeout and serve-expired-client-timeout are combined in unusual configuration (bsc#1271890).

Other updates and bugfixes:

  • Version 1.25.2:
    • Features:
      • TTL behavior changes: cached records reaching TTL 0 are expired; TTL 0 upstream answers are no longer cached by cachedb; serve-expired-reply-ttl is now capped by the original TTL value; TTL decoding updated to adhere to RFC 8767 section 4
      • Add new statistics: num.queries.replyaddr_limit and requestlist.current.replies
      • Add 'log-thread-id' configuration option to log the system-wide Linux thread ID for easier debugging
      • Add ECC-GOST12 support per RFC 9558 (available as contrib/gost12.patch)
      • Allow synthesized DNAME TTL=0 to be served from cache within a 1-second grace period, reducing recursion for TTL=0 DNAMEs (RFC 2308)
      • Fix DoT/DoH/DoQ to reload certificates on config reload without requiring a full restart; fast_reload now supports changes to tls-service-key, tls-service-pem and tls-cert-bundle
      • Allow ip@port notation in control-interface configuration
      • Add iter-scrub-rrsig option (default: 8) to limit the number of …
Record
openSUSE-SU-2026:21550-1
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2026-50252 No score

CVE-2026-50252 in unbound - Patched by Root

Root has patched CVE-2026-50252 in the unbound package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2026-50252
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-50252 No score

CVE-2026-50252 in unbound - Patched by Root

Root has patched CVE-2026-50252 in the unbound package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2026-50252
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-50252 No score

CVE-2026-50252 in unbound - Patched by Root

Root has patched CVE-2026-50252 in the unbound package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2026-50252
Updated
2026-11-02
OSVSUSE-SU-2026:23050-1 No score

Security update for unbound

This update for unbound fixes the following issues:

Update to version 1.25.2.

Security issues fixed:

  • CVE-2026-14586: DoS via assertion in libngtcp2 for DNS-over-QUIC environments with high concurrency (bsc#1271879).
  • CVE-2026-32665: Remote DNS-over-QUIC denial of service due to quic-size budget bypass (bsc#1271873).
  • CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).
  • CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries (bsc#1271891).
  • CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records (bsc#1271892).
  • CVE-2026-44621: Libunbound applications configured with unwanted-reply-threshold could eventually be abruptly terminated (bsc#1271876).
  • CVE-2026-44687: Off-by-one error in harden-below-nxdomain logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN (bsc#1271893).
  • CVE-2026-44690: Cross-zone wildcard cache poisoning via RRSIG.labels manipulation (bsc#1271877).
  • CVE-2026-46582: Replay of a wildcard rrset as another piece of data triggers poisoning in the server expired reply path (bsc#1271894).
  • CVE-2026-50045: max-global-quota bypass via single client queries for a deeply nested name under a DNSSEC-signed parent (bsc#1271878).
  • CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).
  • CVE-2026-50243: response-ip/rpz can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).
  • CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).
  • CVE-2026-50251: Attacker supplied 0.0.0.0/:: glue triggers defensive full-cache flush (bsc#1271883).
  • CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).
  • CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with answer-cookie:yes is used (bsc#1271895).
  • CVE-2026-55708: Privacy/configuration issue when adding local data in views through unbound-control (bsc#1271896).
  • CVE-2026-55717: serve-expired-client-timeout and response-ip CNAME redirect could lead to a crash (bsc#1271886).
  • CVE-2026-55973: DoS due to stack overflow triggered crash when dns-error-reporting: yes is set (bsc#1271874).
  • CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).
  • CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in libngtcp2 (bsc#1271888).
  • CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name (bsc#1271889).
  • CVE-2026-56444: Degradation of resolution service when discard-timeout and serve-expired-client-timeout are combined in unusual configuration (bsc#1271890).

Other updates and bugfixes:

  • Version 1.25.2:
    • Features:
      • TTL behavior changes: cached records reaching TTL 0 are expired; TTL 0 upstream answers are no longer cached by cachedb; serve-expired-reply-ttl is now capped by the original TTL value; TTL decoding updated to adhere to RFC 8767 section 4
      • Add new statistics: num.queries.replyaddr_limit and requestlist.current.replies
      • Add 'log-thread-id' configuration option to log the system-wide Linux thread ID for easier debugging
      • Add ECC-GOST12 support per RFC 9558 (available as contrib/gost12.patch)
      • Allow synthesized DNAME TTL=0 to be served from cache within a 1-second grace period, reducing recursion for TTL=0 DNAMEs (RFC 2308)
      • Fix DoT/DoH/DoQ to reload certificates on config reload without requiring a full restart; fast_reload now supports changes to tls-service-key, tls-service-pem and tls-cert-bundle
      • Allow ip@port notation in control-interface configuration
      • Add iter-scrub-rrsig option (default: 8) to limit the number of …
Record
SUSE-SU-2026:23050-1
Updated
2026-11-02
OSVSUSE-SU-2026:23215-1 No score

Security update for unbound

This update for unbound fixes the following issues:

Update to version 1.25.2.

Security issues fixed:

  • CVE-2026-14586: DoS via assertion in libngtcp2 for DNS-over-QUIC environments with high concurrency (bsc#1271879).
  • CVE-2026-32665: Remote DNS-over-QUIC denial of service due to quic-size budget bypass (bsc#1271873).
  • CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).
  • CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries (bsc#1271891).
  • CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records (bsc#1271892).
  • CVE-2026-44621: Libunbound applications configured with unwanted-reply-threshold could eventually be abruptly terminated (bsc#1271876).
  • CVE-2026-44687: Off-by-one error in harden-below-nxdomain logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN (bsc#1271893).
  • CVE-2026-44690: Cross-zone wildcard cache poisoning via RRSIG.labels manipulation (bsc#1271877).
  • CVE-2026-46582: Replay of a wildcard rrset as another piece of data triggers poisoning in the server expired reply path (bsc#1271894).
  • CVE-2026-50045: max-global-quota bypass via single client queries for a deeply nested name under a DNSSEC-signed parent (bsc#1271878).
  • CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).
  • CVE-2026-50243: response-ip/rpz can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).
  • CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).
  • CVE-2026-50251: Attacker supplied 0.0.0.0/:: glue triggers defensive full-cache flush (bsc#1271883).
  • CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).
  • CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with answer-cookie:yes is used (bsc#1271895).
  • CVE-2026-55708: Privacy/configuration issue when adding local data in views through unbound-control (bsc#1271896).
  • CVE-2026-55717: serve-expired-client-timeout and response-ip CNAME redirect could lead to a crash (bsc#1271886).
  • CVE-2026-55973: DoS due to stack overflow triggered crash when dns-error-reporting: yes is set (bsc#1271874).
  • CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).
  • CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in libngtcp2 (bsc#1271888).
  • CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name (bsc#1271889).
  • CVE-2026-56444: Degradation of resolution service when discard-timeout and serve-expired-client-timeout are combined in unusual configuration (bsc#1271890).

Other updates and bugfixes:

  • Version 1.25.2:
    • Features:
      • TTL behavior changes: cached records reaching TTL 0 are expired; TTL 0 upstream answers are no longer cached by cachedb; serve-expired-reply-ttl is now capped by the original TTL value; TTL decoding updated to adhere to RFC 8767 section 4
      • Add new statistics: num.queries.replyaddr_limit and requestlist.current.replies
      • Add 'log-thread-id' configuration option to log the system-wide Linux thread ID for easier debugging
      • Add ECC-GOST12 support per RFC 9558 (available as contrib/gost12.patch)
      • Allow synthesized DNAME TTL=0 to be served from cache within a 1-second grace period, reducing recursion for TTL=0 DNAMEs (RFC 2308)
      • Fix DoT/DoH/DoQ to reload certificates on config reload without requiring a full restart; fast_reload now supports changes to tls-service-key, tls-service-pem and tls-cert-bundle
      • Allow ip@port notation in control-interface configuration
      • Add iter-scrub-rrsig option (default: 8) to limit the number of …
Record
SUSE-SU-2026:23215-1
Updated
2026-11-02
OSVSUSE-SU-2026:23226-1 No score

Security update for unbound

This update for unbound fixes the following issues:

Update to version 1.25.2.

Security issues fixed:

  • CVE-2026-14586: DoS via assertion in libngtcp2 for DNS-over-QUIC environments with high concurrency (bsc#1271879).
  • CVE-2026-32665: Remote DNS-over-QUIC denial of service due to quic-size budget bypass (bsc#1271873).
  • CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).
  • CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries (bsc#1271891).
  • CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records (bsc#1271892).
  • CVE-2026-44621: Libunbound applications configured with unwanted-reply-threshold could eventually be abruptly terminated (bsc#1271876).
  • CVE-2026-44687: Off-by-one error in harden-below-nxdomain logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN (bsc#1271893).
  • CVE-2026-44690: Cross-zone wildcard cache poisoning via RRSIG.labels manipulation (bsc#1271877).
  • CVE-2026-46582: Replay of a wildcard rrset as another piece of data triggers poisoning in the server expired reply path (bsc#1271894).
  • CVE-2026-50045: max-global-quota bypass via single client queries for a deeply nested name under a DNSSEC-signed parent (bsc#1271878).
  • CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).
  • CVE-2026-50243: response-ip/rpz can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).
  • CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).
  • CVE-2026-50251: Attacker supplied 0.0.0.0/:: glue triggers defensive full-cache flush (bsc#1271883).
  • CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).
  • CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with answer-cookie:yes is used (bsc#1271895).
  • CVE-2026-55708: Privacy/configuration issue when adding local data in views through unbound-control (bsc#1271896).
  • CVE-2026-55717: serve-expired-client-timeout and response-ip CNAME redirect could lead to a crash (bsc#1271886).
  • CVE-2026-55973: DoS due to stack overflow triggered crash when dns-error-reporting: yes is set (bsc#1271874).
  • CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).
  • CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in libngtcp2 (bsc#1271888).
  • CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name (bsc#1271889).
  • CVE-2026-56444: Degradation of resolution service when discard-timeout and serve-expired-client-timeout are combined in unusual configuration (bsc#1271890).

Other updates and bugfixes:

  • Version 1.25.2:
    • Features:
      • TTL behavior changes: cached records reaching TTL 0 are expired; TTL 0 upstream answers are no longer cached by cachedb; serve-expired-reply-ttl is now capped by the original TTL value; TTL decoding updated to adhere to RFC 8767 section 4
      • Add new statistics: num.queries.replyaddr_limit and requestlist.current.replies
      • Add 'log-thread-id' configuration option to log the system-wide Linux thread ID for easier debugging
      • Add ECC-GOST12 support per RFC 9558 (available as contrib/gost12.patch)
      • Allow synthesized DNAME TTL=0 to be served from cache within a 1-second grace period, reducing recursion for TTL=0 DNAMEs (RFC 2308)
      • Fix DoT/DoH/DoQ to reload certificates on config reload without requiring a full restart; fast_reload now supports changes to tls-service-key, tls-service-pem and tls-cert-bundle
      • Allow ip@port notation in control-interface configuration
      • Add iter-scrub-rrsig option (default: 8) to limit the number of …
Record
SUSE-SU-2026:23226-1
Updated
2026-11-02
OSVSUSE-SU-2026:23349-1 No score

Security update for unbound

This update for unbound fixes the following issues:

Update to version 1.25.2.

Security issues fixed:

  • CVE-2026-14586: DoS via assertion in libngtcp2 for DNS-over-QUIC environments with high concurrency (bsc#1271879).
  • CVE-2026-32665: Remote DNS-over-QUIC denial of service due to quic-size budget bypass (bsc#1271873).
  • CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).
  • CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries (bsc#1271891).
  • CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records (bsc#1271892).
  • CVE-2026-44621: Libunbound applications configured with unwanted-reply-threshold could eventually be abruptly terminated (bsc#1271876).
  • CVE-2026-44687: Off-by-one error in harden-below-nxdomain logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN (bsc#1271893).
  • CVE-2026-44690: Cross-zone wildcard cache poisoning via RRSIG.labels manipulation (bsc#1271877).
  • CVE-2026-46582: Replay of a wildcard rrset as another piece of data triggers poisoning in the server expired reply path (bsc#1271894).
  • CVE-2026-50045: max-global-quota bypass via single client queries for a deeply nested name under a DNSSEC-signed parent (bsc#1271878).
  • CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).
  • CVE-2026-50243: response-ip/rpz can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).
  • CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).
  • CVE-2026-50251: Attacker supplied 0.0.0.0/:: glue triggers defensive full-cache flush (bsc#1271883).
  • CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).
  • CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with answer-cookie:yes is used (bsc#1271895).
  • CVE-2026-55708: Privacy/configuration issue when adding local data in views through unbound-control (bsc#1271896).
  • CVE-2026-55717: serve-expired-client-timeout and response-ip CNAME redirect could lead to a crash (bsc#1271886).
  • CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).
  • CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in libngtcp2 (bsc#1271888).
  • CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name (bsc#1271889).
  • CVE-2026-56444: Degradation of resolution service when discard-timeout and serve-expired-client-timeout are combined in unusual configuration (bsc#1271890).

Other updates and bugfixes:

Record
SUSE-SU-2026:23349-1
Updated
2026-11-02
OSVSUSE-SU-2026:23360-1 No score

Security update for unbound

This update for unbound fixes the following issues:

Update to version 1.25.2.

Security issues fixed:

  • CVE-2026-14586: DoS via assertion in libngtcp2 for DNS-over-QUIC environments with high concurrency (bsc#1271879).
  • CVE-2026-32665: Remote DNS-over-QUIC denial of service due to quic-size budget bypass (bsc#1271873).
  • CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).
  • CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries (bsc#1271891).
  • CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records (bsc#1271892).
  • CVE-2026-44621: Libunbound applications configured with unwanted-reply-threshold could eventually be abruptly terminated (bsc#1271876).
  • CVE-2026-44687: Off-by-one error in harden-below-nxdomain logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN (bsc#1271893).
  • CVE-2026-44690: Cross-zone wildcard cache poisoning via RRSIG.labels manipulation (bsc#1271877).
  • CVE-2026-46582: Replay of a wildcard rrset as another piece of data triggers poisoning in the server expired reply path (bsc#1271894).
  • CVE-2026-50045: max-global-quota bypass via single client queries for a deeply nested name under a DNSSEC-signed parent (bsc#1271878).
  • CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).
  • CVE-2026-50243: response-ip/rpz can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).
  • CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).
  • CVE-2026-50251: Attacker supplied 0.0.0.0/:: glue triggers defensive full-cache flush (bsc#1271883).
  • CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).
  • CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with answer-cookie:yes is used (bsc#1271895).
  • CVE-2026-55708: Privacy/configuration issue when adding local data in views through unbound-control (bsc#1271896).
  • CVE-2026-55717: serve-expired-client-timeout and response-ip CNAME redirect could lead to a crash (bsc#1271886).
  • CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).
  • CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in libngtcp2 (bsc#1271888).
  • CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name (bsc#1271889).
  • CVE-2026-56444: Degradation of resolution service when discard-timeout and serve-expired-client-timeout are combined in unusual configuration (bsc#1271890).

Other updates and bugfixes:

Record
SUSE-SU-2026:23360-1
Updated
2026-11-02
OSVSUSE-SU-2026:3884-1 No score

Security update for unbound

This update for unbound fixes the following issues:

Update to version 1.25.2.

Security issues fixed:

  • CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).
  • CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records (bsc#1271892).
  • CVE-2026-44621: Libunbound applications configured with unwanted-reply-threshold could eventually be abruptly terminated (bsc#1271876).
  • CVE-2026-44687: Off-by-one error in harden-below-nxdomain logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN (bsc#1271893).
  • CVE-2026-44690: Cross-zone wildcard cache poisoning via RRSIG.labels manipulation (bsc#1271877).
  • CVE-2026-46582: Replay of a wildcard rrset as another piece of data triggers poisoning in the server expired reply path (bsc#1271894).
  • CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).
  • CVE-2026-50243: response-ip/rpz can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).
  • CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).
  • CVE-2026-50251: Attacker supplied 0.0.0.0/:: glue triggers defensive full-cache flush (bsc#1271883).
  • CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).
  • CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with answer-cookie:yes is used (bsc#1271895).
  • CVE-2026-55708: Privacy/configuration issue when adding local data in views through unbound-control (bsc#1271896).
  • CVE-2026-55717: serve-expired-client-timeout and response-ip CNAME redirect could lead to a crash (bsc#1271886).
  • CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).
  • CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name (bsc#1271889).
  • CVE-2026-56444: Degradation of resolution service when discard-timeout and serve-expired-client-timeout are combined in unusual configuration (bsc#1271890).

Other updates and bugfixes:

Record
SUSE-SU-2026:3884-1
Updated
2026-11-02
OSVSUSE-SU-2026:3885-1 No score

Security update for unbound

This update for unbound fixes the following issues:

Update to version 1.25.2.

Security issues fixed:

  • CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).
  • CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records (bsc#1271892).
  • CVE-2026-44621: Libunbound applications configured with unwanted-reply-threshold could eventually be abruptly terminated (bsc#1271876).
  • CVE-2026-44687: Off-by-one error in harden-below-nxdomain logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN (bsc#1271893).
  • CVE-2026-44690: Cross-zone wildcard cache poisoning via RRSIG.labels manipulation (bsc#1271877).
  • CVE-2026-46582: Replay of a wildcard rrset as another piece of data triggers poisoning in the server expired reply path (bsc#1271894).
  • CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).
  • CVE-2026-50243: response-ip/rpz can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).
  • CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).
  • CVE-2026-50251: Attacker supplied 0.0.0.0/:: glue triggers defensive full-cache flush (bsc#1271883).
  • CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).
  • CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with answer-cookie:yes is used (bsc#1271895).
  • CVE-2026-55708: Privacy/configuration issue when adding local data in views through unbound-control (bsc#1271896).
  • CVE-2026-55717: serve-expired-client-timeout and response-ip CNAME redirect could lead to a crash (bsc#1271886).
  • CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).
  • CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name (bsc#1271889).
  • CVE-2026-56444: Degradation of resolution service when discard-timeout and serve-expired-client-timeout are combined in unusual configuration (bsc#1271890).

Other updates and bugfixes:

Record
SUSE-SU-2026:3885-1
Updated
2026-11-02
OSVUSN-8946-1 No score

unbound vulnerabilities

It was discovered that Unbound incorrectly handled certain TCP connections. A remote attacker could possibly use this issue to cause Unbound to consume resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-80225)

It was discovered that Unbound incorrectly handled certain DNS responses. A remote attacker could possibly use this issue to crash Unbound, resulting in a denial of service. (CVE-2026-81634)

It was discovered that Unbound incorrectly handled certain DNS responses during DNSSEC validation. A remote attacker could possibly use this issue to cause Unbound to consume resources, leading to a denial of service. (CVE-2026-85501)

It was discovered that Unbound incorrectly handled outgoing network ports. A remote attacker could possibly use this issue to crash Unbound, resulting in a denial of service. (CVE-2026-50252)

It was discovered that Unbound incorrectly handled certain DNSCrypt packets. A remote attacker could possibly use this issue to crash Unbound, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS and Ubuntu 18.04 LTS. (CVE-2026-40691)

It was discovered that Unbound incorrectly handled certain cached DNS responses. A remote attacker could possibly use this issue to poison Unbound's cache. This issue only affected Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-44690)

It was discovered that Unbound incorrectly handled certain DNS-over-QUIC connections. A remote attacker could possibly use this issue to cause Unbound to consume resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-32665)

It was discovered that Unbound incorrectly handled certain EDNS options. A remote attacker could possibly use this issue to crash Unbound, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-55973)

Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered that Unbound incorrectly handled validating DNSSEC messages. A remote attacker could possibly use this issue to cause Unbound to consume resources, leading to a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 16.04 LTS and Ubuntu 14.04 LTS. (CVE-2023-50387)

It was discovered that Unbound incorrectly handled preparing an NSEC3 closest encloser proof. A remote attacker could possibly use this issue to cause Unbound to consume resources, leading to a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 16.04 LTS and Ubuntu 14.04 LTS. (CVE-2023-50868)

Record
USN-8946-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
unbound
Alpine:v3.22
 1.4.22 up to 1.25.2-r0
1.25.2-r0
unbound
Alpine:v3.23
 1.4.22 up to 1.25.2-r0
1.25.2-r0
unbound
Alpine:v3.24
 1.4.22 up to 1.25.2-r0
1.25.2-r0
python3-unbound
AlmaLinux:10
 before 1.24.2-7.el10_2.5
1.24.2-7.el10_2.5
unbound
AlmaLinux:10
 before 1.24.2-7.el10_2.5
1.24.2-7.el10_2.5
unbound-anchor
AlmaLinux:10
 before 1.24.2-7.el10_2.5
1.24.2-7.el10_2.5
unbound-devel
AlmaLinux:10
 before 1.24.2-7.el10_2.5
1.24.2-7.el10_2.5
unbound-dracut
AlmaLinux:10
 before 1.24.2-7.el10_2.5
1.24.2-7.el10_2.5
unbound-libs
AlmaLinux:10
 before 1.24.2-7.el10_2.5
1.24.2-7.el10_2.5
unbound-utils
AlmaLinux:10
 before 1.24.2-7.el10_2.5
1.24.2-7.el10_2.5
Show 124 moreShow less
Affected packages
PackageAffectedFixed
python3-unbound
AlmaLinux:9
 before 1.24.2-3.el9_8.6
1.24.2-3.el9_8.6
unbound
AlmaLinux:9
 before 1.24.2-3.el9_8.6
1.24.2-3.el9_8.6
unbound-devel
AlmaLinux:9
 before 1.24.2-3.el9_8.6
1.24.2-3.el9_8.6
unbound-dracut
AlmaLinux:9
 before 1.24.2-3.el9_8.6
1.24.2-3.el9_8.6
unbound-libs
AlmaLinux:9
 before 1.24.2-3.el9_8.6
1.24.2-3.el9_8.6
python3-unbound
AlmaLinux:8
 before 1.16.2-5.14.el8_10.2
1.16.2-5.14.el8_10.2
unbound
AlmaLinux:8
 before 1.16.2-5.14.el8_10.2
1.16.2-5.14.el8_10.2
unbound-devel
AlmaLinux:8
 before 1.16.2-5.14.el8_10.2
1.16.2-5.14.el8_10.2
unbound-libs
AlmaLinux:8
 before 1.16.2-5.14.el8_10.2
1.16.2-5.14.el8_10.2
unbound
Azure Linux:3
 before 1.25.2-1
1.25.2-1
python3-unbound
TuxCare:CentOS-Stream:8
 before 1.16.2-5.el8.tuxcare.els9
1.16.2-5.el8.tuxcare.els9
unbound
TuxCare:CentOS-Stream:8
 before 1.16.2-5.el8.tuxcare.els9
1.16.2-5.el8.tuxcare.els9
unbound-devel
TuxCare:CentOS-Stream:8
 before 1.16.2-5.el8.tuxcare.els9
1.16.2-5.el8.tuxcare.els9
unbound-libs
TuxCare:CentOS-Stream:8
 before 1.16.2-5.el8.tuxcare.els9
1.16.2-5.el8.tuxcare.els9
python3-unbound
TuxCare:AlmaLinux:9.6
 before 1.16.2-19.el9_6.1.tuxcare.els9
1.16.2-19.el9_6.1.tuxcare.els9
unbound
TuxCare:AlmaLinux:9.6
 before 1.16.2-19.el9_6.1.tuxcare.els9
1.16.2-19.el9_6.1.tuxcare.els9
unbound-devel
TuxCare:AlmaLinux:9.6
 before 1.16.2-19.el9_6.1.tuxcare.els9
1.16.2-19.el9_6.1.tuxcare.els9
unbound-dracut
TuxCare:AlmaLinux:9.6
 before 1.16.2-19.el9_6.1.tuxcare.els9
1.16.2-19.el9_6.1.tuxcare.els9
unbound-libs
TuxCare:AlmaLinux:9.6
 before 1.16.2-19.el9_6.1.tuxcare.els9
1.16.2-19.el9_6.1.tuxcare.els9
unbound
TuxCare:CentOS:7
 before 1.6.6-5.el7_8.tuxcare.els7
1.6.6-5.el7_8.tuxcare.els7
unbound-devel
TuxCare:CentOS:7
 before 1.6.6-5.el7_8.tuxcare.els7
1.6.6-5.el7_8.tuxcare.els7
unbound-libs
TuxCare:CentOS:7
 before 1.6.6-5.el7_8.tuxcare.els7
1.6.6-5.el7_8.tuxcare.els7
unbound-python
TuxCare:CentOS:7
 before 1.6.6-5.el7_8.tuxcare.els7
1.6.6-5.el7_8.tuxcare.els7
unbound
TuxCare:RHEL:7
 before 1.6.6-5.el7_8.tuxcare.els7
1.6.6-5.el7_8.tuxcare.els7
unbound-devel
TuxCare:RHEL:7
 before 1.6.6-5.el7_8.tuxcare.els7
1.6.6-5.el7_8.tuxcare.els7
unbound-libs
TuxCare:RHEL:7
 before 1.6.6-5.el7_8.tuxcare.els7
1.6.6-5.el7_8.tuxcare.els7
unbound-python
TuxCare:RHEL:7
 before 1.6.6-5.el7_8.tuxcare.els7
1.6.6-5.el7_8.tuxcare.els7
unbound
TuxCare:OracleLinux:7
 before 1.6.6-5.el7_8.tuxcare.els7
1.6.6-5.el7_8.tuxcare.els7
unbound-devel
TuxCare:OracleLinux:7
 before 1.6.6-5.el7_8.tuxcare.els7
1.6.6-5.el7_8.tuxcare.els7
unbound-libs
TuxCare:OracleLinux:7
 before 1.6.6-5.el7_8.tuxcare.els7
1.6.6-5.el7_8.tuxcare.els7
unbound-python
TuxCare:OracleLinux:7
 before 1.6.6-5.el7_8.tuxcare.els7
1.6.6-5.el7_8.tuxcare.els7
python3-unbound
TuxCare:AlmaLinux:9.2
 before 1.16.2-3.el9_2.tuxcare.els11
1.16.2-3.el9_2.tuxcare.els11
unbound
TuxCare:AlmaLinux:9.2
 before 1.16.2-3.el9_2.tuxcare.els11
1.16.2-3.el9_2.tuxcare.els11
unbound-devel
TuxCare:AlmaLinux:9.2
 before 1.16.2-3.el9_2.tuxcare.els11
1.16.2-3.el9_2.tuxcare.els11
unbound-libs
TuxCare:AlmaLinux:9.2
 before 1.16.2-3.el9_2.tuxcare.els11
1.16.2-3.el9_2.tuxcare.els11
unbound
Debian:12
 All versions, plus listed versions
1.17.1-21.17.1-2+deb12u11.17.1-2+deb12u21.17.1-2+deb12u31.17.1-2+deb12u4
Show 22 moreShow less
1.17.1-2+loong641.18.0-11.18.0-21.19.1-11.19.2-11.20.0-11.21.1-11.22.0-11.22.0-21.23.1-11.24.0-11.24.0-21.24.1-11.24.1-21.24.2-11.25.0-11.25.1-11.25.2-11.26.0-11.26.0-21.26.1-11.26.2-1
 None known
unbound
Debian:13
 before 1.26.1-0+deb13u1, plus listed versions
1.22.0-21.22.0-2+deb13u11.22.0-2+deb13u21.22.0-2+deb13u31.23.1-1
Show 10 moreShow less
1.24.0-11.24.0-21.24.1-11.24.1-21.24.2-11.25.0-11.25.1-11.25.2-11.26.0-11.26.0-2
1.26.1-0+deb13u1
unbound
Debian:14
 before 1.25.2-1, plus listed versions
1.22.0-21.23.1-11.24.0-11.24.0-21.24.1-1
Show 4 moreShow less
1.24.1-21.24.2-11.25.0-11.25.1-1
1.25.2-1
unbound
Mageia:10
 before 1.25.2-1.mga10
1.25.2-1.mga10
unbound
Mageia:9
 before 1.25.2-1.mga9
1.25.2-1.mga9
unbound
Mageia:10
 before 1.26.1-1.mga10
1.26.1-1.mga10
unbound
Mageia:9
 before 1.26.1-1.mga9
1.26.1-1.mga9
unbound
openEuler:22.03-LTS-SP4
 before 1.13.2-24.oe2203sp4
1.13.2-24.oe2203sp4
unbound
openEuler:24.03-LTS-SP1
 before 1.17.1-19.oe2403sp1
1.17.1-19.oe2403sp1
unbound
openEuler:24.03-LTS-SP3
 before 1.17.1-18.oe2403sp3
1.17.1-18.oe2403sp3
unbound
openEuler:24.03-LTS-SP4
 before 1.17.1-18.oe2403sp4
1.17.1-18.oe2403sp4
unbound
openEuler:20.03-LTS-SP4
 before 1.11.0-24.oe2003sp4
1.11.0-24.oe2003sp4
python3-unbound
Red Hat:hummingbird:1
 before 0:1.25.2-0.1.hum1
0:1.25.2-0.1.hum1
unbound
Red Hat:hummingbird:1
 before 0:1.25.2-0.1.hum1
0:1.25.2-0.1.hum1
unbound-anchor
Red Hat:hummingbird:1
 before 0:1.25.2-0.1.hum1
0:1.25.2-0.1.hum1
unbound-devel
Red Hat:hummingbird:1
 before 0:1.25.2-0.1.hum1
0:1.25.2-0.1.hum1
unbound-dracut
Red Hat:hummingbird:1
 before 0:1.25.2-0.1.hum1
0:1.25.2-0.1.hum1
unbound-libs
Red Hat:hummingbird:1
 before 0:1.25.2-0.1.hum1
0:1.25.2-0.1.hum1
unbound-munin
Red Hat:hummingbird:1
 before 0:1.25.2-0.1.hum1
0:1.25.2-0.1.hum1
unbound-utils
Red Hat:hummingbird:1
 before 0:1.25.2-0.1.hum1
0:1.25.2-0.1.hum1
python3-unbound
Red Hat:enterprise_linux:10.2
 before 0:1.24.2-7.el10_2.5
0:1.24.2-7.el10_2.5
python3-unbound-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:1.24.2-7.el10_2.5
0:1.24.2-7.el10_2.5
unbound
Red Hat:enterprise_linux:10.2
 before 0:1.24.2-7.el10_2.5
0:1.24.2-7.el10_2.5
unbound-anchor
Red Hat:enterprise_linux:10.2
 before 0:1.24.2-7.el10_2.5
0:1.24.2-7.el10_2.5
unbound-anchor-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:1.24.2-7.el10_2.5
0:1.24.2-7.el10_2.5
unbound-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:1.24.2-7.el10_2.5
0:1.24.2-7.el10_2.5
unbound-debugsource
Red Hat:enterprise_linux:10.2
 before 0:1.24.2-7.el10_2.5
0:1.24.2-7.el10_2.5
unbound-dracut
Red Hat:enterprise_linux:10.2
 before 0:1.24.2-7.el10_2.5
0:1.24.2-7.el10_2.5
unbound-libs
Red Hat:enterprise_linux:10.2
 before 0:1.24.2-7.el10_2.5
0:1.24.2-7.el10_2.5
unbound-libs-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:1.24.2-7.el10_2.5
0:1.24.2-7.el10_2.5
unbound-utils
Red Hat:enterprise_linux:10.2
 before 0:1.24.2-7.el10_2.5
0:1.24.2-7.el10_2.5
unbound-utils-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:1.24.2-7.el10_2.5
0:1.24.2-7.el10_2.5
unbound-devel
Red Hat:enterprise_linux:10.2
 before 0:1.24.2-7.el10_2.5
0:1.24.2-7.el10_2.5
python3-unbound
Red Hat:enterprise_linux:9::appstream
 before 0:1.24.2-3.el9_8.6
0:1.24.2-3.el9_8.6
python3-unbound-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:1.24.2-3.el9_8.6
0:1.24.2-3.el9_8.6
unbound
Red Hat:enterprise_linux:9::appstream
 before 0:1.24.2-3.el9_8.6
0:1.24.2-3.el9_8.6
unbound-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:1.24.2-3.el9_8.6
0:1.24.2-3.el9_8.6
unbound-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:1.24.2-3.el9_8.6
0:1.24.2-3.el9_8.6
unbound-dracut
Red Hat:enterprise_linux:9::appstream
 before 0:1.24.2-3.el9_8.6
0:1.24.2-3.el9_8.6
unbound-libs
Red Hat:enterprise_linux:9::appstream
 before 0:1.24.2-3.el9_8.6
0:1.24.2-3.el9_8.6
unbound-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:1.24.2-3.el9_8.6
0:1.24.2-3.el9_8.6
python3-unbound-debuginfo
Red Hat:enterprise_linux:9::crb
 before 0:1.24.2-3.el9_8.6
0:1.24.2-3.el9_8.6
unbound-debuginfo
Red Hat:enterprise_linux:9::crb
 before 0:1.24.2-3.el9_8.6
0:1.24.2-3.el9_8.6
unbound-debugsource
Red Hat:enterprise_linux:9::crb
 before 0:1.24.2-3.el9_8.6
0:1.24.2-3.el9_8.6
unbound-devel
Red Hat:enterprise_linux:9::crb
 before 0:1.24.2-3.el9_8.6
0:1.24.2-3.el9_8.6
unbound-libs-debuginfo
Red Hat:enterprise_linux:9::crb
 before 0:1.24.2-3.el9_8.6
0:1.24.2-3.el9_8.6
python3-unbound
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.2-5.14.el8_10.2
0:1.16.2-5.14.el8_10.2
python3-unbound-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.2-5.14.el8_10.2
0:1.16.2-5.14.el8_10.2
unbound
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.2-5.14.el8_10.2
0:1.16.2-5.14.el8_10.2
unbound-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.2-5.14.el8_10.2
0:1.16.2-5.14.el8_10.2
unbound-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.2-5.14.el8_10.2
0:1.16.2-5.14.el8_10.2
unbound-devel
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.2-5.14.el8_10.2
0:1.16.2-5.14.el8_10.2
unbound-libs
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.2-5.14.el8_10.2
0:1.16.2-5.14.el8_10.2
unbound-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.2-5.14.el8_10.2
0:1.16.2-5.14.el8_10.2
unbound
Rocky Linux:10
 before 0:1.24.2-7.el10_2.5
0:1.24.2-7.el10_2.5
unbound
Rocky Linux:9
 before 0:1.24.2-3.el9_8.6
0:1.24.2-3.el9_8.6
unbound
Rocky Linux:8
 before 0:1.16.2-5.14.el8_10.2
0:1.16.2-5.14.el8_10.2
unbound
Root:Debian:11
 before 1.13.1-1+deb11u7.aikido.1
1.13.1-1+deb11u7.aikido.11.13.1-1+deb11u7.aikido.21.13.1-1+deb11u7.aikido.31.13.1-1+deb11u7.aikido.41.13.1-1+deb11u7.aikido.51.13.1-1+deb11u7.aikido.6
rootio-unbound
Root:Debian:11
 before 1.13.1-1+deb11u7.aikido.1
1.13.1-1+deb11u7.aikido.11.13.1-1+deb11u7.aikido.21.13.1-1+deb11u7.aikido.31.13.1-1+deb11u7.aikido.41.13.1-1+deb11u7.aikido.51.13.1-1+deb11u7.aikido.6
unbound
Root:Debian:12
 before 1.17.1-2+deb12u4.aikido.2
1.17.1-2+deb12u4.aikido.21.17.1-2+deb12u4.aikido.31.17.1-2+deb12u4.aikido.41.17.1-2+deb12u4.aikido.5
rootio-unbound
Root:Debian:12
 before 1.17.1-2+deb12u4.aikido.2
1.17.1-2+deb12u4.aikido.21.17.1-2+deb12u4.aikido.31.17.1-2+deb12u4.aikido.41.17.1-2+deb12u4.aikido.5
unbound
SUSE:Linux Micro 6.2
 before 1.25.2-160000.1.1
1.25.2-160000.1.1
unbound
SUSE:Linux Enterprise Server 16.0
 before 1.25.2-160000.1.1
1.25.2-160000.1.1
unbound
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 1.25.2-160000.1.1
1.25.2-160000.1.1
unbound
SUSE:Linux Micro 6.1
 before 1.25.2-slfo.1.1_1.1
1.25.2-slfo.1.1_1.1
unbound
SUSE:Linux Micro 6.0
 before 1.25.2-1.1
1.25.2-1.1
unbound
SUSE:Linux Enterprise Micro 5.5
 before 1.25.2-150100.10.28.1
1.25.2-150100.10.28.1
unbound
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 1.25.2-150100.10.28.1
1.25.2-150100.10.28.1
unbound
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 1.25.2-150100.10.28.1
1.25.2-150100.10.28.1
unbound
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 1.25.2-150100.10.28.1
1.25.2-150100.10.28.1
unbound
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 1.25.2-150100.10.28.1
1.25.2-150100.10.28.1
unbound
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 1.25.2-150100.10.28.1
1.25.2-150100.10.28.1
unbound
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 1.25.2-150100.10.28.1
1.25.2-150100.10.28.1
unbound
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 1.25.2-150100.10.28.1
1.25.2-150100.10.28.1
unbound
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 1.25.2-150100.10.28.1
1.25.2-150100.10.28.1
unbound
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 1.25.2-150600.23.19.1
1.25.2-150600.23.19.1
unbound
SUSE:Linux Enterprise Module for Package Hub 15 SP7
 before 1.25.2-150600.23.19.1
1.25.2-150600.23.19.1
unbound
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 1.25.2-150600.23.19.1
1.25.2-150600.23.19.1
unbound
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
 before 1.25.2-150600.23.19.1
1.25.2-150600.23.19.1
unbound
Ubuntu:Pro:14.04:LTS
 before 1.4.22-1ubuntu4.14.04.3+esm5, plus listed versions
1.4.20-11.4.21-11.4.21-1ubuntu11.4.21-1ubuntu21.4.22-1ubuntu1
Show 10 moreShow less
1.4.22-1ubuntu21.4.22-1ubuntu31.4.22-1ubuntu41.4.22-1ubuntu4.14.04.11.4.22-1ubuntu4.14.04.21.4.22-1ubuntu4.14.04.31.4.22-1ubuntu4.14.04.3+esm11.4.22-1ubuntu4.14.04.3+esm21.4.22-1ubuntu4.14.04.3+esm31.4.22-1ubuntu4.14.04.3+esm4
1.4.22-1ubuntu4.14.04.3+esm5
unbound
Ubuntu:Pro:16.04:LTS
 before 1.5.8-1ubuntu1.1+esm5, plus listed versions
1.4.22-1ubuntu61.5.7-1ubuntu11.5.7-1ubuntu21.5.8-1ubuntu11.5.8-1ubuntu1.1
Show 4 moreShow less
1.5.8-1ubuntu1.1+esm11.5.8-1ubuntu1.1+esm21.5.8-1ubuntu1.1+esm31.5.8-1ubuntu1.1+esm4
1.5.8-1ubuntu1.1+esm5
unbound
Ubuntu:Pro:18.04:LTS
 before 1.6.7-1ubuntu2.6+esm6, plus listed versions
1.6.5-11.6.7-11.6.7-1build11.6.7-1ubuntu11.6.7-1ubuntu2
Show 10 moreShow less
1.6.7-1ubuntu2.11.6.7-1ubuntu2.21.6.7-1ubuntu2.31.6.7-1ubuntu2.41.6.7-1ubuntu2.51.6.7-1ubuntu2.61.6.7-1ubuntu2.6+esm21.6.7-1ubuntu2.6+esm31.6.7-1ubuntu2.6+esm41.6.7-1ubuntu2.6+esm5
1.6.7-1ubuntu2.6+esm6
unbound
Ubuntu:Pro:20.04:LTS
 before 1.9.4-2ubuntu1.11+esm3, plus listed versions
1.9.0-2ubuntu11.9.0-2ubuntu21.9.4-21.9.4-2ubuntu11.9.4-2ubuntu1.1
Show 10 moreShow less
1.9.4-2ubuntu1.21.9.4-2ubuntu1.31.9.4-2ubuntu1.41.9.4-2ubuntu1.51.9.4-2ubuntu1.61.9.4-2ubuntu1.81.9.4-2ubuntu1.91.9.4-2ubuntu1.111.9.4-2ubuntu1.11+esm11.9.4-2ubuntu1.11+esm2
1.9.4-2ubuntu1.11+esm3
unbound
Ubuntu:22.04:LTS
 before 1.13.1-1ubuntu5.17, plus listed versions
1.13.1-1ubuntu11.13.1-1ubuntu31.13.1-1ubuntu51.13.1-1ubuntu5.11.13.1-1ubuntu5.2
Show 12 moreShow less
1.13.1-1ubuntu5.31.13.1-1ubuntu5.41.13.1-1ubuntu5.51.13.1-1ubuntu5.71.13.1-1ubuntu5.81.13.1-1ubuntu5.101.13.1-1ubuntu5.111.13.1-1ubuntu5.121.13.1-1ubuntu5.131.13.1-1ubuntu5.141.13.1-1ubuntu5.151.13.1-1ubuntu5.16
1.13.1-1ubuntu5.17
unbound
Ubuntu:24.04:LTS
 before 1.19.2-1ubuntu3.12, plus listed versions
1.17.1-21.18.0-2ubuntu11.18.0-2ubuntu21.19.1-1ubuntu11.19.2-1ubuntu1
Show 11 moreShow less
1.19.2-1ubuntu31.19.2-1ubuntu3.11.19.2-1ubuntu3.21.19.2-1ubuntu3.31.19.2-1ubuntu3.41.19.2-1ubuntu3.51.19.2-1ubuntu3.61.19.2-1ubuntu3.71.19.2-1ubuntu3.81.19.2-1ubuntu3.91.19.2-1ubuntu3.10
1.19.2-1ubuntu3.12
unbound
Ubuntu:26.10
 All versions, plus listed versions
1.24.2-1ubuntu21.25.1-1ubuntu11.25.1-1ubuntu3
 None known
unbound
Ubuntu:26.04:LTS
 before 1.24.2-1ubuntu2.4, plus listed versions
1.22.0-2ubuntu21.22.0-2ubuntu41.24.2-1ubuntu11.24.2-1ubuntu21.24.2-1ubuntu2.11.24.2-1ubuntu2.21.24.2-1ubuntu2.3
1.24.2-1ubuntu2.4
unbound
openSUSE:Tumbleweed
 before 1.25.2-1.1
1.25.2-1.1
unbound
openSUSE:Leap 16.0
 before 1.25.2-160000.1.1
1.25.2-160000.1.1

History

History
RecordedChangedSources
affected
affected, aliases, published, referencesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-50252 is a medium vulnerability (CVSS 5.7) in Nlnet Labs Unbound, published July 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. Fixed in unbound 1.25.2-r0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 13 references and the rest of 5 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open