CVE-2026-44690

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone). Arbitrary delegations that do not exist under the parent domain and are covered by the parent's NSEC chain can be brought into insecure existence by fraudulent wildcard DS records (less labels than expected, unknown algorithm) from the malicious sibling domain. This allows the malicious actor to inject insecure wildcard records for those delegations.

Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn't make custom builds or provide specific features to paying customers only.

Security Fix(es):

With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and libunbound needs to call 'libworker_alloc_cleanup' since the function is absent from the function call allow list. When an application using libunbound sets 'unwanted-reply-threshold' to any non-zero value and the iterator queries an authoritative that replies with enough wrong-transaction-ID UDP datagrams to cross the threshold, the 'libworker_alloc_cleanup' will eventually be called. Since the function is absent from the function call allow list, this leads to a fatal exit of libunbound and eventual termination of the embedding application.Unbound itself is not affected since its relevant function 'worker_alloc_cleanup' is registed in the allow list and proceeds to perform the documented cache flush.(CVE-2026-44621)

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone). Arbitrary delegations that do not exist under the parent domain and are covered by the parent's NSEC chain can be brought into insecure existence by fraudulent wildcard DS records (less labels than expected, unknown algorithm) from the malicious sibling domain. This allows the malicious actor to inject insecure wildcard records for those delegations.(CVE-2026-44690)

In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache, before later validation treats it as bogus based on NSEC validation. When the resolving thread puts secure on the rrset, and another thread that is on the serve expired path then picks up the updated rrset contents with the secure status for a reply, it can be used to change a specific record, next to a wildcard that could be covered by the wildcard, into the wildcard. A malicious actor can exploit the possible poisonous effect by having any DNSSEC-singed domain (irrelevant to the victim domain) and a CNAME wrapper record that points to a record next to a wildcard (that could be covered by the wildcard). Then quering Unbound for the wildcard sibling record would seed the secure message. A later (after expiry) query for the CNAME wrapper would need to resolve the target sibling record. If the wildcard replay is injected into the response, the wildcard rrset will update the expired sibling record with a secure status before completing proper wildcard validation with NSEC records and eventually treating the CNAME wrapper answer as bogus. The updated poisoned rrset is now secure and points to the wildcard. This vulnerability is explicit for the serve expired path and needs injection of the signed wildcard rrset without the NSEC accompanying rrset.(CVE-2026-46582)

In NLnet Labs Unbound 1.6.2 up to and including 1.25.1,…

Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn't make custom builds or provide specific features to paying customers only.

Security Fix(es):

In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply length against the destination buffer size. The size clamp that protects the UDP path is not applied on the TCP path, so a reply larger than 65504 bytes is shifted forward by 48 bytes inside a buffer of capacity equal to 'msg-buffer-size', writing past the end of the heap allocation. A single malicious encrypted query crashes the resolver and lead to denial of service. This vulnerability needs Unbound to be compiled with DNSCrypt support ('--enable-dnscrypt') and the 'dnscrypt:' clause to be configured and enabled for the listening interfaces.(CVE-2026-40691)

With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and libunbound needs to call 'libworker_alloc_cleanup' since the function is absent from the function call allow list. When an application using libunbound sets 'unwanted-reply-threshold' to any non-zero value and the iterator queries an authoritative that replies with enough wrong-transaction-ID UDP datagrams to cross the threshold, the 'libworker_alloc_cleanup' will eventually be called. Since the function is absent from the function call allow list, this leads to a fatal exit of libunbound and eventual termination of the embedding application.Unbound itself is not affected since its relevant function 'worker_alloc_cleanup' is registed in the allow list and proceeds to perform the documented cache flush.(CVE-2026-44621)

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone). Arbitrary delegations that do not exist under the parent domain and are covered by the parent's NSEC chain can be brought into insecure existence by fraudulent wildcard DS records (less labels than expected, unknown algorithm) from the malicious sibling domain. This allows the malicious actor to inject insecure wildcard records for those delegations.(CVE-2026-44690)

In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache, before later validation treats it as bogus based on NSEC validation. When the resolving thread puts secure on the rrset, and another thread that is on the serve expired path then picks up the updated rrset contents with the secure status for a reply, it can be used to change a specific record, next to a wildcard that could be covered by the wildcard, into the wildcard. A malicious actor can exploit the possible poisonous effect by having any DNSSEC-singed domain (irrelevant to the victim domain) and a CNAME wrapper record that points to a record next to a wildcard (that could…

Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn't make custom builds or provide specific features to paying customers only.

Security Fix(es):

In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply length against the destination buffer size. The size clamp that protects the UDP path is not applied on the TCP path, so a reply larger than 65504 bytes is shifted forward by 48 bytes inside a buffer of capacity equal to 'msg-buffer-size', writing past the end of the heap allocation. A single malicious encrypted query crashes the resolver and lead to denial of service. This vulnerability needs Unbound to be compiled with DNSCrypt support ('--enable-dnscrypt') and the 'dnscrypt:' clause to be configured and enabled for the listening interfaces.(CVE-2026-40691)

With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and libunbound needs to call 'libworker_alloc_cleanup' since the function is absent from the function call allow list. When an application using libunbound sets 'unwanted-reply-threshold' to any non-zero value and the iterator queries an authoritative that replies with enough wrong-transaction-ID UDP datagrams to cross the threshold, the 'libworker_alloc_cleanup' will eventually be called. Since the function is absent from the function call allow list, this leads to a fatal exit of libunbound and eventual termination of the embedding application.Unbound itself is not affected since its relevant function 'worker_alloc_cleanup' is registed in the allow list and proceeds to perform the documented cache flush.(CVE-2026-44621)

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone). Arbitrary delegations that do not exist under the parent domain and are covered by the parent's NSEC chain can be brought into insecure existence by fraudulent wildcard DS records (less labels than expected, unknown algorithm) from the malicious sibling domain. This allows the malicious actor to inject insecure wildcard records for those delegations.(CVE-2026-44690)

In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache, before later validation treats it as bogus based on NSEC validation. When the resolving thread puts secure on the rrset, and another thread that is on the serve expired path then picks up the updated rrset contents with the secure status for a reply, it can be used to change a specific record, next to a wildcard that could be covered by the wildcard, into the wildcard. A malicious actor can exploit the possible poisonous effect by having any DNSSEC-singed domain (irrelevant to the victim domain) and a CNAME wrapper record that points to a record next to a wildcard (that could…

Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn't make custom builds or provide specific features to paying customers only.

Security Fix(es):

With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and libunbound needs to call 'libworker_alloc_cleanup' since the function is absent from the function call allow list. When an application using libunbound sets 'unwanted-reply-threshold' to any non-zero value and the iterator queries an authoritative that replies with enough wrong-transaction-ID UDP datagrams to cross the threshold, the 'libworker_alloc_cleanup' will eventually be called. Since the function is absent from the function call allow list, this leads to a fatal exit of libunbound and eventual termination of the embedding application.Unbound itself is not affected since its relevant function 'worker_alloc_cleanup' is registed in the allow list and proceeds to perform the documented cache flush.(CVE-2026-44621)

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone). Arbitrary delegations that do not exist under the parent domain and are covered by the parent's NSEC chain can be brought into insecure existence by fraudulent wildcard DS records (less labels than expected, unknown algorithm) from the malicious sibling domain. This allows the malicious actor to inject insecure wildcard records for those delegations.(CVE-2026-44690)

In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache, before later validation treats it as bogus based on NSEC validation. When the resolving thread puts secure on the rrset, and another thread that is on the serve expired path then picks up the updated rrset contents with the secure status for a reply, it can be used to change a specific record, next to a wildcard that could be covered by the wildcard, into the wildcard. A malicious actor can exploit the possible poisonous effect by having any DNSSEC-singed domain (irrelevant to the victim domain) and a CNAME wrapper record that points to a record next to a wildcard (that could be covered by the wildcard). Then quering Unbound for the wildcard sibling record would seed the secure message. A later (after expiry) query for the CNAME wrapper would need to resolve the target sibling record. If the wildcard replay is injected into the response, the wildcard rrset will update the expired sibling record with a secure status before completing proper wildcard validation with NSEC records and eventually treating the CNAME wrapper answer as bogus. The updated poisoned rrset is now secure and points to the wildcard. This vulnerability is explicit for the serve expired path and needs injection of the signed wildcard rrset without the NSEC accompanying rrset.(CVE-2026-46582)

In NLnet Labs Unbound 1.6.2 up to and including 1.25.1,…

Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn't make custom builds or provide specific features to paying customers only.

Security Fix(es):

In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply length against the destination buffer size. The size clamp that protects the UDP path is not applied on the TCP path, so a reply larger than 65504 bytes is shifted forward by 48 bytes inside a buffer of capacity equal to 'msg-buffer-size', writing past the end of the heap allocation. A single malicious encrypted query crashes the resolver and lead to denial of service. This vulnerability needs Unbound to be compiled with DNSCrypt support ('--enable-dnscrypt') and the 'dnscrypt:' clause to be configured and enabled for the listening interfaces.(CVE-2026-40691)

In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client A/AAAA query can cause Unbound to overwrite the cached expired parent-side glue rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client query is required since Unbound implicitly performs that query. This is a variant of CVE-2026-40622 which only addressed the NS query.(CVE-2026-42955)

With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and libunbound needs to call 'libworker_alloc_cleanup' since the function is absent from the function call allow list. When an application using libunbound sets 'unwanted-reply-threshold' to any non-zero value and the iterator queries an authoritative that replies with enough wrong-transaction-ID UDP datagrams to cross the threshold, the 'libworker_alloc_cleanup' will eventually be called. Since the function is absent from the function call allow list, this leads to a fatal exit of libunbound and eventual termination of the embedding application.Unbound itself is not affected since its relevant function 'worker_alloc_cleanup' is registed in the allow list and proceeds to perform the documented cache flush.(CVE-2026-44621)

In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed zone could be shadowed by the intermediate label's secure NXDOMAIN answer from the parent. This is caused by an off-by-one error in 'harden-below-nxdomain' logic; enabled by default. It effectively bypasses the configuration and the configured stub/forward zone is never contacted. 'harden-below-nxdomain' does an upward DNS cache walk together with a delegation point guard that does not allow NXDOMAIN synthesis above stub/forward zones. The guard tests the domain name but before stripping a label. This results in an iteration where the domain name equals the configured stub/forward zone apex that…

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

• unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes (CVE-2026-44690)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

• unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes (CVE-2026-44690)

• unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option (CVE-2026-55973)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

• unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes (CVE-2026-44690)

• unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option (CVE-2026-55973)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone). Arbitrary delegations that do not exist under the parent domain and are covered by the parent's NSEC chain can be brought into insecure existence by fraudulent wildcard DS records (less labels than expected, unknown algorithm) from the malicious sibling domain. This allows the malicious actor to inject insecure wildcard records for those delegations.

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

• unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes (CVE-2026-44690)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

• unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes (CVE-2026-44690)
• unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option (CVE-2026-55973)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

• unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes (CVE-2026-44690)
• unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option (CVE-2026-55973)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone). Arbitrary delegations that do not exist under the parent domain and are covered by the parent's NSEC chain can be brought into insecure existence by fraudulent wildcard DS records (less labels than expected, unknown algorithm) from the malicious sibling domain. This allows the malicious actor to inject insecure wildcard records for those delegations.

• CVE-2024-43167: guard against a NULL forward-zone name in ub_ctx_set_fwd to prevent a NULL pointer dereference
• CVE-2026-44690: reject RRSIG label counts below the signer label count and restrict wildcard rrset cache updates to the signer authority, deferring the cache write until the proof succeeds
• CVE-2026-56416: bound the second domain name in canonicalized RDATA and reject multi-dname RRs whose rdata ends early, preventing a heap buffer overflow

Unbound packages updated to version 1.25.2 which incorporates a number of security and bug fixes.

Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY Possible heap buffer overflow during DNSSEC canonicalization CNAME synthesis could lead to heap corruption Possible ZONEMD verification bypass window Use-after-free in DoQ stream output buffer on reset re-transmission Possible degradation of service from continuous queries on the same TCP/DoT connection Use-after-free in DoH stream cleanup code path Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC 'serve-expired' can bypass Unbound 'wait-limit' Remote DNS-over-QUIC denial of service due to 'quic-size' budget bypass Packet of death for DNSCrypt over TCP Cross-zone wildcard cache poisoning via RRSIG.labels manipulation 'dns-error-reporting: yes' leads to stack buffer overflow Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abruptly terminated 'max-global-quota' reset by DNSSEC validation restarts Possible heap use-after-free in an error path when a DoT forwarded query is jostled out 'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL BOGUS configured primary hostname accepted for XFR in auth/rpz zones Date: Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush Possible cache poisoning attack by mapping source port population per thread Memory corruption could lead to crash and denial of service 'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash Packet of death for a DNSCrypt misconfigured Unbound Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2 Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path DNS Cookie bypass when combined with proxy-protocol use Privacy/configuration issue when adding local data in views through 'unbound-control' Possible arbitrary code execution during DNSSEC validation Heap overflow with multiple NSID, COOKIE, PADDING EDNS options Crash during DNSSEC validation of malicious content Date: Packet of death with DNSCrypt Another "ghost domain names" attack variant Long list of incoming EDNS options degrades performance Jostle logic bypass degrades resolution performance Degradation of service with unbounded NSEC3 hash calculations Possible cache poisoning via promiscuous records for the authority section Unbounded name compression in certain cases causes degradation of service Use after free and crash under special conditions in RPZ code Possible domain hijacking via promiscuous records in the authority section Cache poisoning via the ECS-enabled Rebirthday Attack Unbounded name compression could lead to Denial of Service Unbound vulnerable to the "DNSBomb" pulsing DoS amplification attack Denial of service when trimming EDE text on positive replies DNSSEC verification complexity can be exploited to exhaust CPU resources and stall DNS resolvers NSEC3 closest encloser proof can exhaust CPU Non-Responsive Delegation Attack Novel "ghost domain names" attack by updating almost expired delegation information Novel "ghost domain names" attack by introducing subdomain delegations Local symlink attack Vulnerability in Domain Parse NXNSAttack Vulnerability in IPSEC module Vulnerability in parsing NOTIFY queries Vulnerability in the processing of wildcard synthesized NSEC…

These are all security issues fixed in the libunbound8-1.25.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for unbound fixes the following issues:

Update to version 1.25.2.

Security issues fixed:

• CVE-2026-14586: DoS via assertion in libngtcp2 for DNS-over-QUIC environments with high concurrency (bsc#1271879).
• CVE-2026-32665: Remote DNS-over-QUIC denial of service due to quic-size budget bypass (bsc#1271873).
• CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).
• CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries (bsc#1271891).
• CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records (bsc#1271892).
• CVE-2026-44621: Libunbound applications configured with unwanted-reply-threshold could eventually be abruptly terminated (bsc#1271876).
• CVE-2026-44687: Off-by-one error in harden-below-nxdomain logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN (bsc#1271893).
• CVE-2026-44690: Cross-zone wildcard cache poisoning via RRSIG.labels manipulation (bsc#1271877).
• CVE-2026-46582: Replay of a wildcard rrset as another piece of data triggers poisoning in the server expired reply path (bsc#1271894).
• CVE-2026-50045: max-global-quota bypass via single client queries for a deeply nested name under a DNSSEC-signed parent (bsc#1271878).
• CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).
• CVE-2026-50243: response-ip/rpz can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).
• CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).
• CVE-2026-50251: Attacker supplied 0.0.0.0/:: glue triggers defensive full-cache flush (bsc#1271883).
• CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).
• CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with answer-cookie:yes is used (bsc#1271895).
• CVE-2026-55708: Privacy/configuration issue when adding local data in views through unbound-control (bsc#1271896).
• CVE-2026-55717: serve-expired-client-timeout and response-ip CNAME redirect could lead to a crash (bsc#1271886).
• CVE-2026-55973: DoS due to stack overflow triggered crash when dns-error-reporting: yes is set (bsc#1271874).
• CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).
• CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in libngtcp2 (bsc#1271888).
• CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name (bsc#1271889).
• CVE-2026-56444: Degradation of resolution service when discard-timeout and serve-expired-client-timeout are combined in unusual configuration (bsc#1271890).

Other updates and bugfixes:

• Version 1.25.2:
  • Features:
    • TTL behavior changes: cached records reaching TTL 0 are expired; TTL 0 upstream answers are no longer cached by cachedb; serve-expired-reply-ttl is now capped by the original TTL value; TTL decoding updated to adhere to RFC 8767 section 4
    • Add new statistics: num.queries.replyaddr_limit and requestlist.current.replies
    • Add 'log-thread-id' configuration option to log the system-wide Linux thread ID for easier debugging
    • Add ECC-GOST12 support per RFC 9558 (available as contrib/gost12.patch)
    • Allow synthesized DNAME TTL=0 to be served from cache within a 1-second grace period, reducing recursion for TTL=0 DNAMEs (RFC 2308)
    • Fix DoT/DoH/DoQ to reload certificates on config reload without requiring a full restart; fast_reload now supports changes to tls-service-key, tls-service-pem and tls-cert-bundle
    • Allow ip@port notation in control-interface configuration
    • Add iter-scrub-rrsig option (default: 8) to limit the number of …

Root has patched CVE-2026-44690 in the unbound package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-44690 in the unbound package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-44690 in the unbound package for Root:Debian:13. Multiple fixed versions available.

This update for unbound fixes the following issues:

Update to version 1.25.2.

Security issues fixed:

• CVE-2026-14586: DoS via assertion in libngtcp2 for DNS-over-QUIC environments with high concurrency (bsc#1271879).
• CVE-2026-32665: Remote DNS-over-QUIC denial of service due to quic-size budget bypass (bsc#1271873).
• CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).
• CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries (bsc#1271891).
• CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records (bsc#1271892).
• CVE-2026-44621: Libunbound applications configured with unwanted-reply-threshold could eventually be abruptly terminated (bsc#1271876).
• CVE-2026-44687: Off-by-one error in harden-below-nxdomain logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN (bsc#1271893).
• CVE-2026-44690: Cross-zone wildcard cache poisoning via RRSIG.labels manipulation (bsc#1271877).
• CVE-2026-46582: Replay of a wildcard rrset as another piece of data triggers poisoning in the server expired reply path (bsc#1271894).
• CVE-2026-50045: max-global-quota bypass via single client queries for a deeply nested name under a DNSSEC-signed parent (bsc#1271878).
• CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).
• CVE-2026-50243: response-ip/rpz can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).
• CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).
• CVE-2026-50251: Attacker supplied 0.0.0.0/:: glue triggers defensive full-cache flush (bsc#1271883).
• CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).
• CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with answer-cookie:yes is used (bsc#1271895).
• CVE-2026-55708: Privacy/configuration issue when adding local data in views through unbound-control (bsc#1271896).
• CVE-2026-55717: serve-expired-client-timeout and response-ip CNAME redirect could lead to a crash (bsc#1271886).
• CVE-2026-55973: DoS due to stack overflow triggered crash when dns-error-reporting: yes is set (bsc#1271874).
• CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).
• CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in libngtcp2 (bsc#1271888).
• CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name (bsc#1271889).
• CVE-2026-56444: Degradation of resolution service when discard-timeout and serve-expired-client-timeout are combined in unusual configuration (bsc#1271890).

Other updates and bugfixes:

• Version 1.25.2:
  • Features:
    • TTL behavior changes: cached records reaching TTL 0 are expired; TTL 0 upstream answers are no longer cached by cachedb; serve-expired-reply-ttl is now capped by the original TTL value; TTL decoding updated to adhere to RFC 8767 section 4
    • Add new statistics: num.queries.replyaddr_limit and requestlist.current.replies
    • Add 'log-thread-id' configuration option to log the system-wide Linux thread ID for easier debugging
    • Add ECC-GOST12 support per RFC 9558 (available as contrib/gost12.patch)
    • Allow synthesized DNAME TTL=0 to be served from cache within a 1-second grace period, reducing recursion for TTL=0 DNAMEs (RFC 2308)
    • Fix DoT/DoH/DoQ to reload certificates on config reload without requiring a full restart; fast_reload now supports changes to tls-service-key, tls-service-pem and tls-cert-bundle
    • Allow ip@port notation in control-interface configuration
    • Add iter-scrub-rrsig option (default: 8) to limit the number of …

This update for unbound fixes the following issues:

Update to version 1.25.2.

Security issues fixed:

• CVE-2026-14586: DoS via assertion in libngtcp2 for DNS-over-QUIC environments with high concurrency (bsc#1271879).
• CVE-2026-32665: Remote DNS-over-QUIC denial of service due to quic-size budget bypass (bsc#1271873).
• CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).
• CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries (bsc#1271891).
• CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records (bsc#1271892).
• CVE-2026-44621: Libunbound applications configured with unwanted-reply-threshold could eventually be abruptly terminated (bsc#1271876).
• CVE-2026-44687: Off-by-one error in harden-below-nxdomain logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN (bsc#1271893).
• CVE-2026-44690: Cross-zone wildcard cache poisoning via RRSIG.labels manipulation (bsc#1271877).
• CVE-2026-46582: Replay of a wildcard rrset as another piece of data triggers poisoning in the server expired reply path (bsc#1271894).
• CVE-2026-50045: max-global-quota bypass via single client queries for a deeply nested name under a DNSSEC-signed parent (bsc#1271878).
• CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).
• CVE-2026-50243: response-ip/rpz can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).
• CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).
• CVE-2026-50251: Attacker supplied 0.0.0.0/:: glue triggers defensive full-cache flush (bsc#1271883).
• CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).
• CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with answer-cookie:yes is used (bsc#1271895).
• CVE-2026-55708: Privacy/configuration issue when adding local data in views through unbound-control (bsc#1271896).
• CVE-2026-55717: serve-expired-client-timeout and response-ip CNAME redirect could lead to a crash (bsc#1271886).
• CVE-2026-55973: DoS due to stack overflow triggered crash when dns-error-reporting: yes is set (bsc#1271874).
• CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).
• CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in libngtcp2 (bsc#1271888).
• CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name (bsc#1271889).
• CVE-2026-56444: Degradation of resolution service when discard-timeout and serve-expired-client-timeout are combined in unusual configuration (bsc#1271890).

Other updates and bugfixes:

• Version 1.25.2:
  • Features:
    • TTL behavior changes: cached records reaching TTL 0 are expired; TTL 0 upstream answers are no longer cached by cachedb; serve-expired-reply-ttl is now capped by the original TTL value; TTL decoding updated to adhere to RFC 8767 section 4
    • Add new statistics: num.queries.replyaddr_limit and requestlist.current.replies
    • Add 'log-thread-id' configuration option to log the system-wide Linux thread ID for easier debugging
    • Add ECC-GOST12 support per RFC 9558 (available as contrib/gost12.patch)
    • Allow synthesized DNAME TTL=0 to be served from cache within a 1-second grace period, reducing recursion for TTL=0 DNAMEs (RFC 2308)
    • Fix DoT/DoH/DoQ to reload certificates on config reload without requiring a full restart; fast_reload now supports changes to tls-service-key, tls-service-pem and tls-cert-bundle
    • Allow ip@port notation in control-interface configuration
    • Add iter-scrub-rrsig option (default: 8) to limit the number of …

This update for unbound fixes the following issues:

Update to version 1.25.2.

Security issues fixed:

• CVE-2026-14586: DoS via assertion in libngtcp2 for DNS-over-QUIC environments with high concurrency (bsc#1271879).
• CVE-2026-32665: Remote DNS-over-QUIC denial of service due to quic-size budget bypass (bsc#1271873).
• CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).
• CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries (bsc#1271891).
• CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records (bsc#1271892).
• CVE-2026-44621: Libunbound applications configured with unwanted-reply-threshold could eventually be abruptly terminated (bsc#1271876).
• CVE-2026-44687: Off-by-one error in harden-below-nxdomain logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN (bsc#1271893).
• CVE-2026-44690: Cross-zone wildcard cache poisoning via RRSIG.labels manipulation (bsc#1271877).
• CVE-2026-46582: Replay of a wildcard rrset as another piece of data triggers poisoning in the server expired reply path (bsc#1271894).
• CVE-2026-50045: max-global-quota bypass via single client queries for a deeply nested name under a DNSSEC-signed parent (bsc#1271878).
• CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).
• CVE-2026-50243: response-ip/rpz can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).
• CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).
• CVE-2026-50251: Attacker supplied 0.0.0.0/:: glue triggers defensive full-cache flush (bsc#1271883).
• CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).
• CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with answer-cookie:yes is used (bsc#1271895).
• CVE-2026-55708: Privacy/configuration issue when adding local data in views through unbound-control (bsc#1271896).
• CVE-2026-55717: serve-expired-client-timeout and response-ip CNAME redirect could lead to a crash (bsc#1271886).
• CVE-2026-55973: DoS due to stack overflow triggered crash when dns-error-reporting: yes is set (bsc#1271874).
• CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).
• CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in libngtcp2 (bsc#1271888).
• CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name (bsc#1271889).
• CVE-2026-56444: Degradation of resolution service when discard-timeout and serve-expired-client-timeout are combined in unusual configuration (bsc#1271890).

Other updates and bugfixes:

• Version 1.25.2:
  • Features:
    • TTL behavior changes: cached records reaching TTL 0 are expired; TTL 0 upstream answers are no longer cached by cachedb; serve-expired-reply-ttl is now capped by the original TTL value; TTL decoding updated to adhere to RFC 8767 section 4
    • Add new statistics: num.queries.replyaddr_limit and requestlist.current.replies
    • Add 'log-thread-id' configuration option to log the system-wide Linux thread ID for easier debugging
    • Add ECC-GOST12 support per RFC 9558 (available as contrib/gost12.patch)
    • Allow synthesized DNAME TTL=0 to be served from cache within a 1-second grace period, reducing recursion for TTL=0 DNAMEs (RFC 2308)
    • Fix DoT/DoH/DoQ to reload certificates on config reload without requiring a full restart; fast_reload now supports changes to tls-service-key, tls-service-pem and tls-cert-bundle
    • Allow ip@port notation in control-interface configuration
    • Add iter-scrub-rrsig option (default: 8) to limit the number of …

This update for unbound fixes the following issues:

Update to version 1.25.2.

Security issues fixed:

• CVE-2026-14586: DoS via assertion in libngtcp2 for DNS-over-QUIC environments with high concurrency (bsc#1271879).
• CVE-2026-32665: Remote DNS-over-QUIC denial of service due to quic-size budget bypass (bsc#1271873).
• CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).
• CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries (bsc#1271891).
• CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records (bsc#1271892).
• CVE-2026-44621: Libunbound applications configured with unwanted-reply-threshold could eventually be abruptly terminated (bsc#1271876).
• CVE-2026-44687: Off-by-one error in harden-below-nxdomain logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN (bsc#1271893).
• CVE-2026-44690: Cross-zone wildcard cache poisoning via RRSIG.labels manipulation (bsc#1271877).
• CVE-2026-46582: Replay of a wildcard rrset as another piece of data triggers poisoning in the server expired reply path (bsc#1271894).
• CVE-2026-50045: max-global-quota bypass via single client queries for a deeply nested name under a DNSSEC-signed parent (bsc#1271878).
• CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).
• CVE-2026-50243: response-ip/rpz can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).
• CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).
• CVE-2026-50251: Attacker supplied 0.0.0.0/:: glue triggers defensive full-cache flush (bsc#1271883).
• CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).
• CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with answer-cookie:yes is used (bsc#1271895).
• CVE-2026-55708: Privacy/configuration issue when adding local data in views through unbound-control (bsc#1271896).
• CVE-2026-55717: serve-expired-client-timeout and response-ip CNAME redirect could lead to a crash (bsc#1271886).
• CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).
• CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in libngtcp2 (bsc#1271888).
• CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name (bsc#1271889).
• CVE-2026-56444: Degradation of resolution service when discard-timeout and serve-expired-client-timeout are combined in unusual configuration (bsc#1271890).

Other updates and bugfixes:

• Version 1.25.2:
  • For a complete list of additional changes see the changelog at https://nlnetlabs.nl/projects/unbound/download/.
• Update unbound.keyring.

This update for unbound fixes the following issues:

Update to version 1.25.2.

Security issues fixed:

• CVE-2026-14586: DoS via assertion in libngtcp2 for DNS-over-QUIC environments with high concurrency (bsc#1271879).
• CVE-2026-32665: Remote DNS-over-QUIC denial of service due to quic-size budget bypass (bsc#1271873).
• CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).
• CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries (bsc#1271891).
• CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records (bsc#1271892).
• CVE-2026-44621: Libunbound applications configured with unwanted-reply-threshold could eventually be abruptly terminated (bsc#1271876).
• CVE-2026-44687: Off-by-one error in harden-below-nxdomain logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN (bsc#1271893).
• CVE-2026-44690: Cross-zone wildcard cache poisoning via RRSIG.labels manipulation (bsc#1271877).
• CVE-2026-46582: Replay of a wildcard rrset as another piece of data triggers poisoning in the server expired reply path (bsc#1271894).
• CVE-2026-50045: max-global-quota bypass via single client queries for a deeply nested name under a DNSSEC-signed parent (bsc#1271878).
• CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).
• CVE-2026-50243: response-ip/rpz can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).
• CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).
• CVE-2026-50251: Attacker supplied 0.0.0.0/:: glue triggers defensive full-cache flush (bsc#1271883).
• CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).
• CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with answer-cookie:yes is used (bsc#1271895).
• CVE-2026-55708: Privacy/configuration issue when adding local data in views through unbound-control (bsc#1271896).
• CVE-2026-55717: serve-expired-client-timeout and response-ip CNAME redirect could lead to a crash (bsc#1271886).
• CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).
• CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in libngtcp2 (bsc#1271888).
• CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name (bsc#1271889).
• CVE-2026-56444: Degradation of resolution service when discard-timeout and serve-expired-client-timeout are combined in unusual configuration (bsc#1271890).

Other updates and bugfixes:

• Version 1.25.2:
  • For a complete list of additional changes see the changelog at https://nlnetlabs.nl/projects/unbound/download/.
• Update unbound.keyring.

This update for unbound fixes the following issues:

Update to version 1.25.2.

Security issues fixed:

• CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).
• CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records (bsc#1271892).
• CVE-2026-44621: Libunbound applications configured with unwanted-reply-threshold could eventually be abruptly terminated (bsc#1271876).
• CVE-2026-44687: Off-by-one error in harden-below-nxdomain logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN (bsc#1271893).
• CVE-2026-44690: Cross-zone wildcard cache poisoning via RRSIG.labels manipulation (bsc#1271877).
• CVE-2026-46582: Replay of a wildcard rrset as another piece of data triggers poisoning in the server expired reply path (bsc#1271894).
• CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).
• CVE-2026-50243: response-ip/rpz can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).
• CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).
• CVE-2026-50251: Attacker supplied 0.0.0.0/:: glue triggers defensive full-cache flush (bsc#1271883).
• CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).
• CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with answer-cookie:yes is used (bsc#1271895).
• CVE-2026-55708: Privacy/configuration issue when adding local data in views through unbound-control (bsc#1271896).
• CVE-2026-55717: serve-expired-client-timeout and response-ip CNAME redirect could lead to a crash (bsc#1271886).
• CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).
• CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name (bsc#1271889).
• CVE-2026-56444: Degradation of resolution service when discard-timeout and serve-expired-client-timeout are combined in unusual configuration (bsc#1271890).

Other updates and bugfixes:

• Version 1.25.2:
  • For a complete list of additional changes see the changelog at https://nlnetlabs.nl/projects/unbound/download/.
• Update unbound.keyring.

This update for unbound fixes the following issues:

Update to version 1.25.2.

Security issues fixed:

• CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).
• CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records (bsc#1271892).
• CVE-2026-44621: Libunbound applications configured with unwanted-reply-threshold could eventually be abruptly terminated (bsc#1271876).
• CVE-2026-44687: Off-by-one error in harden-below-nxdomain logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN (bsc#1271893).
• CVE-2026-44690: Cross-zone wildcard cache poisoning via RRSIG.labels manipulation (bsc#1271877).
• CVE-2026-46582: Replay of a wildcard rrset as another piece of data triggers poisoning in the server expired reply path (bsc#1271894).
• CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).
• CVE-2026-50243: response-ip/rpz can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).
• CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).
• CVE-2026-50251: Attacker supplied 0.0.0.0/:: glue triggers defensive full-cache flush (bsc#1271883).
• CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).
• CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with answer-cookie:yes is used (bsc#1271895).
• CVE-2026-55708: Privacy/configuration issue when adding local data in views through unbound-control (bsc#1271896).
• CVE-2026-55717: serve-expired-client-timeout and response-ip CNAME redirect could lead to a crash (bsc#1271886).
• CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).
• CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name (bsc#1271889).
• CVE-2026-56444: Degradation of resolution service when discard-timeout and serve-expired-client-timeout are combined in unusual configuration (bsc#1271890).

Other updates and bugfixes:

• Version 1.25.2:
  • For a complete list of additional changes see the changelog at https://nlnetlabs.nl/projects/unbound/download/
• Update unbound.keyring.

It was discovered that Unbound incorrectly handled certain TCP connections. A remote attacker could possibly use this issue to cause Unbound to consume resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-80225)

It was discovered that Unbound incorrectly handled certain DNS responses. A remote attacker could possibly use this issue to crash Unbound, resulting in a denial of service. (CVE-2026-81634)

It was discovered that Unbound incorrectly handled certain DNS responses during DNSSEC validation. A remote attacker could possibly use this issue to cause Unbound to consume resources, leading to a denial of service. (CVE-2026-85501)

It was discovered that Unbound incorrectly handled outgoing network ports. A remote attacker could possibly use this issue to crash Unbound, resulting in a denial of service. (CVE-2026-50252)

It was discovered that Unbound incorrectly handled certain DNSCrypt packets. A remote attacker could possibly use this issue to crash Unbound, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS and Ubuntu 18.04 LTS. (CVE-2026-40691)

It was discovered that Unbound incorrectly handled certain cached DNS responses. A remote attacker could possibly use this issue to poison Unbound's cache. This issue only affected Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-44690)

It was discovered that Unbound incorrectly handled certain DNS-over-QUIC connections. A remote attacker could possibly use this issue to cause Unbound to consume resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-32665)

It was discovered that Unbound incorrectly handled certain EDNS options. A remote attacker could possibly use this issue to crash Unbound, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-55973)

Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered that Unbound incorrectly handled validating DNSSEC messages. A remote attacker could possibly use this issue to cause Unbound to consume resources, leading to a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 16.04 LTS and Ubuntu 14.04 LTS. (CVE-2023-50387)

It was discovered that Unbound incorrectly handled preparing an NSEC3 closest encloser proof. A remote attacker could possibly use this issue to cause Unbound to consume resources, leading to a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 16.04 LTS and Ubuntu 14.04 LTS. (CVE-2023-50868)