{"id":"CVE-2026-40622","aliases":["ALPINE-CVE-2026-40622","ALSA-2026:36320","ALSA-2026:36777","ALSA-2026:37282","AZL-87035","CLSA-2026-1780319730","CLSA-2026-1780477611","CLSA-2026-1780479714","CLSA-2026-1792810088","CLSA-2026-1792810562","DEBIAN-CVE-2026-40622","EUVD-2026-31080","GHSA-m3vq-fgh9-hq65","MGASA-2026-0451","OESA-2026-2606","OESA-2026-2607","OESA-2026-2608","OESA-2026-2609","RHSA-2026:20357","RHSA-2026:36320","RHSA-2026:36777","RHSA-2026:37282","RLSA-2026:36320","RLSA-2026:36777","RLSA-2026:37282","ROOT-OS-DEBIAN-11-CVE-2026-40622","SUSE-SU-2026:21874-1","SUSE-SU-2026:21913-1","SUSE-SU-2026:22160-1","SUSE-SU-2026:22213-1","SUSE-SU-2026:2281-1","SUSE-SU-2026:23050-1","SUSE-SU-2026:23215-1","SUSE-SU-2026:23226-1","SUSE-SU-2026:23349-1","SUSE-SU-2026:23360-1","SUSE-SU-2026:2369-1","SUSE-SU-2026:3885-1","UBUNTU-CVE-2026-40622","openSUSE-SU-2026:10903-1","openSUSE-SU-2026:21083-1","openSUSE-SU-2026:21550-1"],"status":"published","title":"Another 'ghost domain names' attack variant","description":"NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.","severity":{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00142,"percentile":0.03632,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-346"],"published":"2026-05-20T00:00:00Z","modified":"2026-10-29T11:32:35Z","fixes":[{"ecosystem":"Alpine:v3.22","package":"unbound","fixed_in":["1.25.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"unbound","fixed_in":["1.25.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"unbound","fixed_in":["1.25.1-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"unbound","fixed_in":["1.25.1-1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"python3-unbound","fixed_in":["1.16.2-5.el8.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"unbound","fixed_in":["1.16.2-5.el8.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"unbound-devel","fixed_in":["1.16.2-5.el8.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"unbound-libs","fixed_in":["1.16.2-5.el8.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-unbound","fixed_in":["1.16.2-19.el9_6.1.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"unbound","fixed_in":["1.16.2-19.el9_6.1.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"unbound-devel","fixed_in":["1.16.2-19.el9_6.1.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"unbound-dracut","fixed_in":["1.16.2-19.el9_6.1.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"unbound-libs","fixed_in":["1.16.2-19.el9_6.1.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"unbound","fixed_in":["1.26.1-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"unbound","fixed_in":["1.25.2-1"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"unbound","fixed_in":["1.13.1-1+deb11u7.aikido.4","1.13.1-1+deb11u7.aikido.5","1.13.1-1+deb11u7.aikido.6"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-unbound","fixed_in":["1.13.1-1+deb11u7.aikido.4","1.13.1-1+deb11u7.aikido.5","1.13.1-1+deb11u7.aikido.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"unbound","fixed_in":["1.19.2-1ubuntu3.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"unbound","fixed_in":["1.22.0-2ubuntu2.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"unbound","fixed_in":["1.24.2-1ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.22","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.2"},{"fixed":"1.25.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.2"},{"fixed":"1.25.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.2"},{"fixed":"1.25.1-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-7.el10_2.2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-7.el10_2.2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"unbound-anchor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-7.el10_2.2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-7.el10_2.2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"unbound-dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-7.el10_2.2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-7.el10_2.2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"unbound-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-7.el10_2.2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-3.el9_8.2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-3.el9_8.2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-3.el9_8.2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"unbound-dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-3.el9_8.2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-3.el9_8.2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-5.12.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-5.12.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-5.12.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-5.12.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Azure Linux:3","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.1-1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-5.el8.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-5.el8.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-5.el8.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-5.el8.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-3.el9_2.tuxcare.els6"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-3.el9_2.tuxcare.els6"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-3.el9_2.tuxcare.els6"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-3.el9_2.tuxcare.els6"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-19.el9_6.1.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-19.el9_6.1.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-19.el9_6.1.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"unbound-dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-19.el9_6.1.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-19.el9_6.1.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-5.0.1.el7_8.tuxcare.els3"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-5.0.1.el7_8.tuxcare.els3"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-5.0.1.el7_8.tuxcare.els3"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"unbound-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-5.0.1.el7_8.tuxcare.els3"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-5.0.1.el7_8.tuxcare.els3"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-5.0.1.el7_8.tuxcare.els3"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-5.0.1.el7_8.tuxcare.els3"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"unbound-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-5.0.1.el7_8.tuxcare.els3"}]}],"bundled":6},{"source":"osv","ecosystem":"Debian:12","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17.1-2","1.17.1-2+deb12u1","1.17.1-2+deb12u2","1.17.1-2+deb12u3","1.17.1-2+deb12u4","1.17.1-2+loong64","1.18.0-1","1.18.0-2","1.19.1-1","1.19.2-1","1.20.0-1","1.21.1-1","1.22.0-1","1.22.0-2","1.23.1-1","1.24.0-1","1.24.0-2","1.24.1-1","1.24.1-2","1.24.2-1","1.25.0-1","1.25.1-1","1.25.2-1","1.26.0-1","1.26.0-2","1.26.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-0+deb13u1"}]}],"versions":["1.22.0-2","1.22.0-2+deb13u1","1.22.0-2+deb13u2","1.22.0-2+deb13u3","1.23.1-1","1.24.0-1","1.24.0-2","1.24.1-1","1.24.1-2","1.24.2-1","1.25.0-1","1.25.1-1","1.25.2-1","1.26.0-1","1.26.0-2"]},{"source":"osv","ecosystem":"Debian:14","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-1"}]}],"versions":["1.22.0-2","1.23.1-1","1.24.0-1","1.24.0-2","1.24.1-1","1.24.1-2","1.24.2-1","1.25.0-1","1.25.1-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-1.mga10"}]}],"bundled":34},{"source":"osv","ecosystem":"Mageia:9","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-1.mga9"}]}],"bundled":34},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-23.oe2203sp4"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-17.oe2403sp1"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-17.oe2403sp3"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-23.oe2003sp4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.1-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.1-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-anchor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.1-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.1-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.1-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.1-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-munin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.1-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.1-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3-unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"unbound-anchor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"unbound-anchor-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"unbound-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"unbound-dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"unbound-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"unbound-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"unbound-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"unbound-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"unbound-dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"unbound-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"python3-unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"unbound-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"unbound-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.12.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.12.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.12.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.12.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.12.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.12.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.12.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.12.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:10","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.12.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Root:Debian:11","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-1+deb11u7.aikido.4"},{"fixed":"1.13.1-1+deb11u7.aikido.5"},{"fixed":"1.13.1-1+deb11u7.aikido.6"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-1+deb11u7.aikido.4"},{"fixed":"1.13.1-1+deb11u7.aikido.5"},{"fixed":"1.13.1-1+deb11u7.aikido.6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.1-160000.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.1-160000.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.1-160000.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-160000.1.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-160000.1.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-160000.1.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-160000.1.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-160000.1.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-slfo.1.1_1.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-1.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-150100.10.25.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-150100.10.25.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-150100.10.25.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-150100.10.25.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-150100.10.25.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-150100.10.25.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-150100.10.25.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-150100.10.25.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-150100.10.25.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-150600.23.19.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-150600.23.19.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-150600.23.19.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-150600.23.19.1"}]}],"bundled":18},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.22-1ubuntu6","1.5.7-1ubuntu1","1.5.7-1ubuntu2","1.5.8-1ubuntu1","1.5.8-1ubuntu1.1","1.5.8-1ubuntu1.1+esm1","1.5.8-1ubuntu1.1+esm2","1.5.8-1ubuntu1.1+esm3","1.5.8-1ubuntu1.1+esm4","1.5.8-1ubuntu1.1+esm5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-1ubuntu3.8"}]}],"versions":["1.17.1-2","1.18.0-2ubuntu1","1.18.0-2ubuntu2","1.19.1-1ubuntu1","1.19.2-1ubuntu1","1.19.2-1ubuntu3","1.19.2-1ubuntu3.1","1.19.2-1ubuntu3.2","1.19.2-1ubuntu3.3","1.19.2-1ubuntu3.4","1.19.2-1ubuntu3.5","1.19.2-1ubuntu3.6","1.19.2-1ubuntu3.7"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-2ubuntu2.3"}]}],"versions":["1.22.0-1ubuntu1","1.22.0-2ubuntu1","1.22.0-2ubuntu2","1.22.0-2ubuntu2.1","1.22.0-2ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-1ubuntu2.1"}]}],"versions":["1.22.0-2ubuntu2","1.22.0-2ubuntu4","1.24.2-1ubuntu1","1.24.2-1ubuntu2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.1-1.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.1-160000.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-160000.1.1"}]}],"bundled":24}],"products":[{"vendor":"nlnet labs","product":"unbound"},{"vendor":"nlnetlabs","product":"unbound"}],"references":[{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-40622.txt","tags":["vendor-advisory","Patch","Vendor Advisory","fix","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40622","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-m3vq-fgh9-hq65"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-40622","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36320","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-40622","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41292","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42534","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44390","tags":["report"]},{"url":"https://bugzilla.redhat.com/2480125","tags":["report"]},{"url":"https://bugzilla.redhat.com/2480130","tags":["report"]},{"url":"https://bugzilla.redhat.com/2480131","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-36320.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36777","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-36777.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37282","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-37282.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1780319730.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1780477611.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41292","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42944","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42959","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42960","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1780479714.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1792810088.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5994","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109125","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35501","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50106","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96405","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1792810562.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-40622","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0451.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36346","tags":["report"]},{"url":"https://nlnetlabs.nl/projects/unbound/security-advisories/","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2606","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32792","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42534","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42923","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44390","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2607","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44608","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2608","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2609","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20357","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32792","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42960","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42923","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_20357.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479779","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32792","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480127","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40622","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479825","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42923","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479821","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42960","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480125","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480130","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480131","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36320.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41292","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-41292.txt","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42534","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42534.txt","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44390","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-44390.txt","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36777.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_37282.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:36320","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:36777","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:37282","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621874-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1265578","tags":["report"]},{"url":"https://bugzilla.suse.com/1265580","tags":["report"]},{"url":"https://bugzilla.suse.com/1265581","tags":["report"]},{"url":"https://bugzilla.suse.com/1265582","tags":["report"]},{"url":"https://bugzilla.suse.com/1265583","tags":["report"]},{"url":"https://bugzilla.suse.com/1265584","tags":["report"]},{"url":"https://bugzilla.suse.com/1265585","tags":["report"]},{"url":"https://bugzilla.suse.com/1265586","tags":["report"]},{"url":"https://bugzilla.suse.com/1265587","tags":["report"]},{"url":"https://bugzilla.suse.com/1265588","tags":["report"]},{"url":"https://bugzilla.suse.com/1265589","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44608","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621913-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622160-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622213-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262281-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623050-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271873","tags":["report"]},{"url":"https://bugzilla.suse.com/1271874","tags":["report"]},{"url":"https://bugzilla.suse.com/1271875","tags":["report"]},{"url":"https://bugzilla.suse.com/1271876","tags":["report"]},{"url":"https://bugzilla.suse.com/1271877","tags":["report"]},{"url":"https://bugzilla.suse.com/1271878","tags":["report"]},{"url":"https://bugzilla.suse.com/1271879","tags":["report"]},{"url":"https://bugzilla.suse.com/1271880","tags":["report"]},{"url":"https://bugzilla.suse.com/1271881","tags":["report"]},{"url":"https://bugzilla.suse.com/1271882","tags":["report"]},{"url":"https://bugzilla.suse.com/1271883","tags":["report"]},{"url":"https://bugzilla.suse.com/1271884","tags":["report"]},{"url":"https://bugzilla.suse.com/1271886","tags":["report"]},{"url":"https://bugzilla.suse.com/1271887","tags":["report"]},{"url":"https://bugzilla.suse.com/1271888","tags":["report"]},{"url":"https://bugzilla.suse.com/1271889","tags":["report"]},{"url":"https://bugzilla.suse.com/1271890","tags":["report"]},{"url":"https://bugzilla.suse.com/1271891","tags":["report"]},{"url":"https://bugzilla.suse.com/1271892","tags":["report"]},{"url":"https://bugzilla.suse.com/1271893","tags":["report"]},{"url":"https://bugzilla.suse.com/1271894","tags":["report"]},{"url":"https://bugzilla.suse.com/1271895","tags":["report"]},{"url":"https://bugzilla.suse.com/1271896","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44690","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46582","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54478","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56444","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623215-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623226-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623349-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623360-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262369-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263885-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-40622","tags":["report"]},{"url":"https://nlnetlabs.nl/news/2026/May/20/unbound-1.25.1-released/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8282-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-40622","title":"Another 'ghost domain names' attack variant","description":"NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.","status":"published","published":"2026-05-20T09:18:41.816Z","modified":"2026-05-20T12:12:33.115Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber","level":"medium","assessor":"cna"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T13:43:11.445168Z"}],"euvd":[{"id":"EUVD-2026-31080","description":"NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.","status":"published","published":"2026-05-20T09:18:41Z","modified":"2026-05-20T12:12:33Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber","level":"medium"}],"updated_at":"2026-11-02T18:21:14.831553Z"}],"ghsa":[{"id":"GHSA-m3vq-fgh9-hq65","title":"NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost...","description":"NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.","status":"published","published":"2026-05-20T12:30:36Z","modified":"2026-05-26T18:31:40Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T15:08:18.132911Z"}],"nvd":[{"id":"CVE-2026-40622","description":"NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.","status":"published","published":"2026-05-20T10:16:26.85Z","modified":"2026-07-24T10:10:00.197Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T14:12:19.752984Z"}],"osv":[{"id":"ALPINE-CVE-2026-40622","description":"NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.","status":"published","published":"2026-05-20T10:16:26.85Z","modified":"2026-10-01T02:17:49.27944995Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"CVE-2026-40622","description":"NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.","status":"published","published":"2026-05-20T10:16:26.85Z","modified":"2026-10-24T14:55:06.987014692Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:03.424067Z"},{"id":"DEBIAN-CVE-2026-40622","description":"NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.","status":"published","published":"2026-05-20T10:16:26.85Z","modified":"2026-10-01T03:03:04.572093644Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"OESA-2026-2606","title":"unbound security update","description":"Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn\u0026amp;apos;t make custom builds or provide specific features to paying customers only.\r\n\r\nSecurity Fix(es):\n\nNLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service vulnerability when compiled with DNSCrypt support (\u0026apos;--enable-dnscrypt\u0026apos;). A bad DNSCrypt query could underflow Unbound\u0026apos;s DNSCrypt packet reading procedure that may lead to heap overflow. A malicious actor can exploit the vulnerability with a single bad DNSCrypt query that its decrypted plaintext consists entirely of \u0026apos;0x00\u0026apos; bytes and does not contain the expected \u0026apos;0x80\u0026apos; marker. Unbound would then start reading more bytes than necessary until it finds a non-\u0026apos;0x00\u0026apos; byte. Based on the underlying memory allocator and the memory layout, it could lead to heap overflow while reading followed by a crash. Likelihood of a crash is low, since it relies heavily on the underlying memory allocator and the memory layout. If the heap overflow does not happen, Unbound\u0026apos;s later packet checks will deny the packet. Unbound 1.25.1 contains a patch with a fix to bound reading in the given buffer space.(CVE-2026-32792)\n\nNLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the \u0026apos;ghost domain names\u0026apos; family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other \u0026apos;ghost domain names\u0026apos; attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value (\u0026apos;cache-max-ttl\u0026apos;). In configurations where \u0026apos;harden-referral-path: yes\u0026apos; is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.(CVE-2026-40622)\n\nNLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could defeat its purpose and degrade resolution performance. Retransmits of the same query could renew the age of slow running queries and not allow the jostle logic to see them as aged and potential targets for replacement with new queries. An adversary who can query a vulnerable Unbound and who can control a domain name server that replies slowly and/or maliciously to Unbound\u0026apos;s queries can exploit the vulnerability and degrade the resolution performance of Unbound. When Unbound\u0026apos;s \u0026apos;num-queries-per-thread\u0026apos; reaches its limit, the jostle logic kicks in. When a new query comes in, half of the available queries that are also slow to resolve are candidates for replacement. The vulnerability then happens because duplicate queries that need resolution would skew the aging result by using the timestamp of the latest duplicate query instead of the original one that started the resolution effort. Cache and local data response performance remains unaffected. Coordinated attacks could raise this to a denial of resolution service. Unbound 1.25.1 contains a patch with a fix to attach an initial, non-updatable start time for incoming queries that allow the jostle logic to work as intended.(CVE-2026-42534)\n\nNLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code path to consult the negative cache for DS records does not take into account the limit on NSEC3 hash calculations introduced in 1.19.1. This leads to degradation of service during the attack. An adversary that controls a DNSSEC signed zone can exploit this by signing NSEC3 records with acceptably high iterations for child delegations and querying a vulnerable Unbound. Unbound will keep performing the allowed hash calculations on the NSEC3 records and will not limit the work by the mitigation introduced in 1.19.1. As a side effect, a global lock for the negative cache will be held for the duration of the hashing, blocking other threads that need to consult the negative cache. Coordinated attacks could raise the vulnerability to denial of service. Unbound 1.25.1 contains a patch with a fix to bound the vulnerable code path with the existing limit for NSEC3 hash calculations.(CVE-2026-42923)\n\nNLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets that Unbound needs to perform name compression for. Malicious upstream responses with very large RRsets with records that don\u0026apos;t share a suffix above the root can cause Unbound to spend a considerable time applying name compression to downstream replies. This can lead to degraded performance and eventually denial of service in well orchestrated attacks. An adversary can exploit the vulnerability by querying Unbound for the specially crafted contents of a malicious zone with very large RRsets. Before Unbound replies to the query it will try to apply name compression which was an unbounded operation that could lock the CPU until the whole packet was complete. A compression limit was introduced in 1.21.1 for this but it didn\u0026apos;t account for the case where records would not share any suffix above the root. That causes Unbound to go in a different code path because of the compression tree lookup failure and eventually not increment the compression counter for those operations. Unbound 1.25.1 contains a patch with a fix that increments the compression counter regardless of the compression tree lookup. This is a complement fix to CVE-2024-8508.(CVE-2026-44390)","status":"published","published":"2026-06-05T11:11:32Z","modified":"2026-08-18T01:20:04.126877963Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2607","title":"unbound security update","description":"Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn\u0026amp;apos;t make custom builds or provide specific features to paying customers only.\r\n\r\nSecurity Fix(es):\n\nNLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service vulnerability when compiled with DNSCrypt support (\u0026apos;--enable-dnscrypt\u0026apos;). A bad DNSCrypt query could underflow Unbound\u0026apos;s DNSCrypt packet reading procedure that may lead to heap overflow. A malicious actor can exploit the vulnerability with a single bad DNSCrypt query that its decrypted plaintext consists entirely of \u0026apos;0x00\u0026apos; bytes and does not contain the expected \u0026apos;0x80\u0026apos; marker. Unbound would then start reading more bytes than necessary until it finds a non-\u0026apos;0x00\u0026apos; byte. Based on the underlying memory allocator and the memory layout, it could lead to heap overflow while reading followed by a crash. Likelihood of a crash is low, since it relies heavily on the underlying memory allocator and the memory layout. If the heap overflow does not happen, Unbound\u0026apos;s later packet checks will deny the packet. Unbound 1.25.1 contains a patch with a fix to bound reading in the given buffer space.(CVE-2026-32792)\n\nNLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the \u0026apos;ghost domain names\u0026apos; family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other \u0026apos;ghost domain names\u0026apos; attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value (\u0026apos;cache-max-ttl\u0026apos;). In configurations where \u0026apos;harden-referral-path: yes\u0026apos; is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.(CVE-2026-40622)\n\nNLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could defeat its purpose and degrade resolution performance. Retransmits of the same query could renew the age of slow running queries and not allow the jostle logic to see them as aged and potential targets for replacement with new queries. An adversary who can query a vulnerable Unbound and who can control a domain name server that replies slowly and/or maliciously to Unbound\u0026apos;s queries can exploit the vulnerability and degrade the resolution performance of Unbound. When Unbound\u0026apos;s \u0026apos;num-queries-per-thread\u0026apos; reaches its limit, the jostle logic kicks in. When a new query comes in, half of the available queries that are also slow to resolve are candidates for replacement. The vulnerability then happens because duplicate queries that need resolution would skew the aging result by using the timestamp of the latest duplicate query instead of the original one that started the resolution effort. Cache and local data response performance remains unaffected. Coordinated attacks could raise this to a denial of resolution service. Unbound 1.25.1 contains a patch with a fix to attach an initial, non-updatable start time for incoming queries that allow the jostle logic to work as intended.(CVE-2026-42534)\n\nNLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code path to consult the negative cache for DS records does not take into account the limit on NSEC3 hash calculations introduced in 1.19.1. This leads to degradation of service during the attack. An adversary that controls a DNSSEC signed zone can exploit this by signing NSEC3 records with acceptably high iterations for child delegations and querying a vulnerable Unbound. Unbound will keep performing the allowed hash calculations on the NSEC3 records and will not limit the work by the mitigation introduced in 1.19.1. As a side effect, a global lock for the negative cache will be held for the duration of the hashing, blocking other threads that need to consult the negative cache. Coordinated attacks could raise the vulnerability to denial of service. Unbound 1.25.1 contains a patch with a fix to bound the vulnerable code path with the existing limit for NSEC3 hash calculations.(CVE-2026-42923)\n\nNLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets that Unbound needs to perform name compression for. Malicious upstream responses with very large RRsets with records that don\u0026apos;t share a suffix above the root can cause Unbound to spend a considerable time applying name compression to downstream replies. This can lead to degraded performance and eventually denial of service in well orchestrated attacks. An adversary can exploit the vulnerability by querying Unbound for the specially crafted contents of a malicious zone with very large RRsets. Before Unbound replies to the query it will try to apply name compression which was an unbounded operation that could lock the CPU until the whole packet was complete. A compression limit was introduced in 1.21.1 for this but it didn\u0026apos;t account for the case where records would not share any suffix above the root. That causes Unbound to go in a different code path because of the compression tree lookup failure and eventually not increment the compression counter for those operations. Unbound 1.25.1 contains a patch with a fix that increments the compression counter regardless of the compression tree lookup. This is a complement fix to CVE-2024-8508.(CVE-2026-44390)\n\nNLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met (multi-threaded, RPZ XFR reload, RPZ zone with \u0026apos;rpz-nsip\u0026apos;/\u0026apos;rpz-nsdname\u0026apos; triggers) it could result in heap use-after-free and eventual crash. An adversary can exploit the vulnerability if conditions are first met on a vulnerable Unbound, i.e., multi-threaded, an RPZ zone with \u0026apos;rpz-nsip\u0026apos;/\u0026apos;rpz-nsdname\u0026apos; triggers and an ongoing XFR for that RPZ zone. Local RPZ files do not trigger the vulnerability. If the timing is right and an XFR happens at the same time another thread needs to read that RPZ zone, the reader may not hold the lock long enough and the thread applying the XFR may free objects that the reader is about to walk causing the use-after-free. Unbound 1.25.1 contains a patch with a fix to the locking code.(CVE-2026-44608)","status":"published","published":"2026-06-05T11:11:32Z","modified":"2026-08-18T01:20:04.133952824Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2608","title":"unbound security update","description":"Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn\u0026amp;apos;t make custom builds or provide specific features to paying customers only.\r\n\r\nSecurity Fix(es):\n\nNLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service vulnerability when compiled with DNSCrypt support (\u0026apos;--enable-dnscrypt\u0026apos;). A bad DNSCrypt query could underflow Unbound\u0026apos;s DNSCrypt packet reading procedure that may lead to heap overflow. A malicious actor can exploit the vulnerability with a single bad DNSCrypt query that its decrypted plaintext consists entirely of \u0026apos;0x00\u0026apos; bytes and does not contain the expected \u0026apos;0x80\u0026apos; marker. Unbound would then start reading more bytes than necessary until it finds a non-\u0026apos;0x00\u0026apos; byte. Based on the underlying memory allocator and the memory layout, it could lead to heap overflow while reading followed by a crash. Likelihood of a crash is low, since it relies heavily on the underlying memory allocator and the memory layout. If the heap overflow does not happen, Unbound\u0026apos;s later packet checks will deny the packet. Unbound 1.25.1 contains a patch with a fix to bound reading in the given buffer space.(CVE-2026-32792)\n\nNLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the \u0026apos;ghost domain names\u0026apos; family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other \u0026apos;ghost domain names\u0026apos; attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value (\u0026apos;cache-max-ttl\u0026apos;). In configurations where \u0026apos;harden-referral-path: yes\u0026apos; is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.(CVE-2026-40622)\n\nNLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could defeat its purpose and degrade resolution performance. Retransmits of the same query could renew the age of slow running queries and not allow the jostle logic to see them as aged and potential targets for replacement with new queries. An adversary who can query a vulnerable Unbound and who can control a domain name server that replies slowly and/or maliciously to Unbound\u0026apos;s queries can exploit the vulnerability and degrade the resolution performance of Unbound. When Unbound\u0026apos;s \u0026apos;num-queries-per-thread\u0026apos; reaches its limit, the jostle logic kicks in. When a new query comes in, half of the available queries that are also slow to resolve are candidates for replacement. The vulnerability then happens because duplicate queries that need resolution would skew the aging result by using the timestamp of the latest duplicate query instead of the original one that started the resolution effort. Cache and local data response performance remains unaffected. Coordinated attacks could raise this to a denial of resolution service. Unbound 1.25.1 contains a patch with a fix to attach an initial, non-updatable start time for incoming queries that allow the jostle logic to work as intended.(CVE-2026-42534)\n\nNLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code path to consult the negative cache for DS records does not take into account the limit on NSEC3 hash calculations introduced in 1.19.1. This leads to degradation of service during the attack. An adversary that controls a DNSSEC signed zone can exploit this by signing NSEC3 records with acceptably high iterations for child delegations and querying a vulnerable Unbound. Unbound will keep performing the allowed hash calculations on the NSEC3 records and will not limit the work by the mitigation introduced in 1.19.1. As a side effect, a global lock for the negative cache will be held for the duration of the hashing, blocking other threads that need to consult the negative cache. Coordinated attacks could raise the vulnerability to denial of service. Unbound 1.25.1 contains a patch with a fix to bound the vulnerable code path with the existing limit for NSEC3 hash calculations.(CVE-2026-42923)\n\nNLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets that Unbound needs to perform name compression for. Malicious upstream responses with very large RRsets with records that don\u0026apos;t share a suffix above the root can cause Unbound to spend a considerable time applying name compression to downstream replies. This can lead to degraded performance and eventually denial of service in well orchestrated attacks. An adversary can exploit the vulnerability by querying Unbound for the specially crafted contents of a malicious zone with very large RRsets. Before Unbound replies to the query it will try to apply name compression which was an unbounded operation that could lock the CPU until the whole packet was complete. A compression limit was introduced in 1.21.1 for this but it didn\u0026apos;t account for the case where records would not share any suffix above the root. That causes Unbound to go in a different code path because of the compression tree lookup failure and eventually not increment the compression counter for those operations. Unbound 1.25.1 contains a patch with a fix that increments the compression counter regardless of the compression tree lookup. This is a complement fix to CVE-2024-8508.(CVE-2026-44390)\n\nNLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met (multi-threaded, RPZ XFR reload, RPZ zone with \u0026apos;rpz-nsip\u0026apos;/\u0026apos;rpz-nsdname\u0026apos; triggers) it could result in heap use-after-free and eventual crash. An adversary can exploit the vulnerability if conditions are first met on a vulnerable Unbound, i.e., multi-threaded, an RPZ zone with \u0026apos;rpz-nsip\u0026apos;/\u0026apos;rpz-nsdname\u0026apos; triggers and an ongoing XFR for that RPZ zone. Local RPZ files do not trigger the vulnerability. If the timing is right and an XFR happens at the same time another thread needs to read that RPZ zone, the reader may not hold the lock long enough and the thread applying the XFR may free objects that the reader is about to walk causing the use-after-free. Unbound 1.25.1 contains a patch with a fix to the locking code.(CVE-2026-44608)","status":"published","published":"2026-06-05T11:11:33Z","modified":"2026-08-18T01:20:03.616905322Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2609","title":"unbound security update","description":"Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn\u0026amp;apos;t make custom builds or provide specific features to paying customers only.\r\n\r\nSecurity Fix(es):\n\nNLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service vulnerability when compiled with DNSCrypt support (\u0026apos;--enable-dnscrypt\u0026apos;). A bad DNSCrypt query could underflow Unbound\u0026apos;s DNSCrypt packet reading procedure that may lead to heap overflow. A malicious actor can exploit the vulnerability with a single bad DNSCrypt query that its decrypted plaintext consists entirely of \u0026apos;0x00\u0026apos; bytes and does not contain the expected \u0026apos;0x80\u0026apos; marker. Unbound would then start reading more bytes than necessary until it finds a non-\u0026apos;0x00\u0026apos; byte. Based on the underlying memory allocator and the memory layout, it could lead to heap overflow while reading followed by a crash. Likelihood of a crash is low, since it relies heavily on the underlying memory allocator and the memory layout. If the heap overflow does not happen, Unbound\u0026apos;s later packet checks will deny the packet. Unbound 1.25.1 contains a patch with a fix to bound reading in the given buffer space.(CVE-2026-32792)\n\nNLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the \u0026apos;ghost domain names\u0026apos; family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other \u0026apos;ghost domain names\u0026apos; attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value (\u0026apos;cache-max-ttl\u0026apos;). In configurations where \u0026apos;harden-referral-path: yes\u0026apos; is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.(CVE-2026-40622)\n\nNLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could defeat its purpose and degrade resolution performance. Retransmits of the same query could renew the age of slow running queries and not allow the jostle logic to see them as aged and potential targets for replacement with new queries. An adversary who can query a vulnerable Unbound and who can control a domain name server that replies slowly and/or maliciously to Unbound\u0026apos;s queries can exploit the vulnerability and degrade the resolution performance of Unbound. When Unbound\u0026apos;s \u0026apos;num-queries-per-thread\u0026apos; reaches its limit, the jostle logic kicks in. When a new query comes in, half of the available queries that are also slow to resolve are candidates for replacement. The vulnerability then happens because duplicate queries that need resolution would skew the aging result by using the timestamp of the latest duplicate query instead of the original one that started the resolution effort. Cache and local data response performance remains unaffected. Coordinated attacks could raise this to a denial of resolution service. Unbound 1.25.1 contains a patch with a fix to attach an initial, non-updatable start time for incoming queries that allow the jostle logic to work as intended.(CVE-2026-42534)\n\nNLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code path to consult the negative cache for DS records does not take into account the limit on NSEC3 hash calculations introduced in 1.19.1. This leads to degradation of service during the attack. An adversary that controls a DNSSEC signed zone can exploit this by signing NSEC3 records with acceptably high iterations for child delegations and querying a vulnerable Unbound. Unbound will keep performing the allowed hash calculations on the NSEC3 records and will not limit the work by the mitigation introduced in 1.19.1. As a side effect, a global lock for the negative cache will be held for the duration of the hashing, blocking other threads that need to consult the negative cache. Coordinated attacks could raise the vulnerability to denial of service. Unbound 1.25.1 contains a patch with a fix to bound the vulnerable code path with the existing limit for NSEC3 hash calculations.(CVE-2026-42923)\n\nNLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets that Unbound needs to perform name compression for. Malicious upstream responses with very large RRsets with records that don\u0026apos;t share a suffix above the root can cause Unbound to spend a considerable time applying name compression to downstream replies. This can lead to degraded performance and eventually denial of service in well orchestrated attacks. An adversary can exploit the vulnerability by querying Unbound for the specially crafted contents of a malicious zone with very large RRsets. Before Unbound replies to the query it will try to apply name compression which was an unbounded operation that could lock the CPU until the whole packet was complete. A compression limit was introduced in 1.21.1 for this but it didn\u0026apos;t account for the case where records would not share any suffix above the root. That causes Unbound to go in a different code path because of the compression tree lookup failure and eventually not increment the compression counter for those operations. Unbound 1.25.1 contains a patch with a fix that increments the compression counter regardless of the compression tree lookup. This is a complement fix to CVE-2024-8508.(CVE-2026-44390)","status":"published","published":"2026-06-05T11:11:33Z","modified":"2026-08-18T01:20:03.811068824Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"RHSA-2026:20357","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-05-28T10:07:20Z","modified":"2026-10-09T10:21:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:36320","title":"Red Hat Security Advisory: unbound security update","status":"published","published":"2026-07-29T10:09:15Z","modified":"2026-10-19T10:03:44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:36777","title":"Red Hat Security Advisory: unbound security update","status":"published","published":"2026-07-29T10:09:23Z","modified":"2026-10-19T10:03:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:37282","title":"Red Hat Security Advisory: unbound security update","status":"published","published":"2026-07-29T10:09:30Z","modified":"2026-10-19T10:03:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RLSA-2026:36320","title":"Important: unbound security update","description":"The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. \n\nSecurity Fix(es):\n\n* unbound: Unbound: Denial of Service via excessive EDNS options (CVE-2026-41292)\n\n* unbound: Unbound: Cache manipulation via 'ghost domain names' attack (CVE-2026-40622)\n\n* unbound: Unbound: Denial of Service due to excessive resource consumption with large DNS Resource Record Sets (CVE-2026-44390)\n\n* unbound: Unbound: Denial of Service due to degraded resolution performance in jostle logic (CVE-2026-42534)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-28T18:05:53.08241Z","modified":"2026-07-28T18:25:47.231544227Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:36777","title":"Important: unbound security update","description":"The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. \n\nSecurity Fix(es):\n\n* unbound: Unbound: Denial of Service via excessive EDNS options (CVE-2026-41292)\n\n* unbound: Unbound: Cache manipulation via 'ghost domain names' attack (CVE-2026-40622)\n\n* unbound: Unbound: Denial of Service due to excessive resource consumption with large DNS Resource Record Sets (CVE-2026-44390)\n\n* unbound: Unbound: Denial of Service due to degraded resolution performance in jostle logic (CVE-2026-42534)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-28T18:03:31.892523Z","modified":"2026-07-28T18:26:06.31890597Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:37282","title":"Important: unbound security update","description":"The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. \n\nSecurity Fix(es):\n\n* unbound: Unbound: Denial of Service via excessive EDNS options (CVE-2026-41292)\n\n* unbound: Unbound: Cache manipulation via 'ghost domain names' attack (CVE-2026-40622)\n\n* unbound: Unbound: Denial of Service due to excessive resource consumption with large DNS Resource Record Sets (CVE-2026-44390)\n\n* unbound: Unbound: Denial of Service due to degraded resolution performance in jostle logic (CVE-2026-42534)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-28T18:01:06.552042Z","modified":"2026-07-28T18:25:45.235286098Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-40622","title":"CVE-2026-40622 in unbound - Patched by Root","description":"Root has patched CVE-2026-40622 in the unbound package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-31T09:51:41Z","modified":"2026-08-31T11:30:05.012441737Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:29.900552Z"},{"id":"UBUNTU-CVE-2026-40622","description":"NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.","status":"published","published":"2026-05-20T00:00:00Z","modified":"2026-10-21T16:30:58.339106229Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:16.686388Z"},{"id":"ALSA-2026:36320","title":"Important: unbound security update","description":"The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.   \n\nSecurity Fix(es):  \n\n  * unbound: Unbound: Denial of Service via excessive EDNS options (CVE-2026-41292)\n  * unbound: Unbound: Cache manipulation via 'ghost domain names' attack (CVE-2026-40622)\n  * unbound: Unbound: Denial of Service due to excessive resource consumption with large DNS Resource Record Sets (CVE-2026-44390)\n  * unbound: Unbound: Denial of Service due to degraded resolution performance in jostle logic (CVE-2026-42534)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-07T00:00:00Z","modified":"2026-10-29T11:30:29.721254961Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:36777","title":"Important: unbound security update","description":"The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.   \n\nSecurity Fix(es):  \n\n  * unbound: Unbound: Denial of Service via excessive EDNS options (CVE-2026-41292)\n  * unbound: Unbound: Cache manipulation via 'ghost domain names' attack (CVE-2026-40622)\n  * unbound: Unbound: Denial of Service due to excessive resource consumption with large DNS Resource Record Sets (CVE-2026-44390)\n  * unbound: Unbound: Denial of Service due to degraded resolution performance in jostle logic (CVE-2026-42534)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-08T00:00:00Z","modified":"2026-10-29T11:32:35.786590204Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:37282","title":"Important: unbound security update","description":"The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.   \n\nSecurity Fix(es):  \n\n  * unbound: Unbound: Denial of Service via excessive EDNS options (CVE-2026-41292)\n  * unbound: Unbound: Cache manipulation via 'ghost domain names' attack (CVE-2026-40622)\n  * unbound: Unbound: Denial of Service due to excessive resource consumption with large DNS Resource Record Sets (CVE-2026-44390)\n  * unbound: Unbound: Denial of Service due to degraded resolution performance in jostle logic (CVE-2026-42534)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-09T00:00:00Z","modified":"2026-10-29T11:02:24.403105167Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"AZL-87035","title":"CVE-2026-40622 affecting package unbound for versions less than 1.25.1-1","description":"NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.","status":"published","published":"2026-05-20T10:16:26Z","modified":"2026-08-28T17:56:20.573184Z","updated_at":"2026-11-02T15:28:10.677811Z"},{"id":"CLSA-2026-1780319730","title":"unbound: Fix of CVE-2026-40622","description":"- CVE-2026-40622: clamp NS RRset TTL to the cached value in the\n  higher-trust branch of need_to_update_rrset() to prevent the\n  \"ghost domain\" variant where an attacker-controlled higher-trust\n  NS response revives a revoked delegation.","status":"published","published":"2026-06-01T13:15:51Z","modified":"2026-10-26T09:31:37.553376009Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1780477611","title":"unbound: Fix of 5 CVEs","description":"- CVE-2026-42960: prevent cache poisoning via promiscuous additional-section\n  records by marking glue only for NS RRsets in the authority section\n  [ELSCVE-130594]\n- CVE-2026-42944: fix heap overflow and crash with multiple NSID and PADDING\n  EDNS options by deduplicating options and adding bounds checks in\n  attach_edns_record_max_msg_sz [ELSCVE-130649]\n- CVE-2026-41292: cap parsed EDNS options at MAX_PARSED_EDNS_OPTIONS (100)\n  to prevent DoS via long option lists [ELSCVE-130636]\n- CVE-2026-42959: fix out-of-bounds write in val_fill_reply by indexing the\n  destination array with chase-\u003ens_numrrsets instead of orig-\u003ens_numrrsets\n  [ELSCVE-130615]\n- CVE-2026-40622: prevent ghost-domain TTL extension by clamping newd-\u003ettl\n  to cached-\u003ettl in the higher-trust branch of need_to_update_rrset\n  [ELSCVE-129354]","status":"published","published":"2026-06-03T09:07:07Z","modified":"2026-10-26T09:43:51.124851166Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1780479714","title":"unbound: Fix of CVE-2026-40622","description":"- CVE-2026-40622: clamp NS RRset TTL to the cached value in the\n  higher-trust branch of need_to_update_rrset() to prevent the\n  \"ghost domain\" variant where an attacker-controlled higher-trust\n  NS response revives a revoked delegation.","status":"published","published":"2026-06-03T09:42:06Z","modified":"2026-10-26T09:31:05.642653178Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1792810088","title":"unbound: Fix of 6 CVEs","description":"- CVE-2025-5994: do not cache non-ECS answers to ECS queries in the subnet cache (Rebirthday attack)\n- CVE-2026-40622: limit the TTL of a higher-trust NS rrset replacing a cached delegation (ghost domain)\n- CVE-2026-50106: treat an unsigned parent denial of an island trust anchor as bogus\n- CVE-2026-96405: add a per-packet budget for name decompression pointers\n- CVE-2026-109125: clear pending queries on a port when the unwanted-reply threshold is hit\n- CVE-2026-35501: fix NSEC-not-at-apex parent-side key lookup for island trust anchors","status":"published","published":"2026-10-24T02:48:24Z","modified":"2026-10-26T09:43:45.650812372Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792810562","title":"unbound: Fix of 6 CVEs","description":"- CVE-2025-5994: do not cache non-ECS answers to ECS queries in the subnet cache (Rebirthday attack)\n- CVE-2026-40622: limit the TTL of a higher-trust NS rrset replacing a cached delegation (ghost domain)\n- CVE-2026-50106: treat an unsigned parent denial of an island trust anchor as bogus\n- CVE-2026-96405: add a per-packet budget for name decompression pointers\n- CVE-2026-109125: clear pending queries on a port when the unwanted-reply threshold is hit\n- CVE-2026-35501: fix NSEC-not-at-apex parent-side key lookup for island trust anchors","status":"published","published":"2026-10-24T02:56:17Z","modified":"2026-10-26T09:43:42.33157517Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"MGASA-2026-0451","title":"Updated unbound packages fixes security vulnerabilities","description":"Heap buffer overflow and possible Remote Code Execution when digesting\nDNSKEY\nPossible heap buffer overflow during DNSSEC canonicalization\nCNAME synthesis could lead to heap corruption\nPossible ZONEMD verification bypass window\nUse-after-free in DoQ stream output buffer on reset re-transmission\nPossible degradation of service from continuous queries on the same\nTCP/DoT connection\nUse-after-free in DoH stream cleanup code path\nRetrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks\non DNSSEC\n'serve-expired' can bypass Unbound 'wait-limit'\nRemote DNS-over-QUIC denial of service due to 'quic-size' budget bypass\nPacket of death for DNSCrypt over TCP\nCross-zone wildcard cache poisoning via RRSIG.labels manipulation\n'dns-error-reporting: yes' leads to stack buffer overflow\nAssertion in libngtcp2 when under pressure in high concurrency\nDNS-over-QUIC environments\nLibunbound applications configured with 'unwanted-reply-threshold' could\neventually be abruptly terminated\n'max-global-quota' reset by DNSSEC validation restarts\nPossible heap use-after-free in an error path when a DoT forwarded query\nis jostled out\n'response-ip'/'rpz' can rewrite BOGUS answers instead of returning\nSERVFAIL\nBOGUS configured primary hostname accepted for XFR in auth/rpz zones\nDate:\nAttacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache\nflush\nPossible cache poisoning attack by mapping source port population per\nthread\nMemory corruption could lead to crash and denial of service\n'serve-expired-client-timeout' and 'response-ip' CNAME redirect could\nlead to a crash\nPacket of death for a DNSCrypt misconfigured Unbound\nRemote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2\nPossible heap buffer overflow when validator canonicalizes RDATA that\ncontains domain name\nDegradation of resolution service when 'discard-timeout' and\n'serve-expired-client-timeout' are combined in unusual configuration\nDegradation of resolution service from improperly accounted\nclient-terminated DNS-over-QUIC queries\nExtra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records\ndisallowing a one-time 'ghost domain' delegation renewal via glue\nrecords\nOff-by-one error in 'harden-below-nxdomain' logic can shadow a\nstub/forward zone by a legitimate parent's NXDOMAIN\nA wildcard replay, as another piece of data, triggers poisoning in the\nserve expired reply path\nDNS Cookie bypass when combined with proxy-protocol use\nPrivacy/configuration issue when adding local data in views through\n'unbound-control'\nPossible arbitrary code execution during DNSSEC validation\nHeap overflow with multiple NSID, COOKIE, PADDING EDNS options\nCrash during DNSSEC validation of malicious content\nDate:\nPacket of death with DNSCrypt\nAnother \"ghost domain names\" attack variant\nLong list of incoming EDNS options degrades performance\nJostle logic bypass degrades resolution performance\nDegradation of service with unbounded NSEC3 hash calculations\nPossible cache poisoning via promiscuous records for the authority\nsection\nUnbounded name compression in certain cases causes degradation of\nservice\nUse after free and crash under special conditions in RPZ code\nPossible domain hijacking via promiscuous records in the authority\nsection\nCache poisoning via the ECS-enabled Rebirthday Attack\nUnbounded name compression could lead to Denial of Service\nUnbound vulnerable to the \"DNSBomb\" pulsing DoS amplification attack\nDenial of service when trimming EDE text on positive replies\nDNSSEC verification complexity can be exploited to exhaust CPU resources\nand stall DNS resolvers\nNSEC3 closest encloser proof can exhaust CPU\nNon-Responsive Delegation Attack\nNovel \"ghost domain names\" attack by updating almost expired delegation\ninformation\nNovel \"ghost domain names\" attack by introducing subdomain delegations\nLocal symlink attack\nVulnerability in Domain Parse\nNXNSAttack\nVulnerability in IPSEC module\nVulnerability in parsing NOTIFY queries\nVulnerability in the processing of wildcard synthesized NSEC records\nNo limit to delegation chaining\nGhost domain names attack\nIncorrect proof processing for NSEC3-signed zone\nProcessing of duplicate CNAME records in a signed zone\nEmpty error packet handling assertion failure\n","status":"published","published":"2026-09-25T05:02:40Z","modified":"2026-09-25T05:15:03.49547618Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:10903-1","title":"libunbound8-1.25.1-1.1 on GA media","description":"These are all security issues fixed in the libunbound8-1.25.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-29T00:00:00Z","modified":"2026-05-30T23:15:04.972448969Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21083-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues\n\n- CVE-2026-32792: Packet of death with DNSCrypt (bsc#1265583).\n- CVE-2026-33278: Possible remote code execution during DNSSEC validation (bsc#1265587).\n- CVE-2026-40622: \"Ghost domain name\" variant (bsc#1265581).\n- CVE-2026-41292: Parsing a long list of incoming EDNS options degrades performance (bsc#1265580).\n- CVE-2026-42534: Jostle logic bypass degrades resolution performance (bsc#1265585).\n- CVE-2026-42923: Degradation of service with unbounded NSEC3 hash calculations (bsc#1265589).\n- CVE-2026-42944: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (bsc#1265578).\n- CVE-2026-42959: Crash during DNSSEC validation of malicious content (bsc#1265586).\n- CVE-2026-42960: Possible cache poisoning attack while following delegation (bsc#1265588).\n- CVE-2026-44390: Unbounded name compression in certain cases causes degradation of service (bsc#1265584).\n- CVE-2026-44608: Use after free and crash in RPZ code (bsc#1265582).\n","status":"published","published":"2026-06-18T14:31:02Z","modified":"2026-06-30T18:24:39.695528292Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21550-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\nUpdate to version 1.25.2.\n\nSecurity issues fixed:\n\n- CVE-2026-14586: DoS via assertion in `libngtcp2` for DNS-over-QUIC environments with high concurrency (bsc#1271879).\n- CVE-2026-32665: Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass (bsc#1271873).\n- CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).\n- CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries\n  (bsc#1271891).\n- CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records\n  (bsc#1271892).\n- CVE-2026-44621: Libunbound applications configured with `unwanted-reply-threshold` could eventually be abruptly\n  terminated (bsc#1271876).\n- CVE-2026-44687: Off-by-one error in `harden-below-nxdomain` logic can shadow a stub/forward zone by a legitimate\n  parent's `NXDOMAIN` (bsc#1271893).\n- CVE-2026-44690: Cross-zone wildcard cache poisoning via `RRSIG.labels` manipulation (bsc#1271877).\n- CVE-2026-46582: Replay of a wildcard `rrset` as another piece of data triggers poisoning in the server expired reply\n  path (bsc#1271894).\n- CVE-2026-50045: `max-global-quota` bypass via single client queries for a deeply nested name under a DNSSEC-signed\n  parent (bsc#1271878).\n- CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).\n- CVE-2026-50243: `response-ip`/`rpz` can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).\n- CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).\n- CVE-2026-50251: Attacker supplied `0.0.0.0`/`::` glue triggers defensive full-cache flush (bsc#1271883).\n- CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).\n- CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with `answer-cookie:yes` is used (bsc#1271895).\n- CVE-2026-55708: Privacy/configuration issue when adding local data in views through `unbound-control` (bsc#1271896).\n- CVE-2026-55717: `serve-expired-client-timeout` and `response-ip` CNAME redirect could lead to a crash (bsc#1271886).\n- CVE-2026-55973: DoS due to stack overflow triggered crash when `dns-error-reporting: yes` is set (bsc#1271874).\n- CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).\n- CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in `libngtcp2` (bsc#1271888).\n- CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name\n  (bsc#1271889).\n- CVE-2026-56444: Degradation of resolution service when `discard-timeout` and `serve-expired-client-timeout` are\n  combined in unusual configuration (bsc#1271890).\n\nOther updates and bugfixes:\n\n- Version 1.25.2:\n  + Features:\n    * TTL behavior changes: cached records reaching TTL 0 are expired;\n      TTL 0 upstream answers are no longer cached by cachedb;\n      serve-expired-reply-ttl is now capped by the original TTL value;\n      TTL decoding updated to adhere to RFC 8767 section 4\n    * Add new statistics: num.queries.replyaddr_limit and\n      requestlist.current.replies\n    * Add 'log-thread-id' configuration option to log the system-wide\n      Linux thread ID for easier debugging\n    * Add ECC-GOST12 support per RFC 9558 (available as\n      contrib/gost12.patch)\n    * Allow synthesized DNAME TTL=0 to be served from cache within a\n      1-second grace period, reducing recursion for TTL=0 DNAMEs\n      (RFC 2308)\n    * Fix DoT/DoH/DoQ to reload certificates on config reload without\n      requiring a full restart; fast_reload now supports changes to\n      tls-service-key, tls-service-pem and tls-cert-bundle\n    * Allow ip@port notation in control-interface configuration\n    * Add iter-scrub-rrsig option (default: 8) to limit the number of\n      RRSIGs processed by the scrubber\n    * Add 'tls-protocols' configuration option to select which TLS\n      protocol versions are used; TLSv1.2 is re-enabled by default\n    * Add pthread_setname_np support for named threads\n  + Bug Fixes:\n    * Fix handle leak in pythonmod on pythonmod_init\n    * Fix crash when mesh_detect_cycle_found() is called with no mesh\n      state\n    * Fix modstack_call_init to use the original string when it has\n      changed\n    * Fix fr_atomic_copy_cfg\n    * Fix auth-zone empty label for $ORIGIN when downloading via HTTP\n    * Fix respip and dns64 to be usable simultaneously; RPZ now works\n      with DNS64\n    * Fix HTTPS and QUIC not being enabled when port is listed in\n      interface-automatic-ports\n    * Allow wait-limit-cookie: 0 to disable cookie-validated wait limits\n    * Fix FIPS mode in OpenSSL causing unit test failure\n    * Fix discard-timeout to only drop UDP, not stream connections\n    * Reply with SERVFAIL when the wait-limit is exceeded\n    * Add extended DNS error code for invalid query type\n    * Replace deprecated SWIG $function with $action\n    * Log a warning for possible circular dependency when using hostnames\n      in stub/forward zones\n    * Fix infra cache for NAT64 by moving NAT64 synthesis to the\n      delegation point when adding target addresses\n    * Fix discard-timeout packet accounting in the mesh area\n    * Update IANA portlist\n    * Copy DNSTAP configuration from daemon to workers after fast_reload\n    * Fix HTTP/2 stream mesh state removal and drop handling for\n      postpone_drop and send failures\n    * Log THROWAWAY and (DNSSEC) LAME responses with clearer\n      categorization in log output\n    * Fix EDE removal logic consistency between encoding errors and\n      encoding replies\n    * Fix EDNS subnet scope-zero queries not being stored when\n      forward-no-cache or stub-no-cache is set\n    * Do not initialize quic_table unless QUIC is enabled\n    * Fix fast_reload to copy iter_scrub_ns, iter_scrub_cname and\n      max_global_quota options\n    * Fix allow-notify entries with hostnames to be copied after\n      IPv4/IPv6 lookup; fix skipping hostname lookups when only URLs\n      are configured\n    * Fix NAT64 inconsistency with do-not-query-address during retries\n    * Fix cachedb aggressive negative responses not setting the RA flag\n    * Fix root key priming failure after loading RPZ zones containing\n      ZONEMD RRtype\n    * Fix local-zone always_refuse to also block DS queries\n    * Fix cache lookup/store in external cachedb when forwarder/stub\n      uses the no-cache option\n    * Fix cachedb returning expired bogus data as non-bogus\n    * Fix validator unchecked state handling with validation recursion\n      and EDNS subnet\n    * Fix DNAME lookup flag and assertion in expired calculation debug\n      routine\n    * Fix DNS rebinding bypass via SVCB/HTTPS records; private-address\n      now also elides SVCB and HTTPS records matching the filter\n    * Warn for unused 'nodefault' local-zone configuration in\n      unbound-checkconf\n    * Fix lock/unlock for view in memory error handling\n    * Apply cache TTL policy to DNAME and synthesized CNAME on the\n      wire path\n    * Fix detection of HTTP listening port in fast_reload\n    * Fix ignoring out-of-zone DNAME records for CNAME synthesis\n    * Fix invalid HTTP content length/chunk size checks and RR rdata\n      field length validation in zone transfer, preventing heap\n      buffer-overflow read errors\n    * Fix defense in depth for service callback with empty packet\n    * Fix shared memory statistics with threads\n    * Fix EDNS client subnet to not store SERVFAIL in the global cache\n      after a failed lookup; stores a short-lived failure entry in the\n      subnet cache instead\n    * Fix memory corruption related core dumps when alloc_reg_obtain\n      encounters an empty list\n    * Fix RFC 7766 compliance when client sends EOF over TCP\n    * Fix DoH session cleanup when the same query appears on multiple\n      streams\n    * Fix TLS context setup for tls-service-pem\n    * Fix TTL comparisons in rdata_copy for 32-bit signed/unsigned values\n    * Fix memory leak in subnet SERVFAIL store\n    * Fix for the Jiggle Attack: server now answers errors for error\n      cases and no longer reflects parts of the incoming query\n    * Fix EDNS extended RCODE reflection: server no longer echoes\n      extended RCODE values after CHAOS class queries\n    * Fix iterator RCODE handling of YXDOMAIN: only accept YXDOMAIN\n      answers that contain a DNAME record\n    * Fix missing bounds check when decompressing dnames for downloaded\n      authority zones, preventing malformed content from truncated AXFR\n      packets\n    * Fix upstream TLS connections being reused for different names at\n      the same IP address\n    * Fix to disallow signatures with revoked DNSKEYs\n    * Fix DNAME with unsigned CNAME to check for the correct match,\n      preventing certain zone configurations from granting secure status\n      to unchecked CNAMEs\n    * Fix wildcard CNAME handling in the chain of trust\n    * Fix buffer overrun in doq_repinfo_retrieve_localaddr()\n  + Packaging changes:\n    * Update keyring to new NLnet Labs release signing key\n","status":"published","published":"2026-08-10T15:27:28Z","modified":"2026-08-12T18:23:41.681356663Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:21874-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues\n\n- CVE-2026-32792: Packet of death with DNSCrypt (bsc#1265583).\n- CVE-2026-33278: Possible remote code execution during DNSSEC validation (bsc#1265587).\n- CVE-2026-40622: \"Ghost domain name\" variant (bsc#1265581).\n- CVE-2026-41292: Parsing a long list of incoming EDNS options degrades performance (bsc#1265580).\n- CVE-2026-42534: Jostle logic bypass degrades resolution performance (bsc#1265585).\n- CVE-2026-42923: Degradation of service with unbounded NSEC3 hash calculations (bsc#1265589).\n- CVE-2026-42944: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (bsc#1265578).\n- CVE-2026-42959: Crash during DNSSEC validation of malicious content (bsc#1265586).\n- CVE-2026-42960: Possible cache poisoning attack while following delegation (bsc#1265588).\n- CVE-2026-44390: Unbounded name compression in certain cases causes degradation of service (bsc#1265584).\n- CVE-2026-44608: Use after free and crash in RPZ code (bsc#1265582).\n","status":"published","published":"2026-05-28T15:02:16Z","modified":"2026-06-03T18:24:40.564601272Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:21913-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues\n\n- CVE-2026-32792: Packet of death with DNSCrypt (bsc#1265583).\n- CVE-2026-33278: Possible remote code execution during DNSSEC validation (bsc#1265587).\n- CVE-2026-40622: \"Ghost domain name\" variant (bsc#1265581).\n- CVE-2026-41292: Parsing a long list of incoming EDNS options degrades performance (bsc#1265580).\n- CVE-2026-42534: Jostle logic bypass degrades resolution performance (bsc#1265585).\n- CVE-2026-42923: Degradation of service with unbounded NSEC3 hash calculations (bsc#1265589).\n- CVE-2026-42944: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (bsc#1265578).\n- CVE-2026-42959: Crash during DNSSEC validation of malicious content (bsc#1265586).\n- CVE-2026-42960: Possible cache poisoning attack while following delegation (bsc#1265588).\n- CVE-2026-44390: Unbounded name compression in certain cases causes degradation of service (bsc#1265584).\n- CVE-2026-44608: Use after free and crash in RPZ code (bsc#1265582).\n","status":"published","published":"2026-05-28T15:44:30Z","modified":"2026-06-03T18:24:42.175264098Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22160-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues\n\n- CVE-2026-32792: Packet of death with DNSCrypt (bsc#1265583).\n- CVE-2026-33278: Possible remote code execution during DNSSEC validation (bsc#1265587).\n- CVE-2026-40622: \"Ghost domain name\" variant (bsc#1265581).\n- CVE-2026-41292: Parsing a long list of incoming EDNS options degrades performance (bsc#1265580).\n- CVE-2026-42534: Jostle logic bypass degrades resolution performance (bsc#1265585).\n- CVE-2026-42923: Degradation of service with unbounded NSEC3 hash calculations (bsc#1265589).\n- CVE-2026-42944: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (bsc#1265578).\n- CVE-2026-42959: Crash during DNSSEC validation of malicious content (bsc#1265586).\n- CVE-2026-42960: Possible cache poisoning attack while following delegation (bsc#1265588).\n- CVE-2026-44390: Unbounded name compression in certain cases causes degradation of service (bsc#1265584).\n- CVE-2026-44608: Use after free and crash in RPZ code (bsc#1265582).\n","status":"published","published":"2026-06-18T14:32:33Z","modified":"2026-06-24T18:24:22.663727238Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22213-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues\n\n- CVE-2026-32792: Packet of death with DNSCrypt (bsc#1265583).\n- CVE-2026-33278: Possible remote code execution during DNSSEC validation (bsc#1265587).\n- CVE-2026-40622: \"Ghost domain name\" variant (bsc#1265581).\n- CVE-2026-41292: Parsing a long list of incoming EDNS options degrades performance (bsc#1265580).\n- CVE-2026-42534: Jostle logic bypass degrades resolution performance (bsc#1265585).\n- CVE-2026-42923: Degradation of service with unbounded NSEC3 hash calculations (bsc#1265589).\n- CVE-2026-42944: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (bsc#1265578).\n- CVE-2026-42959: Crash during DNSSEC validation of malicious content (bsc#1265586).\n- CVE-2026-42960: Possible cache poisoning attack while following delegation (bsc#1265588).\n- CVE-2026-44390: Unbounded name compression in certain cases causes degradation of service (bsc#1265584).\n- CVE-2026-44608: Use after free and crash in RPZ code (bsc#1265582).\n","status":"published","published":"2026-06-18T14:32:33Z","modified":"2026-06-24T18:24:19.459020557Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:2281-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues\n\n- CVE-2026-32792: Packet of death with DNSCrypt (bsc#1265583).\n- CVE-2026-33278: Possible remote code execution during DNSSEC validation (bsc#1265587).\n- CVE-2026-40622: 'Ghost domain name' variant (bsc#1265581).\n- CVE-2026-41292: Parsing a long list of incoming EDNS options degrades performance (bsc#1265580).\n- CVE-2026-42534: Jostle logic bypass degrades resolution performance (bsc#1265585).\n- CVE-2026-42923: Degradation of service with unbounded NSEC3 hash calculations (bsc#1265589).\n- CVE-2026-42944: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (bsc#1265578).\n- CVE-2026-42959: Crash during DNSSEC validation of malicious content (bsc#1265586).\n- CVE-2026-42960: Possible cache poisoning attack while following delegation (bsc#1265588).\n- CVE-2026-44390: Unbounded name compression in certain cases causes degradation of service (bsc#1265584).\n- CVE-2026-44608: Use after free and crash in RPZ code (bsc#1265582).\n","status":"published","published":"2026-06-05T12:12:47Z","modified":"2026-06-06T07:30:23.75179719Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:23050-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\nUpdate to version 1.25.2.\n\nSecurity issues fixed:\n\n- CVE-2026-14586: DoS via assertion in `libngtcp2` for DNS-over-QUIC environments with high concurrency (bsc#1271879).\n- CVE-2026-32665: Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass (bsc#1271873).\n- CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).\n- CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries\n  (bsc#1271891).\n- CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records\n  (bsc#1271892).\n- CVE-2026-44621: Libunbound applications configured with `unwanted-reply-threshold` could eventually be abruptly\n  terminated (bsc#1271876).\n- CVE-2026-44687: Off-by-one error in `harden-below-nxdomain` logic can shadow a stub/forward zone by a legitimate\n  parent's `NXDOMAIN` (bsc#1271893).\n- CVE-2026-44690: Cross-zone wildcard cache poisoning via `RRSIG.labels` manipulation (bsc#1271877).\n- CVE-2026-46582: Replay of a wildcard `rrset` as another piece of data triggers poisoning in the server expired reply\n  path (bsc#1271894).\n- CVE-2026-50045: `max-global-quota` bypass via single client queries for a deeply nested name under a DNSSEC-signed\n  parent (bsc#1271878).\n- CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).\n- CVE-2026-50243: `response-ip`/`rpz` can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).\n- CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).\n- CVE-2026-50251: Attacker supplied `0.0.0.0`/`::` glue triggers defensive full-cache flush (bsc#1271883).\n- CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).\n- CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with `answer-cookie:yes` is used (bsc#1271895).\n- CVE-2026-55708: Privacy/configuration issue when adding local data in views through `unbound-control` (bsc#1271896).\n- CVE-2026-55717: `serve-expired-client-timeout` and `response-ip` CNAME redirect could lead to a crash (bsc#1271886).\n- CVE-2026-55973: DoS due to stack overflow triggered crash when `dns-error-reporting: yes` is set (bsc#1271874).\n- CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).\n- CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in `libngtcp2` (bsc#1271888).\n- CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name\n  (bsc#1271889).\n- CVE-2026-56444: Degradation of resolution service when `discard-timeout` and `serve-expired-client-timeout` are\n  combined in unusual configuration (bsc#1271890).\n\nOther updates and bugfixes:\n\n- Version 1.25.2:\n  + Features:\n    * TTL behavior changes: cached records reaching TTL 0 are expired;\n      TTL 0 upstream answers are no longer cached by cachedb;\n      serve-expired-reply-ttl is now capped by the original TTL value;\n      TTL decoding updated to adhere to RFC 8767 section 4\n    * Add new statistics: num.queries.replyaddr_limit and\n      requestlist.current.replies\n    * Add 'log-thread-id' configuration option to log the system-wide\n      Linux thread ID for easier debugging\n    * Add ECC-GOST12 support per RFC 9558 (available as\n      contrib/gost12.patch)\n    * Allow synthesized DNAME TTL=0 to be served from cache within a\n      1-second grace period, reducing recursion for TTL=0 DNAMEs\n      (RFC 2308)\n    * Fix DoT/DoH/DoQ to reload certificates on config reload without\n      requiring a full restart; fast_reload now supports changes to\n      tls-service-key, tls-service-pem and tls-cert-bundle\n    * Allow ip@port notation in control-interface configuration\n    * Add iter-scrub-rrsig option (default: 8) to limit the number of\n      RRSIGs processed by the scrubber\n    * Add 'tls-protocols' configuration option to select which TLS\n      protocol versions are used; TLSv1.2 is re-enabled by default\n    * Add pthread_setname_np support for named threads\n  + Bug Fixes:\n    * Fix handle leak in pythonmod on pythonmod_init\n    * Fix crash when mesh_detect_cycle_found() is called with no mesh\n      state\n    * Fix modstack_call_init to use the original string when it has\n      changed\n    * Fix fr_atomic_copy_cfg\n    * Fix auth-zone empty label for $ORIGIN when downloading via HTTP\n    * Fix respip and dns64 to be usable simultaneously; RPZ now works\n      with DNS64\n    * Fix HTTPS and QUIC not being enabled when port is listed in\n      interface-automatic-ports\n    * Allow wait-limit-cookie: 0 to disable cookie-validated wait limits\n    * Fix FIPS mode in OpenSSL causing unit test failure\n    * Fix discard-timeout to only drop UDP, not stream connections\n    * Reply with SERVFAIL when the wait-limit is exceeded\n    * Add extended DNS error code for invalid query type\n    * Replace deprecated SWIG $function with $action\n    * Log a warning for possible circular dependency when using hostnames\n      in stub/forward zones\n    * Fix infra cache for NAT64 by moving NAT64 synthesis to the\n      delegation point when adding target addresses\n    * Fix discard-timeout packet accounting in the mesh area\n    * Update IANA portlist\n    * Copy DNSTAP configuration from daemon to workers after fast_reload\n    * Fix HTTP/2 stream mesh state removal and drop handling for\n      postpone_drop and send failures\n    * Log THROWAWAY and (DNSSEC) LAME responses with clearer\n      categorization in log output\n    * Fix EDE removal logic consistency between encoding errors and\n      encoding replies\n    * Fix EDNS subnet scope-zero queries not being stored when\n      forward-no-cache or stub-no-cache is set\n    * Do not initialize quic_table unless QUIC is enabled\n    * Fix fast_reload to copy iter_scrub_ns, iter_scrub_cname and\n      max_global_quota options\n    * Fix allow-notify entries with hostnames to be copied after\n      IPv4/IPv6 lookup; fix skipping hostname lookups when only URLs\n      are configured\n    * Fix NAT64 inconsistency with do-not-query-address during retries\n    * Fix cachedb aggressive negative responses not setting the RA flag\n    * Fix root key priming failure after loading RPZ zones containing\n      ZONEMD RRtype\n    * Fix local-zone always_refuse to also block DS queries\n    * Fix cache lookup/store in external cachedb when forwarder/stub\n      uses the no-cache option\n    * Fix cachedb returning expired bogus data as non-bogus\n    * Fix validator unchecked state handling with validation recursion\n      and EDNS subnet\n    * Fix DNAME lookup flag and assertion in expired calculation debug\n      routine\n    * Fix DNS rebinding bypass via SVCB/HTTPS records; private-address\n      now also elides SVCB and HTTPS records matching the filter\n    * Warn for unused 'nodefault' local-zone configuration in\n      unbound-checkconf\n    * Fix lock/unlock for view in memory error handling\n    * Apply cache TTL policy to DNAME and synthesized CNAME on the\n      wire path\n    * Fix detection of HTTP listening port in fast_reload\n    * Fix ignoring out-of-zone DNAME records for CNAME synthesis\n    * Fix invalid HTTP content length/chunk size checks and RR rdata\n      field length validation in zone transfer, preventing heap\n      buffer-overflow read errors\n    * Fix defense in depth for service callback with empty packet\n    * Fix shared memory statistics with threads\n    * Fix EDNS client subnet to not store SERVFAIL in the global cache\n      after a failed lookup; stores a short-lived failure entry in the\n      subnet cache instead\n    * Fix memory corruption related core dumps when alloc_reg_obtain\n      encounters an empty list\n    * Fix RFC 7766 compliance when client sends EOF over TCP\n    * Fix DoH session cleanup when the same query appears on multiple\n      streams\n    * Fix TLS context setup for tls-service-pem\n    * Fix TTL comparisons in rdata_copy for 32-bit signed/unsigned values\n    * Fix memory leak in subnet SERVFAIL store\n    * Fix for the Jiggle Attack: server now answers errors for error\n      cases and no longer reflects parts of the incoming query\n    * Fix EDNS extended RCODE reflection: server no longer echoes\n      extended RCODE values after CHAOS class queries\n    * Fix iterator RCODE handling of YXDOMAIN: only accept YXDOMAIN\n      answers that contain a DNAME record\n    * Fix missing bounds check when decompressing dnames for downloaded\n      authority zones, preventing malformed content from truncated AXFR\n      packets\n    * Fix upstream TLS connections being reused for different names at\n      the same IP address\n    * Fix to disallow signatures with revoked DNSKEYs\n    * Fix DNAME with unsigned CNAME to check for the correct match,\n      preventing certain zone configurations from granting secure status\n      to unchecked CNAMEs\n    * Fix wildcard CNAME handling in the chain of trust\n    * Fix buffer overrun in doq_repinfo_retrieve_localaddr()\n  + Packaging changes:\n    * Update keyring to new NLnet Labs release signing key\n","status":"published","published":"2026-08-10T15:26:22Z","modified":"2026-08-12T10:45:03.439161172Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23215-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\nUpdate to version 1.25.2.\n\nSecurity issues fixed:\n\n- CVE-2026-14586: DoS via assertion in `libngtcp2` for DNS-over-QUIC environments with high concurrency (bsc#1271879).\n- CVE-2026-32665: Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass (bsc#1271873).\n- CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).\n- CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries\n  (bsc#1271891).\n- CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records\n  (bsc#1271892).\n- CVE-2026-44621: Libunbound applications configured with `unwanted-reply-threshold` could eventually be abruptly\n  terminated (bsc#1271876).\n- CVE-2026-44687: Off-by-one error in `harden-below-nxdomain` logic can shadow a stub/forward zone by a legitimate\n  parent's `NXDOMAIN` (bsc#1271893).\n- CVE-2026-44690: Cross-zone wildcard cache poisoning via `RRSIG.labels` manipulation (bsc#1271877).\n- CVE-2026-46582: Replay of a wildcard `rrset` as another piece of data triggers poisoning in the server expired reply\n  path (bsc#1271894).\n- CVE-2026-50045: `max-global-quota` bypass via single client queries for a deeply nested name under a DNSSEC-signed\n  parent (bsc#1271878).\n- CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).\n- CVE-2026-50243: `response-ip`/`rpz` can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).\n- CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).\n- CVE-2026-50251: Attacker supplied `0.0.0.0`/`::` glue triggers defensive full-cache flush (bsc#1271883).\n- CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).\n- CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with `answer-cookie:yes` is used (bsc#1271895).\n- CVE-2026-55708: Privacy/configuration issue when adding local data in views through `unbound-control` (bsc#1271896).\n- CVE-2026-55717: `serve-expired-client-timeout` and `response-ip` CNAME redirect could lead to a crash (bsc#1271886).\n- CVE-2026-55973: DoS due to stack overflow triggered crash when `dns-error-reporting: yes` is set (bsc#1271874).\n- CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).\n- CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in `libngtcp2` (bsc#1271888).\n- CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name\n  (bsc#1271889).\n- CVE-2026-56444: Degradation of resolution service when `discard-timeout` and `serve-expired-client-timeout` are\n  combined in unusual configuration (bsc#1271890).\n\nOther updates and bugfixes:\n\n- Version 1.25.2:\n  + Features:\n    * TTL behavior changes: cached records reaching TTL 0 are expired;\n      TTL 0 upstream answers are no longer cached by cachedb;\n      serve-expired-reply-ttl is now capped by the original TTL value;\n      TTL decoding updated to adhere to RFC 8767 section 4\n    * Add new statistics: num.queries.replyaddr_limit and\n      requestlist.current.replies\n    * Add 'log-thread-id' configuration option to log the system-wide\n      Linux thread ID for easier debugging\n    * Add ECC-GOST12 support per RFC 9558 (available as\n      contrib/gost12.patch)\n    * Allow synthesized DNAME TTL=0 to be served from cache within a\n      1-second grace period, reducing recursion for TTL=0 DNAMEs\n      (RFC 2308)\n    * Fix DoT/DoH/DoQ to reload certificates on config reload without\n      requiring a full restart; fast_reload now supports changes to\n      tls-service-key, tls-service-pem and tls-cert-bundle\n    * Allow ip@port notation in control-interface configuration\n    * Add iter-scrub-rrsig option (default: 8) to limit the number of\n      RRSIGs processed by the scrubber\n    * Add 'tls-protocols' configuration option to select which TLS\n      protocol versions are used; TLSv1.2 is re-enabled by default\n    * Add pthread_setname_np support for named threads\n  + Bug Fixes:\n    * Fix handle leak in pythonmod on pythonmod_init\n    * Fix crash when mesh_detect_cycle_found() is called with no mesh\n      state\n    * Fix modstack_call_init to use the original string when it has\n      changed\n    * Fix fr_atomic_copy_cfg\n    * Fix auth-zone empty label for $ORIGIN when downloading via HTTP\n    * Fix respip and dns64 to be usable simultaneously; RPZ now works\n      with DNS64\n    * Fix HTTPS and QUIC not being enabled when port is listed in\n      interface-automatic-ports\n    * Allow wait-limit-cookie: 0 to disable cookie-validated wait limits\n    * Fix FIPS mode in OpenSSL causing unit test failure\n    * Fix discard-timeout to only drop UDP, not stream connections\n    * Reply with SERVFAIL when the wait-limit is exceeded\n    * Add extended DNS error code for invalid query type\n    * Replace deprecated SWIG $function with $action\n    * Log a warning for possible circular dependency when using hostnames\n      in stub/forward zones\n    * Fix infra cache for NAT64 by moving NAT64 synthesis to the\n      delegation point when adding target addresses\n    * Fix discard-timeout packet accounting in the mesh area\n    * Update IANA portlist\n    * Copy DNSTAP configuration from daemon to workers after fast_reload\n    * Fix HTTP/2 stream mesh state removal and drop handling for\n      postpone_drop and send failures\n    * Log THROWAWAY and (DNSSEC) LAME responses with clearer\n      categorization in log output\n    * Fix EDE removal logic consistency between encoding errors and\n      encoding replies\n    * Fix EDNS subnet scope-zero queries not being stored when\n      forward-no-cache or stub-no-cache is set\n    * Do not initialize quic_table unless QUIC is enabled\n    * Fix fast_reload to copy iter_scrub_ns, iter_scrub_cname and\n      max_global_quota options\n    * Fix allow-notify entries with hostnames to be copied after\n      IPv4/IPv6 lookup; fix skipping hostname lookups when only URLs\n      are configured\n    * Fix NAT64 inconsistency with do-not-query-address during retries\n    * Fix cachedb aggressive negative responses not setting the RA flag\n    * Fix root key priming failure after loading RPZ zones containing\n      ZONEMD RRtype\n    * Fix local-zone always_refuse to also block DS queries\n    * Fix cache lookup/store in external cachedb when forwarder/stub\n      uses the no-cache option\n    * Fix cachedb returning expired bogus data as non-bogus\n    * Fix validator unchecked state handling with validation recursion\n      and EDNS subnet\n    * Fix DNAME lookup flag and assertion in expired calculation debug\n      routine\n    * Fix DNS rebinding bypass via SVCB/HTTPS records; private-address\n      now also elides SVCB and HTTPS records matching the filter\n    * Warn for unused 'nodefault' local-zone configuration in\n      unbound-checkconf\n    * Fix lock/unlock for view in memory error handling\n    * Apply cache TTL policy to DNAME and synthesized CNAME on the\n      wire path\n    * Fix detection of HTTP listening port in fast_reload\n    * Fix ignoring out-of-zone DNAME records for CNAME synthesis\n    * Fix invalid HTTP content length/chunk size checks and RR rdata\n      field length validation in zone transfer, preventing heap\n      buffer-overflow read errors\n    * Fix defense in depth for service callback with empty packet\n    * Fix shared memory statistics with threads\n    * Fix EDNS client subnet to not store SERVFAIL in the global cache\n      after a failed lookup; stores a short-lived failure entry in the\n      subnet cache instead\n    * Fix memory corruption related core dumps when alloc_reg_obtain\n      encounters an empty list\n    * Fix RFC 7766 compliance when client sends EOF over TCP\n    * Fix DoH session cleanup when the same query appears on multiple\n      streams\n    * Fix TLS context setup for tls-service-pem\n    * Fix TTL comparisons in rdata_copy for 32-bit signed/unsigned values\n    * Fix memory leak in subnet SERVFAIL store\n    * Fix for the Jiggle Attack: server now answers errors for error\n      cases and no longer reflects parts of the incoming query\n    * Fix EDNS extended RCODE reflection: server no longer echoes\n      extended RCODE values after CHAOS class queries\n    * Fix iterator RCODE handling of YXDOMAIN: only accept YXDOMAIN\n      answers that contain a DNAME record\n    * Fix missing bounds check when decompressing dnames for downloaded\n      authority zones, preventing malformed content from truncated AXFR\n      packets\n    * Fix upstream TLS connections being reused for different names at\n      the same IP address\n    * Fix to disallow signatures with revoked DNSKEYs\n    * Fix DNAME with unsigned CNAME to check for the correct match,\n      preventing certain zone configurations from granting secure status\n      to unchecked CNAMEs\n    * Fix wildcard CNAME handling in the chain of trust\n    * Fix buffer overrun in doq_repinfo_retrieve_localaddr()\n  + Packaging changes:\n    * Update keyring to new NLnet Labs release signing key\n","status":"published","published":"2026-08-10T15:26:22Z","modified":"2026-08-27T18:23:09.188902083Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23226-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\nUpdate to version 1.25.2.\n\nSecurity issues fixed:\n\n- CVE-2026-14586: DoS via assertion in `libngtcp2` for DNS-over-QUIC environments with high concurrency (bsc#1271879).\n- CVE-2026-32665: Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass (bsc#1271873).\n- CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).\n- CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries\n  (bsc#1271891).\n- CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records\n  (bsc#1271892).\n- CVE-2026-44621: Libunbound applications configured with `unwanted-reply-threshold` could eventually be abruptly\n  terminated (bsc#1271876).\n- CVE-2026-44687: Off-by-one error in `harden-below-nxdomain` logic can shadow a stub/forward zone by a legitimate\n  parent's `NXDOMAIN` (bsc#1271893).\n- CVE-2026-44690: Cross-zone wildcard cache poisoning via `RRSIG.labels` manipulation (bsc#1271877).\n- CVE-2026-46582: Replay of a wildcard `rrset` as another piece of data triggers poisoning in the server expired reply\n  path (bsc#1271894).\n- CVE-2026-50045: `max-global-quota` bypass via single client queries for a deeply nested name under a DNSSEC-signed\n  parent (bsc#1271878).\n- CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).\n- CVE-2026-50243: `response-ip`/`rpz` can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).\n- CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).\n- CVE-2026-50251: Attacker supplied `0.0.0.0`/`::` glue triggers defensive full-cache flush (bsc#1271883).\n- CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).\n- CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with `answer-cookie:yes` is used (bsc#1271895).\n- CVE-2026-55708: Privacy/configuration issue when adding local data in views through `unbound-control` (bsc#1271896).\n- CVE-2026-55717: `serve-expired-client-timeout` and `response-ip` CNAME redirect could lead to a crash (bsc#1271886).\n- CVE-2026-55973: DoS due to stack overflow triggered crash when `dns-error-reporting: yes` is set (bsc#1271874).\n- CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).\n- CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in `libngtcp2` (bsc#1271888).\n- CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name\n  (bsc#1271889).\n- CVE-2026-56444: Degradation of resolution service when `discard-timeout` and `serve-expired-client-timeout` are\n  combined in unusual configuration (bsc#1271890).\n\nOther updates and bugfixes:\n\n- Version 1.25.2:\n  + Features:\n    * TTL behavior changes: cached records reaching TTL 0 are expired;\n      TTL 0 upstream answers are no longer cached by cachedb;\n      serve-expired-reply-ttl is now capped by the original TTL value;\n      TTL decoding updated to adhere to RFC 8767 section 4\n    * Add new statistics: num.queries.replyaddr_limit and\n      requestlist.current.replies\n    * Add 'log-thread-id' configuration option to log the system-wide\n      Linux thread ID for easier debugging\n    * Add ECC-GOST12 support per RFC 9558 (available as\n      contrib/gost12.patch)\n    * Allow synthesized DNAME TTL=0 to be served from cache within a\n      1-second grace period, reducing recursion for TTL=0 DNAMEs\n      (RFC 2308)\n    * Fix DoT/DoH/DoQ to reload certificates on config reload without\n      requiring a full restart; fast_reload now supports changes to\n      tls-service-key, tls-service-pem and tls-cert-bundle\n    * Allow ip@port notation in control-interface configuration\n    * Add iter-scrub-rrsig option (default: 8) to limit the number of\n      RRSIGs processed by the scrubber\n    * Add 'tls-protocols' configuration option to select which TLS\n      protocol versions are used; TLSv1.2 is re-enabled by default\n    * Add pthread_setname_np support for named threads\n  + Bug Fixes:\n    * Fix handle leak in pythonmod on pythonmod_init\n    * Fix crash when mesh_detect_cycle_found() is called with no mesh\n      state\n    * Fix modstack_call_init to use the original string when it has\n      changed\n    * Fix fr_atomic_copy_cfg\n    * Fix auth-zone empty label for $ORIGIN when downloading via HTTP\n    * Fix respip and dns64 to be usable simultaneously; RPZ now works\n      with DNS64\n    * Fix HTTPS and QUIC not being enabled when port is listed in\n      interface-automatic-ports\n    * Allow wait-limit-cookie: 0 to disable cookie-validated wait limits\n    * Fix FIPS mode in OpenSSL causing unit test failure\n    * Fix discard-timeout to only drop UDP, not stream connections\n    * Reply with SERVFAIL when the wait-limit is exceeded\n    * Add extended DNS error code for invalid query type\n    * Replace deprecated SWIG $function with $action\n    * Log a warning for possible circular dependency when using hostnames\n      in stub/forward zones\n    * Fix infra cache for NAT64 by moving NAT64 synthesis to the\n      delegation point when adding target addresses\n    * Fix discard-timeout packet accounting in the mesh area\n    * Update IANA portlist\n    * Copy DNSTAP configuration from daemon to workers after fast_reload\n    * Fix HTTP/2 stream mesh state removal and drop handling for\n      postpone_drop and send failures\n    * Log THROWAWAY and (DNSSEC) LAME responses with clearer\n      categorization in log output\n    * Fix EDE removal logic consistency between encoding errors and\n      encoding replies\n    * Fix EDNS subnet scope-zero queries not being stored when\n      forward-no-cache or stub-no-cache is set\n    * Do not initialize quic_table unless QUIC is enabled\n    * Fix fast_reload to copy iter_scrub_ns, iter_scrub_cname and\n      max_global_quota options\n    * Fix allow-notify entries with hostnames to be copied after\n      IPv4/IPv6 lookup; fix skipping hostname lookups when only URLs\n      are configured\n    * Fix NAT64 inconsistency with do-not-query-address during retries\n    * Fix cachedb aggressive negative responses not setting the RA flag\n    * Fix root key priming failure after loading RPZ zones containing\n      ZONEMD RRtype\n    * Fix local-zone always_refuse to also block DS queries\n    * Fix cache lookup/store in external cachedb when forwarder/stub\n      uses the no-cache option\n    * Fix cachedb returning expired bogus data as non-bogus\n    * Fix validator unchecked state handling with validation recursion\n      and EDNS subnet\n    * Fix DNAME lookup flag and assertion in expired calculation debug\n      routine\n    * Fix DNS rebinding bypass via SVCB/HTTPS records; private-address\n      now also elides SVCB and HTTPS records matching the filter\n    * Warn for unused 'nodefault' local-zone configuration in\n      unbound-checkconf\n    * Fix lock/unlock for view in memory error handling\n    * Apply cache TTL policy to DNAME and synthesized CNAME on the\n      wire path\n    * Fix detection of HTTP listening port in fast_reload\n    * Fix ignoring out-of-zone DNAME records for CNAME synthesis\n    * Fix invalid HTTP content length/chunk size checks and RR rdata\n      field length validation in zone transfer, preventing heap\n      buffer-overflow read errors\n    * Fix defense in depth for service callback with empty packet\n    * Fix shared memory statistics with threads\n    * Fix EDNS client subnet to not store SERVFAIL in the global cache\n      after a failed lookup; stores a short-lived failure entry in the\n      subnet cache instead\n    * Fix memory corruption related core dumps when alloc_reg_obtain\n      encounters an empty list\n    * Fix RFC 7766 compliance when client sends EOF over TCP\n    * Fix DoH session cleanup when the same query appears on multiple\n      streams\n    * Fix TLS context setup for tls-service-pem\n    * Fix TTL comparisons in rdata_copy for 32-bit signed/unsigned values\n    * Fix memory leak in subnet SERVFAIL store\n    * Fix for the Jiggle Attack: server now answers errors for error\n      cases and no longer reflects parts of the incoming query\n    * Fix EDNS extended RCODE reflection: server no longer echoes\n      extended RCODE values after CHAOS class queries\n    * Fix iterator RCODE handling of YXDOMAIN: only accept YXDOMAIN\n      answers that contain a DNAME record\n    * Fix missing bounds check when decompressing dnames for downloaded\n      authority zones, preventing malformed content from truncated AXFR\n      packets\n    * Fix upstream TLS connections being reused for different names at\n      the same IP address\n    * Fix to disallow signatures with revoked DNSKEYs\n    * Fix DNAME with unsigned CNAME to check for the correct match,\n      preventing certain zone configurations from granting secure status\n      to unchecked CNAMEs\n    * Fix wildcard CNAME handling in the chain of trust\n    * Fix buffer overrun in doq_repinfo_retrieve_localaddr()\n  + Packaging changes:\n    * Update keyring to new NLnet Labs release signing key\n","status":"published","published":"2026-08-10T15:26:22Z","modified":"2026-08-27T18:23:10.17349122Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23349-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\nUpdate to version 1.25.2.\n\nSecurity issues fixed:\n\n- CVE-2026-14586: DoS via assertion in `libngtcp2` for DNS-over-QUIC environments with high concurrency (bsc#1271879).\n- CVE-2026-32665: Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass (bsc#1271873).\n- CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).\n- CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries\n  (bsc#1271891).\n- CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records\n  (bsc#1271892).\n- CVE-2026-44621: Libunbound applications configured with `unwanted-reply-threshold` could eventually be abruptly\n  terminated (bsc#1271876).\n- CVE-2026-44687: Off-by-one error in `harden-below-nxdomain` logic can shadow a stub/forward zone by a legitimate\n  parent's `NXDOMAIN` (bsc#1271893).\n- CVE-2026-44690: Cross-zone wildcard cache poisoning via `RRSIG.labels` manipulation (bsc#1271877).\n- CVE-2026-46582: Replay of a wildcard `rrset` as another piece of data triggers poisoning in the server expired reply\n  path (bsc#1271894).\n- CVE-2026-50045: `max-global-quota` bypass via single client queries for a deeply nested name under a DNSSEC-signed\n  parent (bsc#1271878).\n- CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).\n- CVE-2026-50243: `response-ip`/`rpz` can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).\n- CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).\n- CVE-2026-50251: Attacker supplied `0.0.0.0`/`::` glue triggers defensive full-cache flush (bsc#1271883).\n- CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).\n- CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with `answer-cookie:yes` is used (bsc#1271895).\n- CVE-2026-55708: Privacy/configuration issue when adding local data in views through `unbound-control` (bsc#1271896).\n- CVE-2026-55717: `serve-expired-client-timeout` and `response-ip` CNAME redirect could lead to a crash (bsc#1271886).\n- CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).\n- CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in `libngtcp2` (bsc#1271888).\n- CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name\n  (bsc#1271889).\n- CVE-2026-56444: Degradation of resolution service when `discard-timeout` and `serve-expired-client-timeout` are\n  combined in unusual configuration (bsc#1271890).\n\nOther updates and bugfixes:\n\n- Version 1.25.2:\n  * For a complete list of additional changes see the changelog at https://nlnetlabs.nl/projects/unbound/download/.\n- Update `unbound.keyring`.\n","status":"published","published":"2026-08-26T14:24:09Z","modified":"2026-09-10T18:23:12.453750666Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23360-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\nUpdate to version 1.25.2.\n\nSecurity issues fixed:\n\n- CVE-2026-14586: DoS via assertion in `libngtcp2` for DNS-over-QUIC environments with high concurrency (bsc#1271879).\n- CVE-2026-32665: Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass (bsc#1271873).\n- CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).\n- CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries\n  (bsc#1271891).\n- CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records\n  (bsc#1271892).\n- CVE-2026-44621: Libunbound applications configured with `unwanted-reply-threshold` could eventually be abruptly\n  terminated (bsc#1271876).\n- CVE-2026-44687: Off-by-one error in `harden-below-nxdomain` logic can shadow a stub/forward zone by a legitimate\n  parent's `NXDOMAIN` (bsc#1271893).\n- CVE-2026-44690: Cross-zone wildcard cache poisoning via `RRSIG.labels` manipulation (bsc#1271877).\n- CVE-2026-46582: Replay of a wildcard `rrset` as another piece of data triggers poisoning in the server expired reply\n  path (bsc#1271894).\n- CVE-2026-50045: `max-global-quota` bypass via single client queries for a deeply nested name under a DNSSEC-signed\n  parent (bsc#1271878).\n- CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).\n- CVE-2026-50243: `response-ip`/`rpz` can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).\n- CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).\n- CVE-2026-50251: Attacker supplied `0.0.0.0`/`::` glue triggers defensive full-cache flush (bsc#1271883).\n- CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).\n- CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with `answer-cookie:yes` is used (bsc#1271895).\n- CVE-2026-55708: Privacy/configuration issue when adding local data in views through `unbound-control` (bsc#1271896).\n- CVE-2026-55717: `serve-expired-client-timeout` and `response-ip` CNAME redirect could lead to a crash (bsc#1271886).\n- CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).\n- CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in `libngtcp2` (bsc#1271888).\n- CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name\n  (bsc#1271889).\n- CVE-2026-56444: Degradation of resolution service when `discard-timeout` and `serve-expired-client-timeout` are\n  combined in unusual configuration (bsc#1271890).\n\nOther updates and bugfixes:\n\n- Version 1.25.2:\n  * For a complete list of additional changes see the changelog at https://nlnetlabs.nl/projects/unbound/download/.\n- Update `unbound.keyring`.\n","status":"published","published":"2026-08-26T14:27:41Z","modified":"2026-09-10T18:23:12.60275904Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:2369-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues\n\n- CVE-2026-32792: Packet of death with DNSCrypt (bsc#1265583).\n- CVE-2026-33278: Possible remote code execution during DNSSEC validation (bsc#1265587).\n- CVE-2026-40622: 'Ghost domain name' variant (bsc#1265581).\n- CVE-2026-41292: Parsing a long list of incoming EDNS options degrades performance (bsc#1265580).\n- CVE-2026-42534: Jostle logic bypass degrades resolution performance (bsc#1265585).\n- CVE-2026-42923: Degradation of service with unbounded NSEC3 hash calculations (bsc#1265589).\n- CVE-2026-42944: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (bsc#1265578).\n- CVE-2026-42959: Crash during DNSSEC validation of malicious content (bsc#1265586).\n- CVE-2026-42960: Possible cache poisoning attack while following delegation (bsc#1265588).\n- CVE-2026-44390: Unbounded name compression in certain cases causes degradation of service (bsc#1265584).\n- CVE-2026-44608: Use after free and crash in RPZ code (bsc#1265582).\n","status":"published","published":"2026-06-11T12:22:51Z","modified":"2026-06-12T08:45:05.869322394Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:3885-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\nUpdate to version 1.25.2.\n\nSecurity issues fixed:\n\n- CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).\n- CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records\n  (bsc#1271892).\n- CVE-2026-44621: Libunbound applications configured with `unwanted-reply-threshold` could eventually be abruptly\n  terminated (bsc#1271876).\n- CVE-2026-44687: Off-by-one error in `harden-below-nxdomain` logic can shadow a stub/forward zone by a legitimate\n  parent's `NXDOMAIN` (bsc#1271893).\n- CVE-2026-44690: Cross-zone wildcard cache poisoning via `RRSIG.labels` manipulation (bsc#1271877).\n- CVE-2026-46582: Replay of a wildcard `rrset` as another piece of data triggers poisoning in the server expired reply\n  path (bsc#1271894).\n- CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).\n- CVE-2026-50243: `response-ip`/`rpz` can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).\n- CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).\n- CVE-2026-50251: Attacker supplied `0.0.0.0`/`::` glue triggers defensive full-cache flush (bsc#1271883).\n- CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).\n- CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with `answer-cookie:yes` is used (bsc#1271895).\n- CVE-2026-55708: Privacy/configuration issue when adding local data in views through `unbound-control` (bsc#1271896).\n- CVE-2026-55717: `serve-expired-client-timeout` and `response-ip` CNAME redirect could lead to a crash (bsc#1271886).\n- CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).\n- CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name\n  (bsc#1271889).\n- CVE-2026-56444: Degradation of resolution service when `discard-timeout` and `serve-expired-client-timeout` are\n  combined in unusual configuration (bsc#1271890).\n\nOther updates and bugfixes:\n\n- Version 1.25.2:\n  * For a complete list of additional changes see the changelog at https://nlnetlabs.nl/projects/unbound/download/\n- Update `unbound.keyring`.\n","status":"published","published":"2026-08-31T14:34:37Z","modified":"2026-09-10T18:23:45.222190322Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}