{"id":"CVE-2026-44690","aliases":["ALPINE-CVE-2026-44690","ALSA-2026:55784","ALSA-2026:55841","ALSA-2026:55892","AZL-92931","CLSA-2026-1785490706","DEBIAN-CVE-2026-44690","EUVD-2026-47669","GHSA-jwg4-375h-655h","MGASA-2026-0316","MGASA-2026-0451","OESA-2026-3333","OESA-2026-3334","OESA-2026-3335","OESA-2026-3336","OESA-2026-3436","RHSA-2026:43588","RHSA-2026:55784","RHSA-2026:55841","RHSA-2026:55892","RLSA-2026:55784","RLSA-2026:55841","RLSA-2026:55892","ROOT-OS-DEBIAN-11-CVE-2026-44690","ROOT-OS-DEBIAN-12-CVE-2026-44690","ROOT-OS-DEBIAN-13-CVE-2026-44690","SUSE-SU-2026:23050-1","SUSE-SU-2026:23215-1","SUSE-SU-2026:23226-1","SUSE-SU-2026:23349-1","SUSE-SU-2026:23360-1","SUSE-SU-2026:3884-1","SUSE-SU-2026:3885-1","UBUNTU-CVE-2026-44690","USN-8946-1","openSUSE-SU-2026:11380-1","openSUSE-SU-2026:21550-1"],"status":"published","title":"Cross-zone wildcard cache poisoning via RRSIG.labels manipulation","description":"In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone). Arbitrary delegations that do not exist under the parent domain and are covered by the parent's NSEC chain can be brought into insecure existence by fraudulent wildcard DS records (less labels than expected, unknown algorithm) from the malicious sibling domain. This allows the malicious actor to inject insecure wildcard records for those delegations.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00153,"percentile":0.04469,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-345"],"published":"2026-07-22T13:06:56Z","modified":"2026-10-29T11:32:36Z","fixes":[{"ecosystem":"Alpine:v3.22","package":"unbound","fixed_in":["1.25.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"unbound","fixed_in":["1.25.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"unbound","fixed_in":["1.25.2-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"python3-unbound","fixed_in":["1.16.2-5.14.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"unbound","fixed_in":["1.16.2-5.14.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"unbound-devel","fixed_in":["1.16.2-5.14.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"unbound-libs","fixed_in":["1.16.2-5.14.el8_10"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"unbound","fixed_in":["1.25.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"unbound","fixed_in":["1.26.1-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"unbound","fixed_in":["1.25.2-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-unbound","fixed_in":["0:1.16.2-5.14.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-unbound-debuginfo","fixed_in":["0:1.16.2-5.14.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound","fixed_in":["0:1.16.2-5.14.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-debuginfo","fixed_in":["0:1.16.2-5.14.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-debugsource","fixed_in":["0:1.16.2-5.14.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-devel","fixed_in":["0:1.16.2-5.14.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-libs","fixed_in":["0:1.16.2-5.14.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-libs-debuginfo","fixed_in":["0:1.16.2-5.14.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"unbound","fixed_in":["0:1.16.2-5.14.el8_10"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"unbound","fixed_in":["1.13.1-1+deb11u7.aikido.3","1.13.1-1+deb11u7.aikido.4","1.13.1-1+deb11u7.aikido.5","1.13.1-1+deb11u7.aikido.6"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-unbound","fixed_in":["1.13.1-1+deb11u7.aikido.3","1.13.1-1+deb11u7.aikido.4","1.13.1-1+deb11u7.aikido.5","1.13.1-1+deb11u7.aikido.6"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"unbound","fixed_in":["1.17.1-2+deb12u4.aikido.2","1.17.1-2+deb12u4.aikido.3","1.17.1-2+deb12u4.aikido.4","1.17.1-2+deb12u4.aikido.5"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-unbound","fixed_in":["1.17.1-2+deb12u4.aikido.2","1.17.1-2+deb12u4.aikido.3","1.17.1-2+deb12u4.aikido.4","1.17.1-2+deb12u4.aikido.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"unbound","fixed_in":["1.9.4-2ubuntu1.11+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"unbound","fixed_in":["1.13.1-1ubuntu5.17"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"unbound","fixed_in":["1.19.2-1ubuntu3.12"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"unbound","fixed_in":["1.24.2-1ubuntu2.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.22","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.0"},{"fixed":"1.25.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.0"},{"fixed":"1.25.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.0"},{"fixed":"1.25.2-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-5.14.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-5.14.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-5.14.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-5.14.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-3.el9_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-3.el9_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-3.el9_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"unbound-dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-3.el9_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-3.el9_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-7.el10_2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-7.el10_2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"unbound-anchor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-7.el10_2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-7.el10_2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"unbound-dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-7.el10_2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-7.el10_2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"unbound-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-7.el10_2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:3","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-19.el9_6.1.tuxcare.els11"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-19.el9_6.1.tuxcare.els11"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-19.el9_6.1.tuxcare.els11"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"unbound-dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-19.el9_6.1.tuxcare.els11"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-19.el9_6.1.tuxcare.els11"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17.1-2","1.17.1-2+deb12u1","1.17.1-2+deb12u2","1.17.1-2+deb12u3","1.17.1-2+deb12u4","1.17.1-2+loong64","1.18.0-1","1.18.0-2","1.19.1-1","1.19.2-1","1.20.0-1","1.21.1-1","1.22.0-1","1.22.0-2","1.23.1-1","1.24.0-1","1.24.0-2","1.24.1-1","1.24.1-2","1.24.2-1","1.25.0-1","1.25.1-1","1.25.2-1","1.26.0-1","1.26.0-2","1.26.1-1","1.26.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-0+deb13u1"}]}],"versions":["1.22.0-2","1.22.0-2+deb13u1","1.22.0-2+deb13u2","1.22.0-2+deb13u3","1.23.1-1","1.24.0-1","1.24.0-2","1.24.1-1","1.24.1-2","1.24.2-1","1.25.0-1","1.25.1-1","1.25.2-1","1.26.0-1","1.26.0-2"]},{"source":"osv","ecosystem":"Debian:14","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-1"}]}],"versions":["1.22.0-2","1.23.1-1","1.24.0-1","1.24.0-2","1.24.1-1","1.24.1-2","1.24.2-1","1.25.0-1","1.25.1-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-1.mga10"}]}],"bundled":24},{"source":"osv","ecosystem":"Mageia:9","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-1.mga9"}]}],"bundled":24},{"source":"osv","ecosystem":"Mageia:10","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-1.mga10"}]}],"bundled":34},{"source":"osv","ecosystem":"Mageia:9","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-1.mga9"}]}],"bundled":34},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-25.oe2203sp4"}]}],"bundled":10},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-19.oe2403sp1"}]}],"bundled":11},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-19.oe2403sp3"}]}],"bundled":11},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-25.oe2003sp4"}]}],"bundled":10},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-20.oe2403sp4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.2-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.2-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-anchor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.2-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.2-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.2-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.2-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-munin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.2-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.2-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.14.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.14.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.14.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.14.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.14.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.14.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.14.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.14.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"unbound-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"unbound-dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"unbound-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"python3-unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"unbound-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"unbound-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3-unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"unbound-anchor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"unbound-anchor-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"unbound-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"unbound-dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"unbound-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"unbound-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"unbound-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.14.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:Debian:11","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-1+deb11u7.aikido.3"},{"fixed":"1.13.1-1+deb11u7.aikido.4"},{"fixed":"1.13.1-1+deb11u7.aikido.5"},{"fixed":"1.13.1-1+deb11u7.aikido.6"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-1+deb11u7.aikido.3"},{"fixed":"1.13.1-1+deb11u7.aikido.4"},{"fixed":"1.13.1-1+deb11u7.aikido.5"},{"fixed":"1.13.1-1+deb11u7.aikido.6"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-2+deb12u4.aikido.2"},{"fixed":"1.17.1-2+deb12u4.aikido.3"},{"fixed":"1.17.1-2+deb12u4.aikido.4"},{"fixed":"1.17.1-2+deb12u4.aikido.5"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-2+deb12u4.aikido.2"},{"fixed":"1.17.1-2+deb12u4.aikido.3"},{"fixed":"1.17.1-2+deb12u4.aikido.4"},{"fixed":"1.17.1-2+deb12u4.aikido.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-160000.1.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-160000.1.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-160000.1.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-160000.1.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-160000.1.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-slfo.1.1_1.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-1.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-150100.10.28.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-150100.10.28.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-150100.10.28.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-150100.10.28.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-150100.10.28.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-150100.10.28.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-150100.10.28.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-150100.10.28.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-150100.10.28.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-150600.23.19.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-150600.23.19.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-150600.23.19.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-150600.23.19.1"}]}],"bundled":18},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-2ubuntu1.11+esm3"}]}],"versions":["1.9.0-2ubuntu1","1.9.0-2ubuntu2","1.9.4-2","1.9.4-2ubuntu1","1.9.4-2ubuntu1.1","1.9.4-2ubuntu1.2","1.9.4-2ubuntu1.3","1.9.4-2ubuntu1.4","1.9.4-2ubuntu1.5","1.9.4-2ubuntu1.6","1.9.4-2ubuntu1.8","1.9.4-2ubuntu1.9","1.9.4-2ubuntu1.11","1.9.4-2ubuntu1.11+esm1","1.9.4-2ubuntu1.11+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-1ubuntu5.17"}]}],"versions":["1.13.1-1ubuntu1","1.13.1-1ubuntu3","1.13.1-1ubuntu5","1.13.1-1ubuntu5.1","1.13.1-1ubuntu5.2","1.13.1-1ubuntu5.3","1.13.1-1ubuntu5.4","1.13.1-1ubuntu5.5","1.13.1-1ubuntu5.7","1.13.1-1ubuntu5.8","1.13.1-1ubuntu5.10","1.13.1-1ubuntu5.11","1.13.1-1ubuntu5.12","1.13.1-1ubuntu5.13","1.13.1-1ubuntu5.14","1.13.1-1ubuntu5.15","1.13.1-1ubuntu5.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-1ubuntu3.12"}]}],"versions":["1.17.1-2","1.18.0-2ubuntu1","1.18.0-2ubuntu2","1.19.1-1ubuntu1","1.19.2-1ubuntu1","1.19.2-1ubuntu3","1.19.2-1ubuntu3.1","1.19.2-1ubuntu3.2","1.19.2-1ubuntu3.3","1.19.2-1ubuntu3.4","1.19.2-1ubuntu3.5","1.19.2-1ubuntu3.6","1.19.2-1ubuntu3.7","1.19.2-1ubuntu3.8","1.19.2-1ubuntu3.9","1.19.2-1ubuntu3.10"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.2-1ubuntu2","1.25.1-1ubuntu1","1.25.1-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-1ubuntu2.4"}]}],"versions":["1.22.0-2ubuntu2","1.22.0-2ubuntu4","1.24.2-1ubuntu1","1.24.2-1ubuntu2","1.24.2-1ubuntu2.1","1.24.2-1ubuntu2.2","1.24.2-1ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.22-1ubuntu4.14.04.3+esm5"}]}],"versions":["1.4.20-1","1.4.21-1","1.4.21-1ubuntu1","1.4.21-1ubuntu2","1.4.22-1ubuntu1","1.4.22-1ubuntu2","1.4.22-1ubuntu3","1.4.22-1ubuntu4","1.4.22-1ubuntu4.14.04.1","1.4.22-1ubuntu4.14.04.2","1.4.22-1ubuntu4.14.04.3","1.4.22-1ubuntu4.14.04.3+esm1","1.4.22-1ubuntu4.14.04.3+esm2","1.4.22-1ubuntu4.14.04.3+esm3","1.4.22-1ubuntu4.14.04.3+esm4"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.8-1ubuntu1.1+esm5"}]}],"versions":["1.4.22-1ubuntu6","1.5.7-1ubuntu1","1.5.7-1ubuntu2","1.5.8-1ubuntu1","1.5.8-1ubuntu1.1","1.5.8-1ubuntu1.1+esm1","1.5.8-1ubuntu1.1+esm2","1.5.8-1ubuntu1.1+esm3","1.5.8-1ubuntu1.1+esm4"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.7-1ubuntu2.6+esm6"}]}],"versions":["1.6.5-1","1.6.7-1","1.6.7-1build1","1.6.7-1ubuntu1","1.6.7-1ubuntu2","1.6.7-1ubuntu2.1","1.6.7-1ubuntu2.2","1.6.7-1ubuntu2.3","1.6.7-1ubuntu2.4","1.6.7-1ubuntu2.5","1.6.7-1ubuntu2.6","1.6.7-1ubuntu2.6+esm2","1.6.7-1ubuntu2.6+esm3","1.6.7-1ubuntu2.6+esm4","1.6.7-1ubuntu2.6+esm5"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-2ubuntu1.11+esm3"}]}],"versions":["1.9.0-2ubuntu1","1.9.0-2ubuntu2","1.9.4-2","1.9.4-2ubuntu1","1.9.4-2ubuntu1.1","1.9.4-2ubuntu1.2","1.9.4-2ubuntu1.3","1.9.4-2ubuntu1.4","1.9.4-2ubuntu1.5","1.9.4-2ubuntu1.6","1.9.4-2ubuntu1.8","1.9.4-2ubuntu1.9","1.9.4-2ubuntu1.11","1.9.4-2ubuntu1.11+esm1","1.9.4-2ubuntu1.11+esm2"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-1ubuntu5.17"}]}],"versions":["1.13.1-1ubuntu1","1.13.1-1ubuntu3","1.13.1-1ubuntu5","1.13.1-1ubuntu5.1","1.13.1-1ubuntu5.2","1.13.1-1ubuntu5.3","1.13.1-1ubuntu5.4","1.13.1-1ubuntu5.5","1.13.1-1ubuntu5.7","1.13.1-1ubuntu5.8","1.13.1-1ubuntu5.10","1.13.1-1ubuntu5.11","1.13.1-1ubuntu5.12","1.13.1-1ubuntu5.13","1.13.1-1ubuntu5.14","1.13.1-1ubuntu5.15","1.13.1-1ubuntu5.16"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-1ubuntu3.12"}]}],"versions":["1.17.1-2","1.18.0-2ubuntu1","1.18.0-2ubuntu2","1.19.1-1ubuntu1","1.19.2-1ubuntu1","1.19.2-1ubuntu3","1.19.2-1ubuntu3.1","1.19.2-1ubuntu3.2","1.19.2-1ubuntu3.3","1.19.2-1ubuntu3.4","1.19.2-1ubuntu3.5","1.19.2-1ubuntu3.6","1.19.2-1ubuntu3.7","1.19.2-1ubuntu3.8","1.19.2-1ubuntu3.9","1.19.2-1ubuntu3.10"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-1ubuntu2.4"}]}],"versions":["1.22.0-2ubuntu2","1.22.0-2ubuntu4","1.24.2-1ubuntu1","1.24.2-1ubuntu2","1.24.2-1ubuntu2.1","1.24.2-1ubuntu2.2","1.24.2-1ubuntu2.3"],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-1.1"}]}],"bundled":24},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-160000.1.1"}]}],"bundled":24}],"products":[{"vendor":"nlnet labs","product":"unbound"},{"vendor":"nlnetlabs","product":"unbound"}],"references":[{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-44690.txt","tags":["vendor-advisory","Vendor Advisory","advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44690","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-jwg4-375h-655h"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-44690","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55784","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44690","tags":["report"]},{"url":"https://bugzilla.redhat.com/2503063","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-55784.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55841","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55973","tags":["report"]},{"url":"https://bugzilla.redhat.com/2503075","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-55841.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55892","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-55892.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1785490706.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43167","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56416","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-44690","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0316.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35991","tags":["report"]},{"url":"https://community.nlnetlabs.nl/t/unbound-1-25-2-released/3430","tags":["web","report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/22/7","tags":["web"]},{"url":"https://nlnetlabs.nl/projects/unbound/security-advisories/","tags":["advisory","article"]},{"url":"https://advisories.mageia.org/MGASA-2026-0451.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36346","tags":["report"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3333","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44621","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46582","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50243","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50248","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50251","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55708","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55717","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55990","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3334","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40691","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3335","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3336","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3436","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42955","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44687","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50046","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56444","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:43588","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-40691","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55717","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56416","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50251","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41637","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-52863","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55990","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42955","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55708","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50243","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50252","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-46582","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56444","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55991","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50046","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54478","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14586","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50248","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44687","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50045","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32665","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_43588.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506128","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14586","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14586","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-14586.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503060","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32665","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32665","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503062","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40691","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506143","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41637","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41637","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-41637.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506144","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42955","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42955.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506130","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44687","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-44687.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503063","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44690","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506139","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-46582","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-46582.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506136","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50045","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50045","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50045.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506138","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50046","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50046.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506132","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50243","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50243.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506129","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50248","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50248.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506150","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50251","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50251.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506133","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50252","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50252","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50252.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506141","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-52863","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52863","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-52863.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506146","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54478","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54478","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-54478.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506131","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55708","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-55708.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506135","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55717","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-55717.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503075","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55973","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55973","tags":["advisory"]},{"url":"https://nlnetlabs.nl/projects/unbound/download/#unbound-1-25-2","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506148","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55990","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-55990.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506147","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55991","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55991","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-55991.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506137","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56416","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-56416.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506142","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56444","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-56444.txt","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55784.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55841.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55892.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:55784","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:55841","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:55892","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623050-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271873","tags":["report"]},{"url":"https://bugzilla.suse.com/1271874","tags":["report"]},{"url":"https://bugzilla.suse.com/1271875","tags":["report"]},{"url":"https://bugzilla.suse.com/1271876","tags":["report"]},{"url":"https://bugzilla.suse.com/1271877","tags":["report"]},{"url":"https://bugzilla.suse.com/1271878","tags":["report"]},{"url":"https://bugzilla.suse.com/1271879","tags":["report"]},{"url":"https://bugzilla.suse.com/1271880","tags":["report"]},{"url":"https://bugzilla.suse.com/1271881","tags":["report"]},{"url":"https://bugzilla.suse.com/1271882","tags":["report"]},{"url":"https://bugzilla.suse.com/1271883","tags":["report"]},{"url":"https://bugzilla.suse.com/1271884","tags":["report"]},{"url":"https://bugzilla.suse.com/1271886","tags":["report"]},{"url":"https://bugzilla.suse.com/1271887","tags":["report"]},{"url":"https://bugzilla.suse.com/1271888","tags":["report"]},{"url":"https://bugzilla.suse.com/1271889","tags":["report"]},{"url":"https://bugzilla.suse.com/1271890","tags":["report"]},{"url":"https://bugzilla.suse.com/1271891","tags":["report"]},{"url":"https://bugzilla.suse.com/1271892","tags":["report"]},{"url":"https://bugzilla.suse.com/1271893","tags":["report"]},{"url":"https://bugzilla.suse.com/1271894","tags":["report"]},{"url":"https://bugzilla.suse.com/1271895","tags":["report"]},{"url":"https://bugzilla.suse.com/1271896","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44690","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46582","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54478","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56444","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623215-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623226-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623349-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623360-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263884-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263885-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-44690","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8946-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-50387","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-50868","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-32665","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-40691","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-50252","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55973","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80225","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-81634","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-85501","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52863","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-44690","title":"Cross-zone wildcard cache poisoning via RRSIG.labels manipulation","description":"In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone). Arbitrary delegations that do not exist under the parent domain and are covered by the parent's NSEC chain can be brought into insecure existence by fraudulent wildcard DS records (less labels than expected, unknown algorithm) from the malicious sibling domain. This allows the malicious actor to inject insecure wildcard records for those delegations.","status":"published","published":"2026-07-22T13:06:56.684Z","modified":"2026-07-22T18:56:16.014Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T13:43:00.288193Z"}],"euvd":[{"id":"EUVD-2026-47669","description":"In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone). Arbitrary delegations that do not exist under the parent domain and are covered by the parent's NSEC chain can be brought into insecure existence by fraudulent wildcard DS records (less labels than expected, unknown algorithm) from the malicious sibling domain. This allows the malicious actor to inject insecure wildcard records for those delegations.","status":"published","published":"2026-07-22T13:06:56Z","modified":"2026-07-22T18:56:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:19:44.868793Z"}],"ghsa":[{"id":"GHSA-jwg4-375h-655h","title":"In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG...","description":"In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone). Arbitrary delegations that do not exist under the parent domain and are covered by the parent's NSEC chain can be brought into insecure existence by fraudulent wildcard DS records (less labels than expected, unknown algorithm) from the malicious sibling domain. This allows the malicious actor to inject insecure wildcard records for those delegations.","status":"published","published":"2026-07-22T15:31:24Z","modified":"2026-07-22T15:31:28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T15:09:38.678188Z"}],"nvd":[{"id":"CVE-2026-44690","description":"In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone). Arbitrary delegations that do not exist under the parent domain and are covered by the parent's NSEC chain can be brought into insecure existence by fraudulent wildcard DS records (less labels than expected, unknown algorithm) from the malicious sibling domain. This allows the malicious actor to inject insecure wildcard records for those delegations.","status":"published","published":"2026-07-22T14:17:19.153Z","modified":"2026-10-24T13:10:00.147Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:12:32.089897Z"}],"osv":[{"id":"ALPINE-CVE-2026-44690","description":"In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone). Arbitrary delegations that do not exist under the parent domain and are covered by the parent's NSEC chain can be brought into insecure existence by fraudulent wildcard DS records (less labels than expected, unknown algorithm) from the malicious sibling domain. This allows the malicious actor to inject insecure wildcard records for those delegations.","status":"published","published":"2026-07-22T14:17:19.153Z","modified":"2026-10-01T02:17:49.309035882Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"CVE-2026-44690","description":"In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone). Arbitrary delegations that do not exist under the parent domain and are covered by the parent's NSEC chain can be brought into insecure existence by fraudulent wildcard DS records (less labels than expected, unknown algorithm) from the malicious sibling domain. This allows the malicious actor to inject insecure wildcard records for those delegations.","status":"published","published":"2026-07-22T14:17:19.153Z","modified":"2026-10-26T02:30:28.859131837Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:05.172514Z"},{"id":"DEBIAN-CVE-2026-44690","description":"In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone). Arbitrary delegations that do not exist under the parent domain and are covered by the parent's NSEC chain can be brought into insecure existence by fraudulent wildcard DS records (less labels than expected, unknown algorithm) from the malicious sibling domain. This allows the malicious actor to inject insecure wildcard records for those delegations.","status":"published","published":"2026-07-22T14:17:19.153Z","modified":"2026-10-25T10:00:29.848027233Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:55.669088Z"},{"id":"OESA-2026-3333","title":"unbound security update","description":"Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn\u0026amp;apos;t make custom builds or provide specific features to paying customers only.\r\n\r\nSecurity Fix(es):\n\nWith NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with \u0026apos;unwanted-reply-threshold\u0026apos;, could eventually be abruptly terminated if the threshold is reached and libunbound needs to call \u0026apos;libworker_alloc_cleanup\u0026apos; since the function is absent from the function call allow list. When an application using libunbound sets \u0026apos;unwanted-reply-threshold\u0026apos; to any non-zero value and the iterator queries an authoritative that replies with enough wrong-transaction-ID UDP datagrams to cross the threshold, the \u0026apos;libworker_alloc_cleanup\u0026apos; will eventually be called. Since the function is absent from the function call allow list, this leads to a fatal exit of libunbound and eventual termination of the embedding application.Unbound itself is not affected since its relevant function \u0026apos;worker_alloc_cleanup\u0026apos; is registed in the allow list and proceeds to perform the documented cache flush.(CVE-2026-44621)\n\nIn NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone). Arbitrary delegations that do not exist under the parent domain and are covered by the parent\u0026apos;s NSEC chain can be brought into insecure existence by fraudulent wildcard DS records (less labels than expected, unknown algorithm) from the malicious sibling domain. This allows the malicious actor to inject insecure wildcard records for those delegations.(CVE-2026-44690)\n\nIn NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache, before later validation treats it as bogus based on NSEC validation. When the resolving thread puts secure on the rrset, and another thread that is on the serve expired path then picks up the updated rrset contents with the secure status for a reply, it can be used to change a specific record, next to a wildcard that could be covered by the wildcard, into the wildcard. A malicious actor can exploit the possible poisonous effect by having any DNSSEC-singed domain (irrelevant to the victim domain) and a CNAME wrapper record that points to a record next to a wildcard (that could be covered by the wildcard). Then quering Unbound for the wildcard sibling record would seed the secure message. A later (after expiry) query for the CNAME wrapper would need to resolve the target sibling record. If the wildcard replay is injected into the response, the wildcard rrset will update the expired sibling record with a secure status before completing proper wildcard validation with NSEC records and eventually treating the CNAME wrapper answer as bogus. The updated poisoned rrset is now secure and points to the wildcard. This vulnerability is explicit for the serve expired path and needs injection of the signed wildcard rrset without the NSEC accompanying rrset.(CVE-2026-46582)\n\nIn NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the \u0026apos;respip\u0026apos; module in front of the validator together with a \u0026apos;response-ip\u0026apos; redirect rule or an RPZ file with an RPZ-IP trigger, the rewriting handler does not check the security status of the upstream answer and can instead rewrite a BOGUS A/AAAA answer to point to an operator\u0026apos;s configured IP. If the validator finds an expired or otherwise invalid RRSIG on an answer whose A record falls within a \u0026apos;response-ip\u0026apos;/RPZ configuration, the answer is still rewritten and given a hard coded security level of INSECURE. This results in the client receiving an INSECURE NOERROR reply rewritten by the operator\u0026apos;s configured IP. A malicious actor can exploit the possible poisonous effect by spoofing a BOGUS A/AAAA answer that falls inside the operator\u0026apos;s configured subnet rewrites. Such DNSSEC protected answers are then insecurely redirected to the operator\u0026apos;s configured target.(CVE-2026-50243)\n\nIn NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname\u0026apos;s A/AAAA record (no valid RRSIG required) becomes the zone\u0026apos;s XFR primary and can replaces the entire zone/the resolver\u0026apos;s entire response policy.(CVE-2026-50248)\n\nIn NLnet Labs Unbound up to and including version 1.25.1, when \u0026apos;unwanted-reply-threshold\u0026apos; is enabled (set to any value greater than zero), glue records of 0.0.0.0/::0 can short-circuit Unbound, on systems that can direct such traffic, by issuing DNS queries and receiving seemingly unwanted replies since the remote IP does not match the original source IP of 0.0.0.0/::0. This behavior keeps on looping for the glue records and pushing the counter to the configured \u0026apos;unwanted-reply-threshold\u0026apos; that triggers a defensive cache clear. A malicious actor who controls a delegation that returns in-bailiwick glue of 0.0.0.0/::0 can drive the counter to the limit of \u0026apos;unwanted-reply-threshold\u0026apos; to the threshold and trigger a cache clean of the message and rrset caches; at will, indefinitely, without sending a single spoofed packet. The iterator uses the 0.0.0.0/::0 glue, and a system that can route this (e.g., Linux kernel routes the datagram over loopback), Unbound\u0026apos;s own listener answers from 127.0.0.1. Because of the mismatch of 0.0.0.0 and 127.0.0.1, in this example, Unbound accounts the reply as an unwanted (probably spoofed) answer. The counter resets to zero on every cache flush, so the attack loops forever.(CVE-2026-50251)\n\nIn NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the \u0026apos;view_local_data\u0026apos; and \u0026apos;view_local_datas\u0026apos; commands of \u0026apos;unbound-control\u0026apos; create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with. However, the creation through the control interface omits adding the default-protected zones (e.g., RFC 1918 reverse, AS112 zones, .onion, .localhost). Once the local zone tree exists without the defaults, every query for a default-protected name from a client mapped to that view escapes to the public DNS via the iterator instead of being answered locally, bypassing local policy expectations.(CVE-2026-55708)\n\nIn NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when \u0026apos;serve-expired: yes\u0026apos; is set together with a \u0026apos;response-ip: \u0026lt;net\u0026gt; redirect\u0026apos; /\u0026apos;response-ip-data: \u0026lt;net\u0026gt; CNAME \u0026lt;target\u0026gt;\u0026apos; rule (or the RPZ \u0026apos;rpz-cname-override\u0026apos; equivalent), a remote client who controls any delegated domain can crash the daemon. The serve-expired-client-timeout callback runs a two-pass loop to chase the respip-generated CNAME alias; on the second pass it resets \u0026apos;alias_rrset\u0026apos; but not \u0026apos;partial_rep\u0026apos;. Later, this inconsistency leads to a NULL pointer dereference and an eventual crash. A malicious actor can exploit the vulnerability by controlling any zone that replies with an A/AAAA record that falls inside the configured response-ip/rpz subnet. By delaying the answer when the previous record has expired, the vulnerable path of \u0026apos;serve-expired-client-timeout\u0026apos; is taken leading to denial of service via the server crash.(CVE-2026-55717)\n\nIn NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the \u0026apos;dnscrypt:\u0026apos; clause lists more \u0026apos;dnscrypt-provider-cert:\u0026apos; files than there are matching \u0026apos;dnscrypt-secret-key:\u0026apos; files, Unbound fills only the matched prefix and leaves the tail slots at the \u0026apos;0xdb\u0026apos; fill that libsodium\u0026apos;s allocator writes into every allocation. Unbound would then iterate over the number of cert files, not the actual slots, so it walks into a slot with garbage data filled with \u0026apos;0xdb\u0026apos; bytes. Any unauthenticated client that sends one UDP datagram of ≥ 68 bytes whose first 8 bytes are \u0026apos;0xdb\u0026apos; to \u0026apos;dnscrypt-port\u0026apos; will use that garbage entry which leads to a garbage dereference killing the server. This is a silent faulty configuration that goes unnoticed until triggered with the right client query. Unbound needs to be compiled with DNSCrypt support (\u0026apos;--enable-dnscrypt\u0026apos;).(CVE-2026-55990)\n\nIn NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain name as \u0026apos;datstart + dname_valid(datstart, ...)\u0026apos; and passes it straight to \u0026apos;query_dname_tolower()\u0026apos; without checking that a second name is actually present in the RDATA. The wire-format parser accepts multi-dname RRs whose RDATA ends after the first name, so an attacker who runs a DNSSEC-signed authoritative server can deliver a record with an absent second domain name (e.g. SOA record) and cause \u0026apos;query_dname_tolower()\u0026apos; to walk label-by-label through stale bytes in the per-worker \u0026apos;env-\u0026gt;scratch_buffer\u0026apos;, past the end of that heap allocation if \u0026apos;msg-buffer-size\u0026apos; has been lowered from the default. This leads to heap buffer overflow and on a release build the outcome relies heavily on the contents of the buffer tail and the adjacent heap chunk.(CVE-2026-56416)","status":"published","published":"2026-08-13T13:59:28Z","modified":"2026-08-16T01:45:14.84412521Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3334","title":"unbound security update","description":"Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn\u0026amp;apos;t make custom builds or provide specific features to paying customers only.\r\n\r\nSecurity Fix(es):\n\nIn Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply length against the destination buffer size. The size clamp that protects the UDP path is not applied on the TCP path, so a reply larger than 65504 bytes is shifted forward by 48 bytes inside a buffer of capacity equal to \u0026apos;msg-buffer-size\u0026apos;, writing past the end of the heap allocation. A single malicious encrypted query crashes the resolver and lead to denial of service. This vulnerability needs Unbound to be compiled with DNSCrypt support (\u0026apos;--enable-dnscrypt\u0026apos;) and the \u0026apos;dnscrypt:\u0026apos; clause to be configured and enabled for the listening interfaces.(CVE-2026-40691)\n\nWith NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with \u0026apos;unwanted-reply-threshold\u0026apos;, could eventually be abruptly terminated if the threshold is reached and libunbound needs to call \u0026apos;libworker_alloc_cleanup\u0026apos; since the function is absent from the function call allow list. When an application using libunbound sets \u0026apos;unwanted-reply-threshold\u0026apos; to any non-zero value and the iterator queries an authoritative that replies with enough wrong-transaction-ID UDP datagrams to cross the threshold, the \u0026apos;libworker_alloc_cleanup\u0026apos; will eventually be called. Since the function is absent from the function call allow list, this leads to a fatal exit of libunbound and eventual termination of the embedding application.Unbound itself is not affected since its relevant function \u0026apos;worker_alloc_cleanup\u0026apos; is registed in the allow list and proceeds to perform the documented cache flush.(CVE-2026-44621)\n\nIn NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone). Arbitrary delegations that do not exist under the parent domain and are covered by the parent\u0026apos;s NSEC chain can be brought into insecure existence by fraudulent wildcard DS records (less labels than expected, unknown algorithm) from the malicious sibling domain. This allows the malicious actor to inject insecure wildcard records for those delegations.(CVE-2026-44690)\n\nIn NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache, before later validation treats it as bogus based on NSEC validation. When the resolving thread puts secure on the rrset, and another thread that is on the serve expired path then picks up the updated rrset contents with the secure status for a reply, it can be used to change a specific record, next to a wildcard that could be covered by the wildcard, into the wildcard. A malicious actor can exploit the possible poisonous effect by having any DNSSEC-singed domain (irrelevant to the victim domain) and a CNAME wrapper record that points to a record next to a wildcard (that could be covered by the wildcard). Then quering Unbound for the wildcard sibling record would seed the secure message. A later (after expiry) query for the CNAME wrapper would need to resolve the target sibling record. If the wildcard replay is injected into the response, the wildcard rrset will update the expired sibling record with a secure status before completing proper wildcard validation with NSEC records and eventually treating the CNAME wrapper answer as bogus. The updated poisoned rrset is now secure and points to the wildcard. This vulnerability is explicit for the serve expired path and needs injection of the signed wildcard rrset without the NSEC accompanying rrset.(CVE-2026-46582)\n\nIn NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the \u0026apos;respip\u0026apos; module in front of the validator together with a \u0026apos;response-ip\u0026apos; redirect rule or an RPZ file with an RPZ-IP trigger, the rewriting handler does not check the security status of the upstream answer and can instead rewrite a BOGUS A/AAAA answer to point to an operator\u0026apos;s configured IP. If the validator finds an expired or otherwise invalid RRSIG on an answer whose A record falls within a \u0026apos;response-ip\u0026apos;/RPZ configuration, the answer is still rewritten and given a hard coded security level of INSECURE. This results in the client receiving an INSECURE NOERROR reply rewritten by the operator\u0026apos;s configured IP. A malicious actor can exploit the possible poisonous effect by spoofing a BOGUS A/AAAA answer that falls inside the operator\u0026apos;s configured subnet rewrites. Such DNSSEC protected answers are then insecurely redirected to the operator\u0026apos;s configured target.(CVE-2026-50243)\n\nIn NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname\u0026apos;s A/AAAA record (no valid RRSIG required) becomes the zone\u0026apos;s XFR primary and can replaces the entire zone/the resolver\u0026apos;s entire response policy.(CVE-2026-50248)\n\nIn NLnet Labs Unbound up to and including version 1.25.1, when \u0026apos;unwanted-reply-threshold\u0026apos; is enabled (set to any value greater than zero), glue records of 0.0.0.0/::0 can short-circuit Unbound, on systems that can direct such traffic, by issuing DNS queries and receiving seemingly unwanted replies since the remote IP does not match the original source IP of 0.0.0.0/::0. This behavior keeps on looping for the glue records and pushing the counter to the configured \u0026apos;unwanted-reply-threshold\u0026apos; that triggers a defensive cache clear. A malicious actor who controls a delegation that returns in-bailiwick glue of 0.0.0.0/::0 can drive the counter to the limit of \u0026apos;unwanted-reply-threshold\u0026apos; to the threshold and trigger a cache clean of the message and rrset caches; at will, indefinitely, without sending a single spoofed packet. The iterator uses the 0.0.0.0/::0 glue, and a system that can route this (e.g., Linux kernel routes the datagram over loopback), Unbound\u0026apos;s own listener answers from 127.0.0.1. Because of the mismatch of 0.0.0.0 and 127.0.0.1, in this example, Unbound accounts the reply as an unwanted (probably spoofed) answer. The counter resets to zero on every cache flush, so the attack loops forever.(CVE-2026-50251)\n\nIn NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the \u0026apos;view_local_data\u0026apos; and \u0026apos;view_local_datas\u0026apos; commands of \u0026apos;unbound-control\u0026apos; create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with. However, the creation through the control interface omits adding the default-protected zones (e.g., RFC 1918 reverse, AS112 zones, .onion, .localhost). Once the local zone tree exists without the defaults, every query for a default-protected name from a client mapped to that view escapes to the public DNS via the iterator instead of being answered locally, bypassing local policy expectations.(CVE-2026-55708)\n\nIn NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when \u0026apos;serve-expired: yes\u0026apos; is set together with a \u0026apos;response-ip: \u0026lt;net\u0026gt; redirect\u0026apos; /\u0026apos;response-ip-data: \u0026lt;net\u0026gt; CNAME \u0026lt;target\u0026gt;\u0026apos; rule (or the RPZ \u0026apos;rpz-cname-override\u0026apos; equivalent), a remote client who controls any delegated domain can crash the daemon. The serve-expired-client-timeout callback runs a two-pass loop to chase the respip-generated CNAME alias; on the second pass it resets \u0026apos;alias_rrset\u0026apos; but not \u0026apos;partial_rep\u0026apos;. Later, this inconsistency leads to a NULL pointer dereference and an eventual crash. A malicious actor can exploit the vulnerability by controlling any zone that replies with an A/AAAA record that falls inside the configured response-ip/rpz subnet. By delaying the answer when the previous record has expired, the vulnerable path of \u0026apos;serve-expired-client-timeout\u0026apos; is taken leading to denial of service via the server crash.(CVE-2026-55717)\n\nIn NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the \u0026apos;dnscrypt:\u0026apos; clause lists more \u0026apos;dnscrypt-provider-cert:\u0026apos; files than there are matching \u0026apos;dnscrypt-secret-key:\u0026apos; files, Unbound fills only the matched prefix and leaves the tail slots at the \u0026apos;0xdb\u0026apos; fill that libsodium\u0026apos;s allocator writes into every allocation. Unbound would then iterate over the number of cert files, not the actual slots, so it walks into a slot with garbage data filled with \u0026apos;0xdb\u0026apos; bytes. Any unauthenticated client that sends one UDP datagram of ≥ 68 bytes whose first 8 bytes are \u0026apos;0xdb\u0026apos; to \u0026apos;dnscrypt-port\u0026apos; will use that garbage entry which leads to a garbage dereference killing the server. This is a silent faulty configuration that goes unnoticed until triggered with the right client query. Unbound needs to be compiled with DNSCrypt support (\u0026apos;--enable-dnscrypt\u0026apos;).(CVE-2026-55990)\n\nIn NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain name as \u0026apos;datstart + dname_valid(datstart, ...)\u0026apos; and passes it straight to \u0026apos;query_dname_tolower()\u0026apos; without checking that a second name is actually present in the RDATA. The wire-format parser accepts multi-dname RRs whose RDATA ends after the first name, so an attacker who runs a DNSSEC-signed authoritative server can deliver a record with an absent second domain name (e.g. SOA record) and cause \u0026apos;query_dname_tolower()\u0026apos; to walk label-by-label through stale bytes in the per-worker \u0026apos;env-\u0026gt;scratch_buffer\u0026apos;, past the end of that heap allocation if \u0026apos;msg-buffer-size\u0026apos; has been lowered from the default. This leads to heap buffer overflow and on a release build the outcome relies heavily on the contents of the buffer tail and the adjacent heap chunk.(CVE-2026-56416)","status":"published","published":"2026-08-13T13:59:37Z","modified":"2026-08-16T01:45:14.994140178Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3335","title":"unbound security update","description":"Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn\u0026amp;apos;t make custom builds or provide specific features to paying customers only.\r\n\r\nSecurity Fix(es):\n\nIn Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply length against the destination buffer size. The size clamp that protects the UDP path is not applied on the TCP path, so a reply larger than 65504 bytes is shifted forward by 48 bytes inside a buffer of capacity equal to \u0026apos;msg-buffer-size\u0026apos;, writing past the end of the heap allocation. A single malicious encrypted query crashes the resolver and lead to denial of service. This vulnerability needs Unbound to be compiled with DNSCrypt support (\u0026apos;--enable-dnscrypt\u0026apos;) and the \u0026apos;dnscrypt:\u0026apos; clause to be configured and enabled for the listening interfaces.(CVE-2026-40691)\n\nWith NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with \u0026apos;unwanted-reply-threshold\u0026apos;, could eventually be abruptly terminated if the threshold is reached and libunbound needs to call \u0026apos;libworker_alloc_cleanup\u0026apos; since the function is absent from the function call allow list. When an application using libunbound sets \u0026apos;unwanted-reply-threshold\u0026apos; to any non-zero value and the iterator queries an authoritative that replies with enough wrong-transaction-ID UDP datagrams to cross the threshold, the \u0026apos;libworker_alloc_cleanup\u0026apos; will eventually be called. Since the function is absent from the function call allow list, this leads to a fatal exit of libunbound and eventual termination of the embedding application.Unbound itself is not affected since its relevant function \u0026apos;worker_alloc_cleanup\u0026apos; is registed in the allow list and proceeds to perform the documented cache flush.(CVE-2026-44621)\n\nIn NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone). Arbitrary delegations that do not exist under the parent domain and are covered by the parent\u0026apos;s NSEC chain can be brought into insecure existence by fraudulent wildcard DS records (less labels than expected, unknown algorithm) from the malicious sibling domain. This allows the malicious actor to inject insecure wildcard records for those delegations.(CVE-2026-44690)\n\nIn NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache, before later validation treats it as bogus based on NSEC validation. When the resolving thread puts secure on the rrset, and another thread that is on the serve expired path then picks up the updated rrset contents with the secure status for a reply, it can be used to change a specific record, next to a wildcard that could be covered by the wildcard, into the wildcard. A malicious actor can exploit the possible poisonous effect by having any DNSSEC-singed domain (irrelevant to the victim domain) and a CNAME wrapper record that points to a record next to a wildcard (that could be covered by the wildcard). Then quering Unbound for the wildcard sibling record would seed the secure message. A later (after expiry) query for the CNAME wrapper would need to resolve the target sibling record. If the wildcard replay is injected into the response, the wildcard rrset will update the expired sibling record with a secure status before completing proper wildcard validation with NSEC records and eventually treating the CNAME wrapper answer as bogus. The updated poisoned rrset is now secure and points to the wildcard. This vulnerability is explicit for the serve expired path and needs injection of the signed wildcard rrset without the NSEC accompanying rrset.(CVE-2026-46582)\n\nIn NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the \u0026apos;respip\u0026apos; module in front of the validator together with a \u0026apos;response-ip\u0026apos; redirect rule or an RPZ file with an RPZ-IP trigger, the rewriting handler does not check the security status of the upstream answer and can instead rewrite a BOGUS A/AAAA answer to point to an operator\u0026apos;s configured IP. If the validator finds an expired or otherwise invalid RRSIG on an answer whose A record falls within a \u0026apos;response-ip\u0026apos;/RPZ configuration, the answer is still rewritten and given a hard coded security level of INSECURE. This results in the client receiving an INSECURE NOERROR reply rewritten by the operator\u0026apos;s configured IP. A malicious actor can exploit the possible poisonous effect by spoofing a BOGUS A/AAAA answer that falls inside the operator\u0026apos;s configured subnet rewrites. Such DNSSEC protected answers are then insecurely redirected to the operator\u0026apos;s configured target.(CVE-2026-50243)\n\nIn NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname\u0026apos;s A/AAAA record (no valid RRSIG required) becomes the zone\u0026apos;s XFR primary and can replaces the entire zone/the resolver\u0026apos;s entire response policy.(CVE-2026-50248)\n\nIn NLnet Labs Unbound up to and including version 1.25.1, when \u0026apos;unwanted-reply-threshold\u0026apos; is enabled (set to any value greater than zero), glue records of 0.0.0.0/::0 can short-circuit Unbound, on systems that can direct such traffic, by issuing DNS queries and receiving seemingly unwanted replies since the remote IP does not match the original source IP of 0.0.0.0/::0. This behavior keeps on looping for the glue records and pushing the counter to the configured \u0026apos;unwanted-reply-threshold\u0026apos; that triggers a defensive cache clear. A malicious actor who controls a delegation that returns in-bailiwick glue of 0.0.0.0/::0 can drive the counter to the limit of \u0026apos;unwanted-reply-threshold\u0026apos; to the threshold and trigger a cache clean of the message and rrset caches; at will, indefinitely, without sending a single spoofed packet. The iterator uses the 0.0.0.0/::0 glue, and a system that can route this (e.g., Linux kernel routes the datagram over loopback), Unbound\u0026apos;s own listener answers from 127.0.0.1. Because of the mismatch of 0.0.0.0 and 127.0.0.1, in this example, Unbound accounts the reply as an unwanted (probably spoofed) answer. The counter resets to zero on every cache flush, so the attack loops forever.(CVE-2026-50251)\n\nIn NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the \u0026apos;view_local_data\u0026apos; and \u0026apos;view_local_datas\u0026apos; commands of \u0026apos;unbound-control\u0026apos; create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with. However, the creation through the control interface omits adding the default-protected zones (e.g., RFC 1918 reverse, AS112 zones, .onion, .localhost). Once the local zone tree exists without the defaults, every query for a default-protected name from a client mapped to that view escapes to the public DNS via the iterator instead of being answered locally, bypassing local policy expectations.(CVE-2026-55708)\n\nIn NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when \u0026apos;serve-expired: yes\u0026apos; is set together with a \u0026apos;response-ip: \u0026lt;net\u0026gt; redirect\u0026apos; /\u0026apos;response-ip-data: \u0026lt;net\u0026gt; CNAME \u0026lt;target\u0026gt;\u0026apos; rule (or the RPZ \u0026apos;rpz-cname-override\u0026apos; equivalent), a remote client who controls any delegated domain can crash the daemon. The serve-expired-client-timeout callback runs a two-pass loop to chase the respip-generated CNAME alias; on the second pass it resets \u0026apos;alias_rrset\u0026apos; but not \u0026apos;partial_rep\u0026apos;. Later, this inconsistency leads to a NULL pointer dereference and an eventual crash. A malicious actor can exploit the vulnerability by controlling any zone that replies with an A/AAAA record that falls inside the configured response-ip/rpz subnet. By delaying the answer when the previous record has expired, the vulnerable path of \u0026apos;serve-expired-client-timeout\u0026apos; is taken leading to denial of service via the server crash.(CVE-2026-55717)\n\nIn NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the \u0026apos;dnscrypt:\u0026apos; clause lists more \u0026apos;dnscrypt-provider-cert:\u0026apos; files than there are matching \u0026apos;dnscrypt-secret-key:\u0026apos; files, Unbound fills only the matched prefix and leaves the tail slots at the \u0026apos;0xdb\u0026apos; fill that libsodium\u0026apos;s allocator writes into every allocation. Unbound would then iterate over the number of cert files, not the actual slots, so it walks into a slot with garbage data filled with \u0026apos;0xdb\u0026apos; bytes. Any unauthenticated client that sends one UDP datagram of ≥ 68 bytes whose first 8 bytes are \u0026apos;0xdb\u0026apos; to \u0026apos;dnscrypt-port\u0026apos; will use that garbage entry which leads to a garbage dereference killing the server. This is a silent faulty configuration that goes unnoticed until triggered with the right client query. Unbound needs to be compiled with DNSCrypt support (\u0026apos;--enable-dnscrypt\u0026apos;).(CVE-2026-55990)\n\nIn NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain name as \u0026apos;datstart + dname_valid(datstart, ...)\u0026apos; and passes it straight to \u0026apos;query_dname_tolower()\u0026apos; without checking that a second name is actually present in the RDATA. The wire-format parser accepts multi-dname RRs whose RDATA ends after the first name, so an attacker who runs a DNSSEC-signed authoritative server can deliver a record with an absent second domain name (e.g. SOA record) and cause \u0026apos;query_dname_tolower()\u0026apos; to walk label-by-label through stale bytes in the per-worker \u0026apos;env-\u0026gt;scratch_buffer\u0026apos;, past the end of that heap allocation if \u0026apos;msg-buffer-size\u0026apos; has been lowered from the default. This leads to heap buffer overflow and on a release build the outcome relies heavily on the contents of the buffer tail and the adjacent heap chunk.(CVE-2026-56416)","status":"published","published":"2026-08-13T13:59:44Z","modified":"2026-08-16T01:45:15.030696162Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3336","title":"unbound security update","description":"Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn\u0026amp;apos;t make custom builds or provide specific features to paying customers only.\r\n\r\nSecurity Fix(es):\n\nWith NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with \u0026apos;unwanted-reply-threshold\u0026apos;, could eventually be abruptly terminated if the threshold is reached and libunbound needs to call \u0026apos;libworker_alloc_cleanup\u0026apos; since the function is absent from the function call allow list. When an application using libunbound sets \u0026apos;unwanted-reply-threshold\u0026apos; to any non-zero value and the iterator queries an authoritative that replies with enough wrong-transaction-ID UDP datagrams to cross the threshold, the \u0026apos;libworker_alloc_cleanup\u0026apos; will eventually be called. Since the function is absent from the function call allow list, this leads to a fatal exit of libunbound and eventual termination of the embedding application.Unbound itself is not affected since its relevant function \u0026apos;worker_alloc_cleanup\u0026apos; is registed in the allow list and proceeds to perform the documented cache flush.(CVE-2026-44621)\n\nIn NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone). Arbitrary delegations that do not exist under the parent domain and are covered by the parent\u0026apos;s NSEC chain can be brought into insecure existence by fraudulent wildcard DS records (less labels than expected, unknown algorithm) from the malicious sibling domain. This allows the malicious actor to inject insecure wildcard records for those delegations.(CVE-2026-44690)\n\nIn NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache, before later validation treats it as bogus based on NSEC validation. When the resolving thread puts secure on the rrset, and another thread that is on the serve expired path then picks up the updated rrset contents with the secure status for a reply, it can be used to change a specific record, next to a wildcard that could be covered by the wildcard, into the wildcard. A malicious actor can exploit the possible poisonous effect by having any DNSSEC-singed domain (irrelevant to the victim domain) and a CNAME wrapper record that points to a record next to a wildcard (that could be covered by the wildcard). Then quering Unbound for the wildcard sibling record would seed the secure message. A later (after expiry) query for the CNAME wrapper would need to resolve the target sibling record. If the wildcard replay is injected into the response, the wildcard rrset will update the expired sibling record with a secure status before completing proper wildcard validation with NSEC records and eventually treating the CNAME wrapper answer as bogus. The updated poisoned rrset is now secure and points to the wildcard. This vulnerability is explicit for the serve expired path and needs injection of the signed wildcard rrset without the NSEC accompanying rrset.(CVE-2026-46582)\n\nIn NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the \u0026apos;respip\u0026apos; module in front of the validator together with a \u0026apos;response-ip\u0026apos; redirect rule or an RPZ file with an RPZ-IP trigger, the rewriting handler does not check the security status of the upstream answer and can instead rewrite a BOGUS A/AAAA answer to point to an operator\u0026apos;s configured IP. If the validator finds an expired or otherwise invalid RRSIG on an answer whose A record falls within a \u0026apos;response-ip\u0026apos;/RPZ configuration, the answer is still rewritten and given a hard coded security level of INSECURE. This results in the client receiving an INSECURE NOERROR reply rewritten by the operator\u0026apos;s configured IP. A malicious actor can exploit the possible poisonous effect by spoofing a BOGUS A/AAAA answer that falls inside the operator\u0026apos;s configured subnet rewrites. Such DNSSEC protected answers are then insecurely redirected to the operator\u0026apos;s configured target.(CVE-2026-50243)\n\nIn NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname\u0026apos;s A/AAAA record (no valid RRSIG required) becomes the zone\u0026apos;s XFR primary and can replaces the entire zone/the resolver\u0026apos;s entire response policy.(CVE-2026-50248)\n\nIn NLnet Labs Unbound up to and including version 1.25.1, when \u0026apos;unwanted-reply-threshold\u0026apos; is enabled (set to any value greater than zero), glue records of 0.0.0.0/::0 can short-circuit Unbound, on systems that can direct such traffic, by issuing DNS queries and receiving seemingly unwanted replies since the remote IP does not match the original source IP of 0.0.0.0/::0. This behavior keeps on looping for the glue records and pushing the counter to the configured \u0026apos;unwanted-reply-threshold\u0026apos; that triggers a defensive cache clear. A malicious actor who controls a delegation that returns in-bailiwick glue of 0.0.0.0/::0 can drive the counter to the limit of \u0026apos;unwanted-reply-threshold\u0026apos; to the threshold and trigger a cache clean of the message and rrset caches; at will, indefinitely, without sending a single spoofed packet. The iterator uses the 0.0.0.0/::0 glue, and a system that can route this (e.g., Linux kernel routes the datagram over loopback), Unbound\u0026apos;s own listener answers from 127.0.0.1. Because of the mismatch of 0.0.0.0 and 127.0.0.1, in this example, Unbound accounts the reply as an unwanted (probably spoofed) answer. The counter resets to zero on every cache flush, so the attack loops forever.(CVE-2026-50251)\n\nIn NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the \u0026apos;view_local_data\u0026apos; and \u0026apos;view_local_datas\u0026apos; commands of \u0026apos;unbound-control\u0026apos; create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with. However, the creation through the control interface omits adding the default-protected zones (e.g., RFC 1918 reverse, AS112 zones, .onion, .localhost). Once the local zone tree exists without the defaults, every query for a default-protected name from a client mapped to that view escapes to the public DNS via the iterator instead of being answered locally, bypassing local policy expectations.(CVE-2026-55708)\n\nIn NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when \u0026apos;serve-expired: yes\u0026apos; is set together with a \u0026apos;response-ip: \u0026lt;net\u0026gt; redirect\u0026apos; /\u0026apos;response-ip-data: \u0026lt;net\u0026gt; CNAME \u0026lt;target\u0026gt;\u0026apos; rule (or the RPZ \u0026apos;rpz-cname-override\u0026apos; equivalent), a remote client who controls any delegated domain can crash the daemon. The serve-expired-client-timeout callback runs a two-pass loop to chase the respip-generated CNAME alias; on the second pass it resets \u0026apos;alias_rrset\u0026apos; but not \u0026apos;partial_rep\u0026apos;. Later, this inconsistency leads to a NULL pointer dereference and an eventual crash. A malicious actor can exploit the vulnerability by controlling any zone that replies with an A/AAAA record that falls inside the configured response-ip/rpz subnet. By delaying the answer when the previous record has expired, the vulnerable path of \u0026apos;serve-expired-client-timeout\u0026apos; is taken leading to denial of service via the server crash.(CVE-2026-55717)\n\nIn NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the \u0026apos;dnscrypt:\u0026apos; clause lists more \u0026apos;dnscrypt-provider-cert:\u0026apos; files than there are matching \u0026apos;dnscrypt-secret-key:\u0026apos; files, Unbound fills only the matched prefix and leaves the tail slots at the \u0026apos;0xdb\u0026apos; fill that libsodium\u0026apos;s allocator writes into every allocation. Unbound would then iterate over the number of cert files, not the actual slots, so it walks into a slot with garbage data filled with \u0026apos;0xdb\u0026apos; bytes. Any unauthenticated client that sends one UDP datagram of ≥ 68 bytes whose first 8 bytes are \u0026apos;0xdb\u0026apos; to \u0026apos;dnscrypt-port\u0026apos; will use that garbage entry which leads to a garbage dereference killing the server. This is a silent faulty configuration that goes unnoticed until triggered with the right client query. Unbound needs to be compiled with DNSCrypt support (\u0026apos;--enable-dnscrypt\u0026apos;).(CVE-2026-55990)\n\nIn NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain name as \u0026apos;datstart + dname_valid(datstart, ...)\u0026apos; and passes it straight to \u0026apos;query_dname_tolower()\u0026apos; without checking that a second name is actually present in the RDATA. The wire-format parser accepts multi-dname RRs whose RDATA ends after the first name, so an attacker who runs a DNSSEC-signed authoritative server can deliver a record with an absent second domain name (e.g. SOA record) and cause \u0026apos;query_dname_tolower()\u0026apos; to walk label-by-label through stale bytes in the per-worker \u0026apos;env-\u0026gt;scratch_buffer\u0026apos;, past the end of that heap allocation if \u0026apos;msg-buffer-size\u0026apos; has been lowered from the default. This leads to heap buffer overflow and on a release build the outcome relies heavily on the contents of the buffer tail and the adjacent heap chunk.(CVE-2026-56416)","status":"published","published":"2026-08-13T13:59:51Z","modified":"2026-08-16T01:45:14.994485897Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3436","title":"unbound security update","description":"Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn\u0026amp;apos;t make custom builds or provide specific features to paying customers only.\r\n\r\nSecurity Fix(es):\n\nIn Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply length against the destination buffer size. The size clamp that protects the UDP path is not applied on the TCP path, so a reply larger than 65504 bytes is shifted forward by 48 bytes inside a buffer of capacity equal to \u0026apos;msg-buffer-size\u0026apos;, writing past the end of the heap allocation. A single malicious encrypted query crashes the resolver and lead to denial of service. This vulnerability needs Unbound to be compiled with DNSCrypt support (\u0026apos;--enable-dnscrypt\u0026apos;) and the \u0026apos;dnscrypt:\u0026apos; clause to be configured and enabled for the listening interfaces.(CVE-2026-40691)\n\nIn NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the \u0026apos;ghost domain names\u0026apos; family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other \u0026apos;ghost domain names\u0026apos; attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client A/AAAA query can cause Unbound to overwrite the cached expired parent-side glue rrset and essentially extend the ghost domain window by up to one cached TTL configured value (\u0026apos;cache-max-ttl\u0026apos;). In configurations where \u0026apos;harden-referral-path: yes\u0026apos; is used (non-default configuration), no client query is required since Unbound implicitly performs that query. This is a variant of CVE-2026-40622 which only addressed the NS query.(CVE-2026-42955)\n\nWith NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with \u0026apos;unwanted-reply-threshold\u0026apos;, could eventually be abruptly terminated if the threshold is reached and libunbound needs to call \u0026apos;libworker_alloc_cleanup\u0026apos; since the function is absent from the function call allow list. When an application using libunbound sets \u0026apos;unwanted-reply-threshold\u0026apos; to any non-zero value and the iterator queries an authoritative that replies with enough wrong-transaction-ID UDP datagrams to cross the threshold, the \u0026apos;libworker_alloc_cleanup\u0026apos; will eventually be called. Since the function is absent from the function call allow list, this leads to a fatal exit of libunbound and eventual termination of the embedding application.Unbound itself is not affected since its relevant function \u0026apos;worker_alloc_cleanup\u0026apos; is registed in the allow list and proceeds to perform the documented cache flush.(CVE-2026-44621)\n\nIn NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed zone could be shadowed by the intermediate label\u0026apos;s secure NXDOMAIN answer from the parent. This is caused by an off-by-one error in \u0026apos;harden-below-nxdomain\u0026apos; logic; enabled by default. It effectively bypasses the configuration and the configured stub/forward zone is never contacted. \u0026apos;harden-below-nxdomain\u0026apos; does an upward DNS cache walk together with a delegation point guard that does not allow NXDOMAIN synthesis above stub/forward zones. The guard tests the domain name but before stripping a label. This results in an iteration where the domain name equals the configured stub/forward zone apex that passes the guard, strips one more label, and probes the cache at the apex\u0026apos;s immediate public parent. If that parent has a cached DNSSEC-secure NXDOMAIN, which it will for any private namespace nested two or more labels under a signed public name, the walk returns it and the configured stub/forward upstream is never contacted. This can only be triggered by the query for the intermediate label (between the stub/forward apex and the DNSSEC parent zone).(CVE-2026-44687)\n\nIn NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone). Arbitrary delegations that do not exist under the parent domain and are covered by the parent\u0026apos;s NSEC chain can be brought into insecure existence by fraudulent wildcard DS records (less labels than expected, unknown algorithm) from the malicious sibling domain. This allows the malicious actor to inject insecure wildcard records for those delegations.(CVE-2026-44690)\n\nIn NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache, before later validation treats it as bogus based on NSEC validation. When the resolving thread puts secure on the rrset, and another thread that is on the serve expired path then picks up the updated rrset contents with the secure status for a reply, it can be used to change a specific record, next to a wildcard that could be covered by the wildcard, into the wildcard. A malicious actor can exploit the possible poisonous effect by having any DNSSEC-singed domain (irrelevant to the victim domain) and a CNAME wrapper record that points to a record next to a wildcard (that could be covered by the wildcard). Then quering Unbound for the wildcard sibling record would seed the secure message. A later (after expiry) query for the CNAME wrapper would need to resolve the target sibling record. If the wildcard replay is injected into the response, the wildcard rrset will update the expired sibling record with a secure status before completing proper wildcard validation with NSEC records and eventually treating the CNAME wrapper answer as bogus. The updated poisoned rrset is now secure and points to the wildcard. This vulnerability is explicit for the serve expired path and needs injection of the signed wildcard rrset without the NSEC accompanying rrset.(CVE-2026-46582)\n\nIn NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS (DoT) forwarded queries is tied to a struct\u0026apos;s (\u0026apos;serviced_query\u0026apos;) lifetime but also referenced by another struct (\u0026apos;waiting_tcp\u0026apos;). When the owning struct is jostled out of the mesh while the DoT TCP stream is still handshaking it frees the storage behind the referenced string and if the TLS stream then errors out, it dereferences the freed pointer. The dereference is read-only and the practical impact is a daemon crash resulting in denial of service. A malicious actor that knows a DoT forwarding/stub Unbound\u0026apos;s configuration could exploit the vulnerability by quering records in the appropriate zone while keeping Unbound uder pressure so that the jostle logic kicks in. If answers for the vulnerable zone are slow, the likelihood of jostling such queries is higher, although the timing of the jostle needs to be precise. Requirements for a vulnerable Unbound is the existence of a stub/forward zone configured for DoT together with a configured \u0026apos;#authname\u0026apos; suffix on the server identification. The connectivity to the server needs to exhibit a transient failure at the correct time in order to kick off the vulnerable error path.(CVE-2026-50046)\n\nIn NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the \u0026apos;respip\u0026apos; module in front of the validator together with a \u0026apos;response-ip\u0026apos; redirect rule or an RPZ file with an RPZ-IP trigger, the rewriting handler does not check the security status of the upstream answer and can instead rewrite a BOGUS A/AAAA answer to point to an operator\u0026apos;s configured IP. If the validator finds an expired or otherwise invalid RRSIG on an answer whose A record falls within a \u0026apos;response-ip\u0026apos;/RPZ configuration, the answer is still rewritten and given a hard coded security level of INSECURE. This results in the client receiving an INSECURE NOERROR reply rewritten by the operator\u0026apos;s configured IP. A malicious actor can exploit the possible poisonous effect by spoofing a BOGUS A/AAAA answer that falls inside the operator\u0026apos;s configured subnet rewrites. Such DNSSEC protected answers are then insecurely redirected to the operator\u0026apos;s configured target.(CVE-2026-50243)\n\nIn NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname\u0026apos;s A/AAAA record (no valid RRSIG required) becomes the zone\u0026apos;s XFR primary and can replaces the entire zone/the resolver\u0026apos;s entire response policy.(CVE-2026-50248)\n\nIn NLnet Labs Unbound up to and including version 1.25.1, when \u0026apos;unwanted-reply-threshold\u0026apos; is enabled (set to any value greater than zero), glue records of 0.0.0.0/::0 can short-circuit Unbound, on systems that can direct such traffic, by issuing DNS queries and receiving seemingly unwanted replies since the remote IP does not match the original source IP of 0.0.0.0/::0. This behavior keeps on looping for the glue records and pushing the counter to the configured \u0026apos;unwanted-reply-threshold\u0026apos; that triggers a defensive cache clear. A malicious actor who controls a delegation that returns in-bailiwick glue of 0.0.0.0/::0 can drive the counter to the limit of \u0026apos;unwanted-reply-threshold\u0026apos; to the threshold and trigger a cache clean of the message and rrset caches; at will, indefinitely, without sending a single spoofed packet. The iterator uses the 0.0.0.0/::0 glue, and a system that can route this (e.g., Linux kernel routes the datagram over loopback), Unbound\u0026apos;s own listener answers from 127.0.0.1. Because of the mismatch of 0.0.0.0 and 127.0.0.1, in this example, Unbound accounts the reply as an unwanted (probably spoofed) answer. The counter resets to zero on every cache flush, so the attack loops forever.(CVE-2026-50251)\n\nIn NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the \u0026apos;view_local_data\u0026apos; and \u0026apos;view_local_datas\u0026apos; commands of \u0026apos;unbound-control\u0026apos; create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with. However, the creation through the control interface omits adding the default-protected zones (e.g., RFC 1918 reverse, AS112 zones, .onion, .localhost). Once the local zone tree exists without the defaults, every query for a default-protected name from a client mapped to that view escapes to the public DNS via the iterator instead of being answered locally, bypassing local policy expectations.(CVE-2026-55708)\n\nIn NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when \u0026apos;serve-expired: yes\u0026apos; is set together with a \u0026apos;response-ip: \u0026lt;net\u0026gt; redirect\u0026apos; /\u0026apos;response-ip-data: \u0026lt;net\u0026gt; CNAME \u0026lt;target\u0026gt;\u0026apos; rule (or the RPZ \u0026apos;rpz-cname-override\u0026apos; equivalent), a remote client who controls any delegated domain can crash the daemon. The serve-expired-client-timeout callback runs a two-pass loop to chase the respip-generated CNAME alias; on the second pass it resets \u0026apos;alias_rrset\u0026apos; but not \u0026apos;partial_rep\u0026apos;. Later, this inconsistency leads to a NULL pointer dereference and an eventual crash. A malicious actor can exploit the vulnerability by controlling any zone that replies with an A/AAAA record that falls inside the configured response-ip/rpz subnet. By delaying the answer when the previous record has expired, the vulnerable path of \u0026apos;serve-expired-client-timeout\u0026apos; is taken leading to denial of service via the server crash.(CVE-2026-55717)\n\nIn NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the \u0026apos;dnscrypt:\u0026apos; clause lists more \u0026apos;dnscrypt-provider-cert:\u0026apos; files than there are matching \u0026apos;dnscrypt-secret-key:\u0026apos; files, Unbound fills only the matched prefix and leaves the tail slots at the \u0026apos;0xdb\u0026apos; fill that libsodium\u0026apos;s allocator writes into every allocation. Unbound would then iterate over the number of cert files, not the actual slots, so it walks into a slot with garbage data filled with \u0026apos;0xdb\u0026apos; bytes. Any unauthenticated client that sends one UDP datagram of ≥ 68 bytes whose first 8 bytes are \u0026apos;0xdb\u0026apos; to \u0026apos;dnscrypt-port\u0026apos; will use that garbage entry which leads to a garbage dereference killing the server. This is a silent faulty configuration that goes unnoticed until triggered with the right client query. Unbound needs to be compiled with DNSCrypt support (\u0026apos;--enable-dnscrypt\u0026apos;).(CVE-2026-55990)\n\nIn NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain name as \u0026apos;datstart + dname_valid(datstart, ...)\u0026apos; and passes it straight to \u0026apos;query_dname_tolower()\u0026apos; without checking that a second name is actually present in the RDATA. The wire-format parser accepts multi-dname RRs whose RDATA ends after the first name, so an attacker who runs a DNSSEC-signed authoritative server can deliver a record with an absent second domain name (e.g. SOA record) and cause \u0026apos;query_dname_tolower()\u0026apos; to walk label-by-label through stale bytes in the per-worker \u0026apos;env-\u0026gt;scratch_buffer\u0026apos;, past the end of that heap allocation if \u0026apos;msg-buffer-size\u0026apos; has been lowered from the default. This leads to heap buffer overflow and on a release build the outcome relies heavily on the contents of the buffer tail and the adjacent heap chunk.(CVE-2026-56416)\n\nIn NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with \u0026apos;serve-expired: yes\u0026apos; and \u0026apos;serve-expired-client-timeout \u0026gt; discard-timeout \u0026gt; 0\u0026apos; (contrary to the suggested values), the discard-timeout branch during the serve expired logic drops an aged client reply without performing the correct accounting for the number of reply addresses for the query. Other identical branches outside of serve expired perform the correct decrement. Since the counter is never decremented in such scenario, it can reach the maximum limit and new clients for duplicate in-flight queries are silently dropped resulting in degradation of resolution service. A malicious actor can exploit the vulnerability by querying the resolver for a client-controlled slow-on-demand authoritative zone that can drive the counter past the threshold. Shipped defaults for \u0026apos;serve-expired-client-timeout: 1800\u0026apos; and \u0026apos;discard-timeout: 1900\u0026apos; make the branch unreachable.(CVE-2026-56444)","status":"published","published":"2026-08-20T09:57:59Z","modified":"2026-08-20T10:15:12.818253796Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"RHSA-2026:43588","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-23T10:14:32Z","modified":"2026-10-20T10:09:15Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:55784","title":"Red Hat Security Advisory: unbound security update","status":"published","published":"2026-08-18T10:21:10Z","modified":"2026-10-19T10:04:29Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:55841","title":"Red Hat Security Advisory: unbound security update","status":"published","published":"2026-08-18T10:21:14Z","modified":"2026-10-19T10:04:29Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:55892","title":"Red Hat Security Advisory: unbound security update","status":"published","published":"2026-08-18T10:21:19Z","modified":"2026-10-19T10:04:30Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RLSA-2026:55784","title":"Important: unbound security update","description":"The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. \n\nSecurity Fix(es):\n\n* unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes (CVE-2026-44690)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-18T06:01:20.072897Z","modified":"2026-08-18T06:30:07.55678762Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:55841","title":"Important: unbound security update","description":"The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. \n\nSecurity Fix(es):\n\n* unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes (CVE-2026-44690)\n\n* unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option (CVE-2026-55973)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-18T06:04:25.43626Z","modified":"2026-08-18T06:30:07.519767583Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:55892","title":"Important: unbound security update","description":"The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. \n\nSecurity Fix(es):\n\n* unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes (CVE-2026-44690)\n\n* unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option (CVE-2026-55973)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-18T12:07:31.722662Z","modified":"2026-08-18T12:30:03.297036566Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"UBUNTU-CVE-2026-44690","description":"In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone). Arbitrary delegations that do not exist under the parent domain and are covered by the parent's NSEC chain can be brought into insecure existence by fraudulent wildcard DS records (less labels than expected, unknown algorithm) from the malicious sibling domain. This allows the malicious actor to inject insecure wildcard records for those delegations.","status":"published","published":"2026-07-22T14:17:00Z","modified":"2026-10-21T23:02:09.719122774Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:26.396868Z"},{"id":"ALSA-2026:55784","title":"Important: unbound security update","description":"The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.   \n\nSecurity Fix(es):  \n\n  * unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes (CVE-2026-44690)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-17T00:00:00Z","modified":"2026-10-29T11:02:28.989278798Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:55841","title":"Important: unbound security update","description":"The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.   \n\nSecurity Fix(es):  \n\n  * unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes (CVE-2026-44690)\n  * unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option (CVE-2026-55973)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-17T00:00:00Z","modified":"2026-10-29T11:32:36.388327535Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:55892","title":"Important: unbound security update","description":"The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.   \n\nSecurity Fix(es):  \n\n  * unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes (CVE-2026-44690)\n  * unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option (CVE-2026-55973)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-17T00:00:00Z","modified":"2026-10-29T11:30:38.459703778Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"AZL-92931","title":"CVE-2026-44690 affecting package unbound for versions less than 1.25.2-1","description":"In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone). Arbitrary delegations that do not exist under the parent domain and are covered by the parent's NSEC chain can be brought into insecure existence by fraudulent wildcard DS records (less labels than expected, unknown algorithm) from the malicious sibling domain. This allows the malicious actor to inject insecure wildcard records for those delegations.","status":"published","published":"2026-07-22T14:17:19Z","modified":"2026-08-28T17:56:25.433719Z","updated_at":"2026-11-02T15:28:11.723718Z"},{"id":"CLSA-2026-1785490706","title":"unbound: Fix of 3 CVEs","description":"- CVE-2024-43167: guard against a NULL forward-zone name in ub_ctx_set_fwd\n  to prevent a NULL pointer dereference\n- CVE-2026-44690: reject RRSIG label counts below the signer label count and\n  restrict wildcard rrset cache updates to the signer authority, deferring\n  the cache write until the proof succeeds\n- CVE-2026-56416: bound the second domain name in canonicalized RDATA and\n  reject multi-dname RRs whose rdata ends early, preventing a heap buffer\n  overflow","status":"published","published":"2026-07-31T09:38:38Z","modified":"2026-10-26T09:31:24.699218479Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"MGASA-2026-0316","title":"Updated unbound packages fix security vulnerabilities","description":"Unbound packages updated to version 1.25.2 which incorporates a number\nof security and bug fixes.\n","status":"published","published":"2026-08-03T18:47:23Z","modified":"2026-08-03T19:00:05.516020211Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"MGASA-2026-0451","title":"Updated unbound packages fixes security vulnerabilities","description":"Heap buffer overflow and possible Remote Code Execution when digesting\nDNSKEY\nPossible heap buffer overflow during DNSSEC canonicalization\nCNAME synthesis could lead to heap corruption\nPossible ZONEMD verification bypass window\nUse-after-free in DoQ stream output buffer on reset re-transmission\nPossible degradation of service from continuous queries on the same\nTCP/DoT connection\nUse-after-free in DoH stream cleanup code path\nRetrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks\non DNSSEC\n'serve-expired' can bypass Unbound 'wait-limit'\nRemote DNS-over-QUIC denial of service due to 'quic-size' budget bypass\nPacket of death for DNSCrypt over TCP\nCross-zone wildcard cache poisoning via RRSIG.labels manipulation\n'dns-error-reporting: yes' leads to stack buffer overflow\nAssertion in libngtcp2 when under pressure in high concurrency\nDNS-over-QUIC environments\nLibunbound applications configured with 'unwanted-reply-threshold' could\neventually be abruptly terminated\n'max-global-quota' reset by DNSSEC validation restarts\nPossible heap use-after-free in an error path when a DoT forwarded query\nis jostled out\n'response-ip'/'rpz' can rewrite BOGUS answers instead of returning\nSERVFAIL\nBOGUS configured primary hostname accepted for XFR in auth/rpz zones\nDate:\nAttacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache\nflush\nPossible cache poisoning attack by mapping source port population per\nthread\nMemory corruption could lead to crash and denial of service\n'serve-expired-client-timeout' and 'response-ip' CNAME redirect could\nlead to a crash\nPacket of death for a DNSCrypt misconfigured Unbound\nRemote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2\nPossible heap buffer overflow when validator canonicalizes RDATA that\ncontains domain name\nDegradation of resolution service when 'discard-timeout' and\n'serve-expired-client-timeout' are combined in unusual configuration\nDegradation of resolution service from improperly accounted\nclient-terminated DNS-over-QUIC queries\nExtra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records\ndisallowing a one-time 'ghost domain' delegation renewal via glue\nrecords\nOff-by-one error in 'harden-below-nxdomain' logic can shadow a\nstub/forward zone by a legitimate parent's NXDOMAIN\nA wildcard replay, as another piece of data, triggers poisoning in the\nserve expired reply path\nDNS Cookie bypass when combined with proxy-protocol use\nPrivacy/configuration issue when adding local data in views through\n'unbound-control'\nPossible arbitrary code execution during DNSSEC validation\nHeap overflow with multiple NSID, COOKIE, PADDING EDNS options\nCrash during DNSSEC validation of malicious content\nDate:\nPacket of death with DNSCrypt\nAnother \"ghost domain names\" attack variant\nLong list of incoming EDNS options degrades performance\nJostle logic bypass degrades resolution performance\nDegradation of service with unbounded NSEC3 hash calculations\nPossible cache poisoning via promiscuous records for the authority\nsection\nUnbounded name compression in certain cases causes degradation of\nservice\nUse after free and crash under special conditions in RPZ code\nPossible domain hijacking via promiscuous records in the authority\nsection\nCache poisoning via the ECS-enabled Rebirthday Attack\nUnbounded name compression could lead to Denial of Service\nUnbound vulnerable to the \"DNSBomb\" pulsing DoS amplification attack\nDenial of service when trimming EDE text on positive replies\nDNSSEC verification complexity can be exploited to exhaust CPU resources\nand stall DNS resolvers\nNSEC3 closest encloser proof can exhaust CPU\nNon-Responsive Delegation Attack\nNovel \"ghost domain names\" attack by updating almost expired delegation\ninformation\nNovel \"ghost domain names\" attack by introducing subdomain delegations\nLocal symlink attack\nVulnerability in Domain Parse\nNXNSAttack\nVulnerability in IPSEC module\nVulnerability in parsing NOTIFY queries\nVulnerability in the processing of wildcard synthesized NSEC records\nNo limit to delegation chaining\nGhost domain names attack\nIncorrect proof processing for NSEC3-signed zone\nProcessing of duplicate CNAME records in a signed zone\nEmpty error packet handling assertion failure\n","status":"published","published":"2026-09-25T05:02:40Z","modified":"2026-09-25T05:15:03.49547618Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11380-1","title":"libunbound8-1.25.2-1.1 on GA media","description":"These are all security issues fixed in the libunbound8-1.25.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-26T00:00:00Z","modified":"2026-07-27T09:00:10.044193884Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21550-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\nUpdate to version 1.25.2.\n\nSecurity issues fixed:\n\n- CVE-2026-14586: DoS via assertion in `libngtcp2` for DNS-over-QUIC environments with high concurrency (bsc#1271879).\n- CVE-2026-32665: Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass (bsc#1271873).\n- CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).\n- CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries\n  (bsc#1271891).\n- CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records\n  (bsc#1271892).\n- CVE-2026-44621: Libunbound applications configured with `unwanted-reply-threshold` could eventually be abruptly\n  terminated (bsc#1271876).\n- CVE-2026-44687: Off-by-one error in `harden-below-nxdomain` logic can shadow a stub/forward zone by a legitimate\n  parent's `NXDOMAIN` (bsc#1271893).\n- CVE-2026-44690: Cross-zone wildcard cache poisoning via `RRSIG.labels` manipulation (bsc#1271877).\n- CVE-2026-46582: Replay of a wildcard `rrset` as another piece of data triggers poisoning in the server expired reply\n  path (bsc#1271894).\n- CVE-2026-50045: `max-global-quota` bypass via single client queries for a deeply nested name under a DNSSEC-signed\n  parent (bsc#1271878).\n- CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).\n- CVE-2026-50243: `response-ip`/`rpz` can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).\n- CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).\n- CVE-2026-50251: Attacker supplied `0.0.0.0`/`::` glue triggers defensive full-cache flush (bsc#1271883).\n- CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).\n- CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with `answer-cookie:yes` is used (bsc#1271895).\n- CVE-2026-55708: Privacy/configuration issue when adding local data in views through `unbound-control` (bsc#1271896).\n- CVE-2026-55717: `serve-expired-client-timeout` and `response-ip` CNAME redirect could lead to a crash (bsc#1271886).\n- CVE-2026-55973: DoS due to stack overflow triggered crash when `dns-error-reporting: yes` is set (bsc#1271874).\n- CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).\n- CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in `libngtcp2` (bsc#1271888).\n- CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name\n  (bsc#1271889).\n- CVE-2026-56444: Degradation of resolution service when `discard-timeout` and `serve-expired-client-timeout` are\n  combined in unusual configuration (bsc#1271890).\n\nOther updates and bugfixes:\n\n- Version 1.25.2:\n  + Features:\n    * TTL behavior changes: cached records reaching TTL 0 are expired;\n      TTL 0 upstream answers are no longer cached by cachedb;\n      serve-expired-reply-ttl is now capped by the original TTL value;\n      TTL decoding updated to adhere to RFC 8767 section 4\n    * Add new statistics: num.queries.replyaddr_limit and\n      requestlist.current.replies\n    * Add 'log-thread-id' configuration option to log the system-wide\n      Linux thread ID for easier debugging\n    * Add ECC-GOST12 support per RFC 9558 (available as\n      contrib/gost12.patch)\n    * Allow synthesized DNAME TTL=0 to be served from cache within a\n      1-second grace period, reducing recursion for TTL=0 DNAMEs\n      (RFC 2308)\n    * Fix DoT/DoH/DoQ to reload certificates on config reload without\n      requiring a full restart; fast_reload now supports changes to\n      tls-service-key, tls-service-pem and tls-cert-bundle\n    * Allow ip@port notation in control-interface configuration\n    * Add iter-scrub-rrsig option (default: 8) to limit the number of\n      RRSIGs processed by the scrubber\n    * Add 'tls-protocols' configuration option to select which TLS\n      protocol versions are used; TLSv1.2 is re-enabled by default\n    * Add pthread_setname_np support for named threads\n  + Bug Fixes:\n    * Fix handle leak in pythonmod on pythonmod_init\n    * Fix crash when mesh_detect_cycle_found() is called with no mesh\n      state\n    * Fix modstack_call_init to use the original string when it has\n      changed\n    * Fix fr_atomic_copy_cfg\n    * Fix auth-zone empty label for $ORIGIN when downloading via HTTP\n    * Fix respip and dns64 to be usable simultaneously; RPZ now works\n      with DNS64\n    * Fix HTTPS and QUIC not being enabled when port is listed in\n      interface-automatic-ports\n    * Allow wait-limit-cookie: 0 to disable cookie-validated wait limits\n    * Fix FIPS mode in OpenSSL causing unit test failure\n    * Fix discard-timeout to only drop UDP, not stream connections\n    * Reply with SERVFAIL when the wait-limit is exceeded\n    * Add extended DNS error code for invalid query type\n    * Replace deprecated SWIG $function with $action\n    * Log a warning for possible circular dependency when using hostnames\n      in stub/forward zones\n    * Fix infra cache for NAT64 by moving NAT64 synthesis to the\n      delegation point when adding target addresses\n    * Fix discard-timeout packet accounting in the mesh area\n    * Update IANA portlist\n    * Copy DNSTAP configuration from daemon to workers after fast_reload\n    * Fix HTTP/2 stream mesh state removal and drop handling for\n      postpone_drop and send failures\n    * Log THROWAWAY and (DNSSEC) LAME responses with clearer\n      categorization in log output\n    * Fix EDE removal logic consistency between encoding errors and\n      encoding replies\n    * Fix EDNS subnet scope-zero queries not being stored when\n      forward-no-cache or stub-no-cache is set\n    * Do not initialize quic_table unless QUIC is enabled\n    * Fix fast_reload to copy iter_scrub_ns, iter_scrub_cname and\n      max_global_quota options\n    * Fix allow-notify entries with hostnames to be copied after\n      IPv4/IPv6 lookup; fix skipping hostname lookups when only URLs\n      are configured\n    * Fix NAT64 inconsistency with do-not-query-address during retries\n    * Fix cachedb aggressive negative responses not setting the RA flag\n    * Fix root key priming failure after loading RPZ zones containing\n      ZONEMD RRtype\n    * Fix local-zone always_refuse to also block DS queries\n    * Fix cache lookup/store in external cachedb when forwarder/stub\n      uses the no-cache option\n    * Fix cachedb returning expired bogus data as non-bogus\n    * Fix validator unchecked state handling with validation recursion\n      and EDNS subnet\n    * Fix DNAME lookup flag and assertion in expired calculation debug\n      routine\n    * Fix DNS rebinding bypass via SVCB/HTTPS records; private-address\n      now also elides SVCB and HTTPS records matching the filter\n    * Warn for unused 'nodefault' local-zone configuration in\n      unbound-checkconf\n    * Fix lock/unlock for view in memory error handling\n    * Apply cache TTL policy to DNAME and synthesized CNAME on the\n      wire path\n    * Fix detection of HTTP listening port in fast_reload\n    * Fix ignoring out-of-zone DNAME records for CNAME synthesis\n    * Fix invalid HTTP content length/chunk size checks and RR rdata\n      field length validation in zone transfer, preventing heap\n      buffer-overflow read errors\n    * Fix defense in depth for service callback with empty packet\n    * Fix shared memory statistics with threads\n    * Fix EDNS client subnet to not store SERVFAIL in the global cache\n      after a failed lookup; stores a short-lived failure entry in the\n      subnet cache instead\n    * Fix memory corruption related core dumps when alloc_reg_obtain\n      encounters an empty list\n    * Fix RFC 7766 compliance when client sends EOF over TCP\n    * Fix DoH session cleanup when the same query appears on multiple\n      streams\n    * Fix TLS context setup for tls-service-pem\n    * Fix TTL comparisons in rdata_copy for 32-bit signed/unsigned values\n    * Fix memory leak in subnet SERVFAIL store\n    * Fix for the Jiggle Attack: server now answers errors for error\n      cases and no longer reflects parts of the incoming query\n    * Fix EDNS extended RCODE reflection: server no longer echoes\n      extended RCODE values after CHAOS class queries\n    * Fix iterator RCODE handling of YXDOMAIN: only accept YXDOMAIN\n      answers that contain a DNAME record\n    * Fix missing bounds check when decompressing dnames for downloaded\n      authority zones, preventing malformed content from truncated AXFR\n      packets\n    * Fix upstream TLS connections being reused for different names at\n      the same IP address\n    * Fix to disallow signatures with revoked DNSKEYs\n    * Fix DNAME with unsigned CNAME to check for the correct match,\n      preventing certain zone configurations from granting secure status\n      to unchecked CNAMEs\n    * Fix wildcard CNAME handling in the chain of trust\n    * Fix buffer overrun in doq_repinfo_retrieve_localaddr()\n  + Packaging changes:\n    * Update keyring to new NLnet Labs release signing key\n","status":"published","published":"2026-08-10T15:27:28Z","modified":"2026-08-12T18:23:41.681356663Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-44690","title":"CVE-2026-44690 in unbound - Patched by Root","description":"Root has patched CVE-2026-44690 in the unbound package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-31T09:51:41Z","modified":"2026-08-31T11:30:04.114187341Z","updated_at":"2026-11-02T15:53:30.179841Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-44690","title":"CVE-2026-44690 in unbound - Patched by Root","description":"Root has patched CVE-2026-44690 in the unbound package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-09-22T12:19:46Z","modified":"2026-09-22T13:15:03.131653762Z","updated_at":"2026-11-02T15:53:32.037361Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-44690","title":"CVE-2026-44690 in unbound - Patched by Root","description":"Root has patched CVE-2026-44690 in the unbound package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-09-23T08:20:02Z","modified":"2026-10-09T13:00:15.91033932Z","updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"SUSE-SU-2026:23050-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\nUpdate to version 1.25.2.\n\nSecurity issues fixed:\n\n- CVE-2026-14586: DoS via assertion in `libngtcp2` for DNS-over-QUIC environments with high concurrency (bsc#1271879).\n- CVE-2026-32665: Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass (bsc#1271873).\n- CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).\n- CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries\n  (bsc#1271891).\n- CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records\n  (bsc#1271892).\n- CVE-2026-44621: Libunbound applications configured with `unwanted-reply-threshold` could eventually be abruptly\n  terminated (bsc#1271876).\n- CVE-2026-44687: Off-by-one error in `harden-below-nxdomain` logic can shadow a stub/forward zone by a legitimate\n  parent's `NXDOMAIN` (bsc#1271893).\n- CVE-2026-44690: Cross-zone wildcard cache poisoning via `RRSIG.labels` manipulation (bsc#1271877).\n- CVE-2026-46582: Replay of a wildcard `rrset` as another piece of data triggers poisoning in the server expired reply\n  path (bsc#1271894).\n- CVE-2026-50045: `max-global-quota` bypass via single client queries for a deeply nested name under a DNSSEC-signed\n  parent (bsc#1271878).\n- CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).\n- CVE-2026-50243: `response-ip`/`rpz` can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).\n- CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).\n- CVE-2026-50251: Attacker supplied `0.0.0.0`/`::` glue triggers defensive full-cache flush (bsc#1271883).\n- CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).\n- CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with `answer-cookie:yes` is used (bsc#1271895).\n- CVE-2026-55708: Privacy/configuration issue when adding local data in views through `unbound-control` (bsc#1271896).\n- CVE-2026-55717: `serve-expired-client-timeout` and `response-ip` CNAME redirect could lead to a crash (bsc#1271886).\n- CVE-2026-55973: DoS due to stack overflow triggered crash when `dns-error-reporting: yes` is set (bsc#1271874).\n- CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).\n- CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in `libngtcp2` (bsc#1271888).\n- CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name\n  (bsc#1271889).\n- CVE-2026-56444: Degradation of resolution service when `discard-timeout` and `serve-expired-client-timeout` are\n  combined in unusual configuration (bsc#1271890).\n\nOther updates and bugfixes:\n\n- Version 1.25.2:\n  + Features:\n    * TTL behavior changes: cached records reaching TTL 0 are expired;\n      TTL 0 upstream answers are no longer cached by cachedb;\n      serve-expired-reply-ttl is now capped by the original TTL value;\n      TTL decoding updated to adhere to RFC 8767 section 4\n    * Add new statistics: num.queries.replyaddr_limit and\n      requestlist.current.replies\n    * Add 'log-thread-id' configuration option to log the system-wide\n      Linux thread ID for easier debugging\n    * Add ECC-GOST12 support per RFC 9558 (available as\n      contrib/gost12.patch)\n    * Allow synthesized DNAME TTL=0 to be served from cache within a\n      1-second grace period, reducing recursion for TTL=0 DNAMEs\n      (RFC 2308)\n    * Fix DoT/DoH/DoQ to reload certificates on config reload without\n      requiring a full restart; fast_reload now supports changes to\n      tls-service-key, tls-service-pem and tls-cert-bundle\n    * Allow ip@port notation in control-interface configuration\n    * Add iter-scrub-rrsig option (default: 8) to limit the number of\n      RRSIGs processed by the scrubber\n    * Add 'tls-protocols' configuration option to select which TLS\n      protocol versions are used; TLSv1.2 is re-enabled by default\n    * Add pthread_setname_np support for named threads\n  + Bug Fixes:\n    * Fix handle leak in pythonmod on pythonmod_init\n    * Fix crash when mesh_detect_cycle_found() is called with no mesh\n      state\n    * Fix modstack_call_init to use the original string when it has\n      changed\n    * Fix fr_atomic_copy_cfg\n    * Fix auth-zone empty label for $ORIGIN when downloading via HTTP\n    * Fix respip and dns64 to be usable simultaneously; RPZ now works\n      with DNS64\n    * Fix HTTPS and QUIC not being enabled when port is listed in\n      interface-automatic-ports\n    * Allow wait-limit-cookie: 0 to disable cookie-validated wait limits\n    * Fix FIPS mode in OpenSSL causing unit test failure\n    * Fix discard-timeout to only drop UDP, not stream connections\n    * Reply with SERVFAIL when the wait-limit is exceeded\n    * Add extended DNS error code for invalid query type\n    * Replace deprecated SWIG $function with $action\n    * Log a warning for possible circular dependency when using hostnames\n      in stub/forward zones\n    * Fix infra cache for NAT64 by moving NAT64 synthesis to the\n      delegation point when adding target addresses\n    * Fix discard-timeout packet accounting in the mesh area\n    * Update IANA portlist\n    * Copy DNSTAP configuration from daemon to workers after fast_reload\n    * Fix HTTP/2 stream mesh state removal and drop handling for\n      postpone_drop and send failures\n    * Log THROWAWAY and (DNSSEC) LAME responses with clearer\n      categorization in log output\n    * Fix EDE removal logic consistency between encoding errors and\n      encoding replies\n    * Fix EDNS subnet scope-zero queries not being stored when\n      forward-no-cache or stub-no-cache is set\n    * Do not initialize quic_table unless QUIC is enabled\n    * Fix fast_reload to copy iter_scrub_ns, iter_scrub_cname and\n      max_global_quota options\n    * Fix allow-notify entries with hostnames to be copied after\n      IPv4/IPv6 lookup; fix skipping hostname lookups when only URLs\n      are configured\n    * Fix NAT64 inconsistency with do-not-query-address during retries\n    * Fix cachedb aggressive negative responses not setting the RA flag\n    * Fix root key priming failure after loading RPZ zones containing\n      ZONEMD RRtype\n    * Fix local-zone always_refuse to also block DS queries\n    * Fix cache lookup/store in external cachedb when forwarder/stub\n      uses the no-cache option\n    * Fix cachedb returning expired bogus data as non-bogus\n    * Fix validator unchecked state handling with validation recursion\n      and EDNS subnet\n    * Fix DNAME lookup flag and assertion in expired calculation debug\n      routine\n    * Fix DNS rebinding bypass via SVCB/HTTPS records; private-address\n      now also elides SVCB and HTTPS records matching the filter\n    * Warn for unused 'nodefault' local-zone configuration in\n      unbound-checkconf\n    * Fix lock/unlock for view in memory error handling\n    * Apply cache TTL policy to DNAME and synthesized CNAME on the\n      wire path\n    * Fix detection of HTTP listening port in fast_reload\n    * Fix ignoring out-of-zone DNAME records for CNAME synthesis\n    * Fix invalid HTTP content length/chunk size checks and RR rdata\n      field length validation in zone transfer, preventing heap\n      buffer-overflow read errors\n    * Fix defense in depth for service callback with empty packet\n    * Fix shared memory statistics with threads\n    * Fix EDNS client subnet to not store SERVFAIL in the global cache\n      after a failed lookup; stores a short-lived failure entry in the\n      subnet cache instead\n    * Fix memory corruption related core dumps when alloc_reg_obtain\n      encounters an empty list\n    * Fix RFC 7766 compliance when client sends EOF over TCP\n    * Fix DoH session cleanup when the same query appears on multiple\n      streams\n    * Fix TLS context setup for tls-service-pem\n    * Fix TTL comparisons in rdata_copy for 32-bit signed/unsigned values\n    * Fix memory leak in subnet SERVFAIL store\n    * Fix for the Jiggle Attack: server now answers errors for error\n      cases and no longer reflects parts of the incoming query\n    * Fix EDNS extended RCODE reflection: server no longer echoes\n      extended RCODE values after CHAOS class queries\n    * Fix iterator RCODE handling of YXDOMAIN: only accept YXDOMAIN\n      answers that contain a DNAME record\n    * Fix missing bounds check when decompressing dnames for downloaded\n      authority zones, preventing malformed content from truncated AXFR\n      packets\n    * Fix upstream TLS connections being reused for different names at\n      the same IP address\n    * Fix to disallow signatures with revoked DNSKEYs\n    * Fix DNAME with unsigned CNAME to check for the correct match,\n      preventing certain zone configurations from granting secure status\n      to unchecked CNAMEs\n    * Fix wildcard CNAME handling in the chain of trust\n    * Fix buffer overrun in doq_repinfo_retrieve_localaddr()\n  + Packaging changes:\n    * Update keyring to new NLnet Labs release signing key\n","status":"published","published":"2026-08-10T15:26:22Z","modified":"2026-08-12T10:45:03.439161172Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23215-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\nUpdate to version 1.25.2.\n\nSecurity issues fixed:\n\n- CVE-2026-14586: DoS via assertion in `libngtcp2` for DNS-over-QUIC environments with high concurrency (bsc#1271879).\n- CVE-2026-32665: Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass (bsc#1271873).\n- CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).\n- CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries\n  (bsc#1271891).\n- CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records\n  (bsc#1271892).\n- CVE-2026-44621: Libunbound applications configured with `unwanted-reply-threshold` could eventually be abruptly\n  terminated (bsc#1271876).\n- CVE-2026-44687: Off-by-one error in `harden-below-nxdomain` logic can shadow a stub/forward zone by a legitimate\n  parent's `NXDOMAIN` (bsc#1271893).\n- CVE-2026-44690: Cross-zone wildcard cache poisoning via `RRSIG.labels` manipulation (bsc#1271877).\n- CVE-2026-46582: Replay of a wildcard `rrset` as another piece of data triggers poisoning in the server expired reply\n  path (bsc#1271894).\n- CVE-2026-50045: `max-global-quota` bypass via single client queries for a deeply nested name under a DNSSEC-signed\n  parent (bsc#1271878).\n- CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).\n- CVE-2026-50243: `response-ip`/`rpz` can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).\n- CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).\n- CVE-2026-50251: Attacker supplied `0.0.0.0`/`::` glue triggers defensive full-cache flush (bsc#1271883).\n- CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).\n- CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with `answer-cookie:yes` is used (bsc#1271895).\n- CVE-2026-55708: Privacy/configuration issue when adding local data in views through `unbound-control` (bsc#1271896).\n- CVE-2026-55717: `serve-expired-client-timeout` and `response-ip` CNAME redirect could lead to a crash (bsc#1271886).\n- CVE-2026-55973: DoS due to stack overflow triggered crash when `dns-error-reporting: yes` is set (bsc#1271874).\n- CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).\n- CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in `libngtcp2` (bsc#1271888).\n- CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name\n  (bsc#1271889).\n- CVE-2026-56444: Degradation of resolution service when `discard-timeout` and `serve-expired-client-timeout` are\n  combined in unusual configuration (bsc#1271890).\n\nOther updates and bugfixes:\n\n- Version 1.25.2:\n  + Features:\n    * TTL behavior changes: cached records reaching TTL 0 are expired;\n      TTL 0 upstream answers are no longer cached by cachedb;\n      serve-expired-reply-ttl is now capped by the original TTL value;\n      TTL decoding updated to adhere to RFC 8767 section 4\n    * Add new statistics: num.queries.replyaddr_limit and\n      requestlist.current.replies\n    * Add 'log-thread-id' configuration option to log the system-wide\n      Linux thread ID for easier debugging\n    * Add ECC-GOST12 support per RFC 9558 (available as\n      contrib/gost12.patch)\n    * Allow synthesized DNAME TTL=0 to be served from cache within a\n      1-second grace period, reducing recursion for TTL=0 DNAMEs\n      (RFC 2308)\n    * Fix DoT/DoH/DoQ to reload certificates on config reload without\n      requiring a full restart; fast_reload now supports changes to\n      tls-service-key, tls-service-pem and tls-cert-bundle\n    * Allow ip@port notation in control-interface configuration\n    * Add iter-scrub-rrsig option (default: 8) to limit the number of\n      RRSIGs processed by the scrubber\n    * Add 'tls-protocols' configuration option to select which TLS\n      protocol versions are used; TLSv1.2 is re-enabled by default\n    * Add pthread_setname_np support for named threads\n  + Bug Fixes:\n    * Fix handle leak in pythonmod on pythonmod_init\n    * Fix crash when mesh_detect_cycle_found() is called with no mesh\n      state\n    * Fix modstack_call_init to use the original string when it has\n      changed\n    * Fix fr_atomic_copy_cfg\n    * Fix auth-zone empty label for $ORIGIN when downloading via HTTP\n    * Fix respip and dns64 to be usable simultaneously; RPZ now works\n      with DNS64\n    * Fix HTTPS and QUIC not being enabled when port is listed in\n      interface-automatic-ports\n    * Allow wait-limit-cookie: 0 to disable cookie-validated wait limits\n    * Fix FIPS mode in OpenSSL causing unit test failure\n    * Fix discard-timeout to only drop UDP, not stream connections\n    * Reply with SERVFAIL when the wait-limit is exceeded\n    * Add extended DNS error code for invalid query type\n    * Replace deprecated SWIG $function with $action\n    * Log a warning for possible circular dependency when using hostnames\n      in stub/forward zones\n    * Fix infra cache for NAT64 by moving NAT64 synthesis to the\n      delegation point when adding target addresses\n    * Fix discard-timeout packet accounting in the mesh area\n    * Update IANA portlist\n    * Copy DNSTAP configuration from daemon to workers after fast_reload\n    * Fix HTTP/2 stream mesh state removal and drop handling for\n      postpone_drop and send failures\n    * Log THROWAWAY and (DNSSEC) LAME responses with clearer\n      categorization in log output\n    * Fix EDE removal logic consistency between encoding errors and\n      encoding replies\n    * Fix EDNS subnet scope-zero queries not being stored when\n      forward-no-cache or stub-no-cache is set\n    * Do not initialize quic_table unless QUIC is enabled\n    * Fix fast_reload to copy iter_scrub_ns, iter_scrub_cname and\n      max_global_quota options\n    * Fix allow-notify entries with hostnames to be copied after\n      IPv4/IPv6 lookup; fix skipping hostname lookups when only URLs\n      are configured\n    * Fix NAT64 inconsistency with do-not-query-address during retries\n    * Fix cachedb aggressive negative responses not setting the RA flag\n    * Fix root key priming failure after loading RPZ zones containing\n      ZONEMD RRtype\n    * Fix local-zone always_refuse to also block DS queries\n    * Fix cache lookup/store in external cachedb when forwarder/stub\n      uses the no-cache option\n    * Fix cachedb returning expired bogus data as non-bogus\n    * Fix validator unchecked state handling with validation recursion\n      and EDNS subnet\n    * Fix DNAME lookup flag and assertion in expired calculation debug\n      routine\n    * Fix DNS rebinding bypass via SVCB/HTTPS records; private-address\n      now also elides SVCB and HTTPS records matching the filter\n    * Warn for unused 'nodefault' local-zone configuration in\n      unbound-checkconf\n    * Fix lock/unlock for view in memory error handling\n    * Apply cache TTL policy to DNAME and synthesized CNAME on the\n      wire path\n    * Fix detection of HTTP listening port in fast_reload\n    * Fix ignoring out-of-zone DNAME records for CNAME synthesis\n    * Fix invalid HTTP content length/chunk size checks and RR rdata\n      field length validation in zone transfer, preventing heap\n      buffer-overflow read errors\n    * Fix defense in depth for service callback with empty packet\n    * Fix shared memory statistics with threads\n    * Fix EDNS client subnet to not store SERVFAIL in the global cache\n      after a failed lookup; stores a short-lived failure entry in the\n      subnet cache instead\n    * Fix memory corruption related core dumps when alloc_reg_obtain\n      encounters an empty list\n    * Fix RFC 7766 compliance when client sends EOF over TCP\n    * Fix DoH session cleanup when the same query appears on multiple\n      streams\n    * Fix TLS context setup for tls-service-pem\n    * Fix TTL comparisons in rdata_copy for 32-bit signed/unsigned values\n    * Fix memory leak in subnet SERVFAIL store\n    * Fix for the Jiggle Attack: server now answers errors for error\n      cases and no longer reflects parts of the incoming query\n    * Fix EDNS extended RCODE reflection: server no longer echoes\n      extended RCODE values after CHAOS class queries\n    * Fix iterator RCODE handling of YXDOMAIN: only accept YXDOMAIN\n      answers that contain a DNAME record\n    * Fix missing bounds check when decompressing dnames for downloaded\n      authority zones, preventing malformed content from truncated AXFR\n      packets\n    * Fix upstream TLS connections being reused for different names at\n      the same IP address\n    * Fix to disallow signatures with revoked DNSKEYs\n    * Fix DNAME with unsigned CNAME to check for the correct match,\n      preventing certain zone configurations from granting secure status\n      to unchecked CNAMEs\n    * Fix wildcard CNAME handling in the chain of trust\n    * Fix buffer overrun in doq_repinfo_retrieve_localaddr()\n  + Packaging changes:\n    * Update keyring to new NLnet Labs release signing key\n","status":"published","published":"2026-08-10T15:26:22Z","modified":"2026-08-27T18:23:09.188902083Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23226-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\nUpdate to version 1.25.2.\n\nSecurity issues fixed:\n\n- CVE-2026-14586: DoS via assertion in `libngtcp2` for DNS-over-QUIC environments with high concurrency (bsc#1271879).\n- CVE-2026-32665: Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass (bsc#1271873).\n- CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).\n- CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries\n  (bsc#1271891).\n- CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records\n  (bsc#1271892).\n- CVE-2026-44621: Libunbound applications configured with `unwanted-reply-threshold` could eventually be abruptly\n  terminated (bsc#1271876).\n- CVE-2026-44687: Off-by-one error in `harden-below-nxdomain` logic can shadow a stub/forward zone by a legitimate\n  parent's `NXDOMAIN` (bsc#1271893).\n- CVE-2026-44690: Cross-zone wildcard cache poisoning via `RRSIG.labels` manipulation (bsc#1271877).\n- CVE-2026-46582: Replay of a wildcard `rrset` as another piece of data triggers poisoning in the server expired reply\n  path (bsc#1271894).\n- CVE-2026-50045: `max-global-quota` bypass via single client queries for a deeply nested name under a DNSSEC-signed\n  parent (bsc#1271878).\n- CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).\n- CVE-2026-50243: `response-ip`/`rpz` can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).\n- CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).\n- CVE-2026-50251: Attacker supplied `0.0.0.0`/`::` glue triggers defensive full-cache flush (bsc#1271883).\n- CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).\n- CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with `answer-cookie:yes` is used (bsc#1271895).\n- CVE-2026-55708: Privacy/configuration issue when adding local data in views through `unbound-control` (bsc#1271896).\n- CVE-2026-55717: `serve-expired-client-timeout` and `response-ip` CNAME redirect could lead to a crash (bsc#1271886).\n- CVE-2026-55973: DoS due to stack overflow triggered crash when `dns-error-reporting: yes` is set (bsc#1271874).\n- CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).\n- CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in `libngtcp2` (bsc#1271888).\n- CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name\n  (bsc#1271889).\n- CVE-2026-56444: Degradation of resolution service when `discard-timeout` and `serve-expired-client-timeout` are\n  combined in unusual configuration (bsc#1271890).\n\nOther updates and bugfixes:\n\n- Version 1.25.2:\n  + Features:\n    * TTL behavior changes: cached records reaching TTL 0 are expired;\n      TTL 0 upstream answers are no longer cached by cachedb;\n      serve-expired-reply-ttl is now capped by the original TTL value;\n      TTL decoding updated to adhere to RFC 8767 section 4\n    * Add new statistics: num.queries.replyaddr_limit and\n      requestlist.current.replies\n    * Add 'log-thread-id' configuration option to log the system-wide\n      Linux thread ID for easier debugging\n    * Add ECC-GOST12 support per RFC 9558 (available as\n      contrib/gost12.patch)\n    * Allow synthesized DNAME TTL=0 to be served from cache within a\n      1-second grace period, reducing recursion for TTL=0 DNAMEs\n      (RFC 2308)\n    * Fix DoT/DoH/DoQ to reload certificates on config reload without\n      requiring a full restart; fast_reload now supports changes to\n      tls-service-key, tls-service-pem and tls-cert-bundle\n    * Allow ip@port notation in control-interface configuration\n    * Add iter-scrub-rrsig option (default: 8) to limit the number of\n      RRSIGs processed by the scrubber\n    * Add 'tls-protocols' configuration option to select which TLS\n      protocol versions are used; TLSv1.2 is re-enabled by default\n    * Add pthread_setname_np support for named threads\n  + Bug Fixes:\n    * Fix handle leak in pythonmod on pythonmod_init\n    * Fix crash when mesh_detect_cycle_found() is called with no mesh\n      state\n    * Fix modstack_call_init to use the original string when it has\n      changed\n    * Fix fr_atomic_copy_cfg\n    * Fix auth-zone empty label for $ORIGIN when downloading via HTTP\n    * Fix respip and dns64 to be usable simultaneously; RPZ now works\n      with DNS64\n    * Fix HTTPS and QUIC not being enabled when port is listed in\n      interface-automatic-ports\n    * Allow wait-limit-cookie: 0 to disable cookie-validated wait limits\n    * Fix FIPS mode in OpenSSL causing unit test failure\n    * Fix discard-timeout to only drop UDP, not stream connections\n    * Reply with SERVFAIL when the wait-limit is exceeded\n    * Add extended DNS error code for invalid query type\n    * Replace deprecated SWIG $function with $action\n    * Log a warning for possible circular dependency when using hostnames\n      in stub/forward zones\n    * Fix infra cache for NAT64 by moving NAT64 synthesis to the\n      delegation point when adding target addresses\n    * Fix discard-timeout packet accounting in the mesh area\n    * Update IANA portlist\n    * Copy DNSTAP configuration from daemon to workers after fast_reload\n    * Fix HTTP/2 stream mesh state removal and drop handling for\n      postpone_drop and send failures\n    * Log THROWAWAY and (DNSSEC) LAME responses with clearer\n      categorization in log output\n    * Fix EDE removal logic consistency between encoding errors and\n      encoding replies\n    * Fix EDNS subnet scope-zero queries not being stored when\n      forward-no-cache or stub-no-cache is set\n    * Do not initialize quic_table unless QUIC is enabled\n    * Fix fast_reload to copy iter_scrub_ns, iter_scrub_cname and\n      max_global_quota options\n    * Fix allow-notify entries with hostnames to be copied after\n      IPv4/IPv6 lookup; fix skipping hostname lookups when only URLs\n      are configured\n    * Fix NAT64 inconsistency with do-not-query-address during retries\n    * Fix cachedb aggressive negative responses not setting the RA flag\n    * Fix root key priming failure after loading RPZ zones containing\n      ZONEMD RRtype\n    * Fix local-zone always_refuse to also block DS queries\n    * Fix cache lookup/store in external cachedb when forwarder/stub\n      uses the no-cache option\n    * Fix cachedb returning expired bogus data as non-bogus\n    * Fix validator unchecked state handling with validation recursion\n      and EDNS subnet\n    * Fix DNAME lookup flag and assertion in expired calculation debug\n      routine\n    * Fix DNS rebinding bypass via SVCB/HTTPS records; private-address\n      now also elides SVCB and HTTPS records matching the filter\n    * Warn for unused 'nodefault' local-zone configuration in\n      unbound-checkconf\n    * Fix lock/unlock for view in memory error handling\n    * Apply cache TTL policy to DNAME and synthesized CNAME on the\n      wire path\n    * Fix detection of HTTP listening port in fast_reload\n    * Fix ignoring out-of-zone DNAME records for CNAME synthesis\n    * Fix invalid HTTP content length/chunk size checks and RR rdata\n      field length validation in zone transfer, preventing heap\n      buffer-overflow read errors\n    * Fix defense in depth for service callback with empty packet\n    * Fix shared memory statistics with threads\n    * Fix EDNS client subnet to not store SERVFAIL in the global cache\n      after a failed lookup; stores a short-lived failure entry in the\n      subnet cache instead\n    * Fix memory corruption related core dumps when alloc_reg_obtain\n      encounters an empty list\n    * Fix RFC 7766 compliance when client sends EOF over TCP\n    * Fix DoH session cleanup when the same query appears on multiple\n      streams\n    * Fix TLS context setup for tls-service-pem\n    * Fix TTL comparisons in rdata_copy for 32-bit signed/unsigned values\n    * Fix memory leak in subnet SERVFAIL store\n    * Fix for the Jiggle Attack: server now answers errors for error\n      cases and no longer reflects parts of the incoming query\n    * Fix EDNS extended RCODE reflection: server no longer echoes\n      extended RCODE values after CHAOS class queries\n    * Fix iterator RCODE handling of YXDOMAIN: only accept YXDOMAIN\n      answers that contain a DNAME record\n    * Fix missing bounds check when decompressing dnames for downloaded\n      authority zones, preventing malformed content from truncated AXFR\n      packets\n    * Fix upstream TLS connections being reused for different names at\n      the same IP address\n    * Fix to disallow signatures with revoked DNSKEYs\n    * Fix DNAME with unsigned CNAME to check for the correct match,\n      preventing certain zone configurations from granting secure status\n      to unchecked CNAMEs\n    * Fix wildcard CNAME handling in the chain of trust\n    * Fix buffer overrun in doq_repinfo_retrieve_localaddr()\n  + Packaging changes:\n    * Update keyring to new NLnet Labs release signing key\n","status":"published","published":"2026-08-10T15:26:22Z","modified":"2026-08-27T18:23:10.17349122Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23349-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\nUpdate to version 1.25.2.\n\nSecurity issues fixed:\n\n- CVE-2026-14586: DoS via assertion in `libngtcp2` for DNS-over-QUIC environments with high concurrency (bsc#1271879).\n- CVE-2026-32665: Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass (bsc#1271873).\n- CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).\n- CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries\n  (bsc#1271891).\n- CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records\n  (bsc#1271892).\n- CVE-2026-44621: Libunbound applications configured with `unwanted-reply-threshold` could eventually be abruptly\n  terminated (bsc#1271876).\n- CVE-2026-44687: Off-by-one error in `harden-below-nxdomain` logic can shadow a stub/forward zone by a legitimate\n  parent's `NXDOMAIN` (bsc#1271893).\n- CVE-2026-44690: Cross-zone wildcard cache poisoning via `RRSIG.labels` manipulation (bsc#1271877).\n- CVE-2026-46582: Replay of a wildcard `rrset` as another piece of data triggers poisoning in the server expired reply\n  path (bsc#1271894).\n- CVE-2026-50045: `max-global-quota` bypass via single client queries for a deeply nested name under a DNSSEC-signed\n  parent (bsc#1271878).\n- CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).\n- CVE-2026-50243: `response-ip`/`rpz` can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).\n- CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).\n- CVE-2026-50251: Attacker supplied `0.0.0.0`/`::` glue triggers defensive full-cache flush (bsc#1271883).\n- CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).\n- CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with `answer-cookie:yes` is used (bsc#1271895).\n- CVE-2026-55708: Privacy/configuration issue when adding local data in views through `unbound-control` (bsc#1271896).\n- CVE-2026-55717: `serve-expired-client-timeout` and `response-ip` CNAME redirect could lead to a crash (bsc#1271886).\n- CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).\n- CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in `libngtcp2` (bsc#1271888).\n- CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name\n  (bsc#1271889).\n- CVE-2026-56444: Degradation of resolution service when `discard-timeout` and `serve-expired-client-timeout` are\n  combined in unusual configuration (bsc#1271890).\n\nOther updates and bugfixes:\n\n- Version 1.25.2:\n  * For a complete list of additional changes see the changelog at https://nlnetlabs.nl/projects/unbound/download/.\n- Update `unbound.keyring`.\n","status":"published","published":"2026-08-26T14:24:09Z","modified":"2026-09-10T18:23:12.453750666Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23360-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\nUpdate to version 1.25.2.\n\nSecurity issues fixed:\n\n- CVE-2026-14586: DoS via assertion in `libngtcp2` for DNS-over-QUIC environments with high concurrency (bsc#1271879).\n- CVE-2026-32665: Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass (bsc#1271873).\n- CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).\n- CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries\n  (bsc#1271891).\n- CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records\n  (bsc#1271892).\n- CVE-2026-44621: Libunbound applications configured with `unwanted-reply-threshold` could eventually be abruptly\n  terminated (bsc#1271876).\n- CVE-2026-44687: Off-by-one error in `harden-below-nxdomain` logic can shadow a stub/forward zone by a legitimate\n  parent's `NXDOMAIN` (bsc#1271893).\n- CVE-2026-44690: Cross-zone wildcard cache poisoning via `RRSIG.labels` manipulation (bsc#1271877).\n- CVE-2026-46582: Replay of a wildcard `rrset` as another piece of data triggers poisoning in the server expired reply\n  path (bsc#1271894).\n- CVE-2026-50045: `max-global-quota` bypass via single client queries for a deeply nested name under a DNSSEC-signed\n  parent (bsc#1271878).\n- CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).\n- CVE-2026-50243: `response-ip`/`rpz` can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).\n- CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).\n- CVE-2026-50251: Attacker supplied `0.0.0.0`/`::` glue triggers defensive full-cache flush (bsc#1271883).\n- CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).\n- CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with `answer-cookie:yes` is used (bsc#1271895).\n- CVE-2026-55708: Privacy/configuration issue when adding local data in views through `unbound-control` (bsc#1271896).\n- CVE-2026-55717: `serve-expired-client-timeout` and `response-ip` CNAME redirect could lead to a crash (bsc#1271886).\n- CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).\n- CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in `libngtcp2` (bsc#1271888).\n- CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name\n  (bsc#1271889).\n- CVE-2026-56444: Degradation of resolution service when `discard-timeout` and `serve-expired-client-timeout` are\n  combined in unusual configuration (bsc#1271890).\n\nOther updates and bugfixes:\n\n- Version 1.25.2:\n  * For a complete list of additional changes see the changelog at https://nlnetlabs.nl/projects/unbound/download/.\n- Update `unbound.keyring`.\n","status":"published","published":"2026-08-26T14:27:41Z","modified":"2026-09-10T18:23:12.60275904Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:3884-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\nUpdate to version 1.25.2.\n\nSecurity issues fixed:\n\n- CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).\n- CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records\n  (bsc#1271892).\n- CVE-2026-44621: Libunbound applications configured with `unwanted-reply-threshold` could eventually be abruptly\n  terminated (bsc#1271876).\n- CVE-2026-44687: Off-by-one error in `harden-below-nxdomain` logic can shadow a stub/forward zone by a legitimate\n  parent's `NXDOMAIN` (bsc#1271893).\n- CVE-2026-44690: Cross-zone wildcard cache poisoning via `RRSIG.labels` manipulation (bsc#1271877).\n- CVE-2026-46582: Replay of a wildcard `rrset` as another piece of data triggers poisoning in the server expired reply\n  path (bsc#1271894).\n- CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).\n- CVE-2026-50243: `response-ip`/`rpz` can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).\n- CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).\n- CVE-2026-50251: Attacker supplied `0.0.0.0`/`::` glue triggers defensive full-cache flush (bsc#1271883).\n- CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).\n- CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with `answer-cookie:yes` is used (bsc#1271895).\n- CVE-2026-55708: Privacy/configuration issue when adding local data in views through `unbound-control` (bsc#1271896).\n- CVE-2026-55717: `serve-expired-client-timeout` and `response-ip` CNAME redirect could lead to a crash (bsc#1271886).\n- CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).\n- CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name\n  (bsc#1271889).\n- CVE-2026-56444: Degradation of resolution service when `discard-timeout` and `serve-expired-client-timeout` are\n  combined in unusual configuration (bsc#1271890).\n\nOther updates and bugfixes:\n\n- Version 1.25.2:\n  * For a complete list of additional changes see the changelog at https://nlnetlabs.nl/projects/unbound/download/.\n- Update `unbound.keyring`.\n","status":"published","published":"2026-08-31T14:33:51Z","modified":"2026-09-10T18:23:16.858167945Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3885-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\nUpdate to version 1.25.2.\n\nSecurity issues fixed:\n\n- CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).\n- CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records\n  (bsc#1271892).\n- CVE-2026-44621: Libunbound applications configured with `unwanted-reply-threshold` could eventually be abruptly\n  terminated (bsc#1271876).\n- CVE-2026-44687: Off-by-one error in `harden-below-nxdomain` logic can shadow a stub/forward zone by a legitimate\n  parent's `NXDOMAIN` (bsc#1271893).\n- CVE-2026-44690: Cross-zone wildcard cache poisoning via `RRSIG.labels` manipulation (bsc#1271877).\n- CVE-2026-46582: Replay of a wildcard `rrset` as another piece of data triggers poisoning in the server expired reply\n  path (bsc#1271894).\n- CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).\n- CVE-2026-50243: `response-ip`/`rpz` can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).\n- CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).\n- CVE-2026-50251: Attacker supplied `0.0.0.0`/`::` glue triggers defensive full-cache flush (bsc#1271883).\n- CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).\n- CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with `answer-cookie:yes` is used (bsc#1271895).\n- CVE-2026-55708: Privacy/configuration issue when adding local data in views through `unbound-control` (bsc#1271896).\n- CVE-2026-55717: `serve-expired-client-timeout` and `response-ip` CNAME redirect could lead to a crash (bsc#1271886).\n- CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).\n- CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name\n  (bsc#1271889).\n- CVE-2026-56444: Degradation of resolution service when `discard-timeout` and `serve-expired-client-timeout` are\n  combined in unusual configuration (bsc#1271890).\n\nOther updates and bugfixes:\n\n- Version 1.25.2:\n  * For a complete list of additional changes see the changelog at https://nlnetlabs.nl/projects/unbound/download/\n- Update `unbound.keyring`.\n","status":"published","published":"2026-08-31T14:34:37Z","modified":"2026-09-10T18:23:45.222190322Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-8946-1","title":"unbound vulnerabilities","description":"It was discovered that Unbound incorrectly handled certain TCP connections.\nA remote attacker could possibly use this issue to cause Unbound to consume\nresources, leading to a denial of service. This issue only affected Ubuntu\n26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS and Ubuntu 20.04 LTS.\n(CVE-2026-80225)\n\nIt was discovered that Unbound incorrectly handled certain DNS responses. A\nremote attacker could possibly use this issue to crash Unbound, resulting\nin a denial of service. (CVE-2026-81634)\n\nIt was discovered that Unbound incorrectly handled certain DNS responses\nduring DNSSEC validation. A remote attacker could possibly use this issue\nto cause Unbound to consume resources, leading to a denial of service.\n(CVE-2026-85501)\n\nIt was discovered that Unbound incorrectly handled outgoing network ports.\nA remote attacker could possibly use this issue to crash Unbound, resulting\nin a denial of service. (CVE-2026-50252)\n\nIt was discovered that Unbound incorrectly handled certain DNSCrypt\npackets. A remote attacker could possibly use this issue to crash Unbound,\nresulting in a denial of service. This issue only affected Ubuntu 26.04\nLTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS and Ubuntu 18.04\nLTS. (CVE-2026-40691)\n\nIt was discovered that Unbound incorrectly handled certain cached DNS\nresponses. A remote attacker could possibly use this issue to poison\nUnbound's cache. This issue only affected Ubuntu 26.04 LTS, Ubuntu 24.04\nLTS, Ubuntu 22.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-44690)\n\nIt was discovered that Unbound incorrectly handled certain DNS-over-QUIC\nconnections. A remote attacker could possibly use this issue to cause\nUnbound to consume resources, leading to a denial of service. This issue\nonly affected Ubuntu 26.04 LTS. (CVE-2026-32665)\n\nIt was discovered that Unbound incorrectly handled certain EDNS options. A\nremote attacker could possibly use this issue to crash Unbound, resulting\nin a denial of service. This issue only affected Ubuntu 26.04 LTS.\n(CVE-2026-55973)\n\nElias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered\nthat Unbound incorrectly handled validating DNSSEC messages. A remote\nattacker could possibly use this issue to cause Unbound to consume\nresources, leading to a denial of service. This issue only affected Ubuntu\n18.04 LTS, Ubuntu 16.04 LTS and Ubuntu 14.04 LTS. (CVE-2023-50387)\n\nIt was discovered that Unbound incorrectly handled preparing an NSEC3\nclosest encloser proof. A remote attacker could possibly use this issue to\ncause Unbound to consume resources, leading to a denial of service. This\nissue only affected Ubuntu 18.04 LTS, Ubuntu 16.04 LTS and Ubuntu 14.04\nLTS. (CVE-2023-50868)","status":"published","published":"2026-10-21T09:48:45Z","modified":"2026-10-21T23:13:04.088658103Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}