{"id":"CVE-2026-52863","aliases":["ALPINE-CVE-2026-52863","AZL-92937","DEBIAN-CVE-2026-52863","EUVD-2026-47677","GHSA-5gh2-8ch2-g46c","MGASA-2026-0316","MGASA-2026-0451","RHSA-2026:43588","UBUNTU-CVE-2026-52863","openSUSE-SU-2026:11380-1"],"status":"published","title":"Memory corruption could lead to crash and denial of service","description":"In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of the view name in effect that could lead to memory corruption if the owner of the original view name is jostled out when Unbound is under pressure. Unbound needs to be configured with one of 'respip'/'rpz' modules, together with a module that can attach subqueries (respip CNAME redirection, dns64, subnetcache) and a configured 'access-control-view' while Unbound is under pressure so that joslte logic kicks in and starts dropping slow queries. The subquery is getting a shallow copy of the view name and if the super query which owns the view name is jostled out, memory corruption can occur. Likelihood of a crash is low, since it relies heavily on the underlying memory allocator and the memory layout. Debug memory builds (e.g., ASAN) that catch the free terminate the server.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00365,"percentile":0.3063,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2026-07-22T13:09:06Z","modified":"2026-10-26T02:30:49Z","fixes":[{"ecosystem":"Alpine:v3.22","package":"unbound","fixed_in":["1.25.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"unbound","fixed_in":["1.25.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"unbound","fixed_in":["1.25.2-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"unbound","fixed_in":["1.25.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"unbound","fixed_in":["1.26.1-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"unbound","fixed_in":["1.25.2-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.22","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.25.0"},{"fixed":"1.25.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.25.0"},{"fixed":"1.25.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.25.0"},{"fixed":"1.25.2-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17.1-2","1.17.1-2+deb12u1","1.17.1-2+deb12u2","1.17.1-2+deb12u3","1.17.1-2+deb12u4","1.17.1-2+loong64","1.18.0-1","1.18.0-2","1.19.1-1","1.19.2-1","1.20.0-1","1.21.1-1","1.22.0-1","1.22.0-2","1.23.1-1","1.24.0-1","1.24.0-2","1.24.1-1","1.24.1-2","1.24.2-1","1.25.0-1","1.25.1-1","1.25.2-1","1.26.0-1","1.26.0-2","1.26.1-1","1.26.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-0+deb13u1"}]}],"versions":["1.22.0-2","1.22.0-2+deb13u1","1.22.0-2+deb13u2","1.22.0-2+deb13u3","1.23.1-1","1.24.0-1","1.24.0-2","1.24.1-1","1.24.1-2","1.24.2-1","1.25.0-1","1.25.1-1","1.25.2-1","1.26.0-1","1.26.0-2"]},{"source":"osv","ecosystem":"Debian:14","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-1"}]}],"versions":["1.22.0-2","1.23.1-1","1.24.0-1","1.24.0-2","1.24.1-1","1.24.1-2","1.24.2-1","1.25.0-1","1.25.1-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-1.mga10"}]}],"bundled":24},{"source":"osv","ecosystem":"Mageia:9","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-1.mga9"}]}],"bundled":24},{"source":"osv","ecosystem":"Mageia:10","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-1.mga10"}]}],"bundled":34},{"source":"osv","ecosystem":"Mageia:9","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-1.mga9"}]}],"bundled":34},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.2-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.2-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-anchor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.2-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.2-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.2-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.2-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-munin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.2-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.2-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.20-1","1.4.21-1","1.4.21-1ubuntu1","1.4.21-1ubuntu2","1.4.22-1ubuntu1","1.4.22-1ubuntu2","1.4.22-1ubuntu3","1.4.22-1ubuntu4","1.4.22-1ubuntu4.14.04.1","1.4.22-1ubuntu4.14.04.2","1.4.22-1ubuntu4.14.04.3","1.4.22-1ubuntu4.14.04.3+esm1","1.4.22-1ubuntu4.14.04.3+esm2","1.4.22-1ubuntu4.14.04.3+esm3","1.4.22-1ubuntu4.14.04.3+esm4","1.4.22-1ubuntu4.14.04.3+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.22-1ubuntu6","1.5.7-1ubuntu1","1.5.7-1ubuntu2","1.5.8-1ubuntu1","1.5.8-1ubuntu1.1","1.5.8-1ubuntu1.1+esm1","1.5.8-1ubuntu1.1+esm2","1.5.8-1ubuntu1.1+esm3","1.5.8-1ubuntu1.1+esm4","1.5.8-1ubuntu1.1+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.5-1","1.6.7-1","1.6.7-1build1","1.6.7-1ubuntu1","1.6.7-1ubuntu2","1.6.7-1ubuntu2.1","1.6.7-1ubuntu2.2","1.6.7-1ubuntu2.3","1.6.7-1ubuntu2.4","1.6.7-1ubuntu2.5","1.6.7-1ubuntu2.6","1.6.7-1ubuntu2.6+esm2","1.6.7-1ubuntu2.6+esm3","1.6.7-1ubuntu2.6+esm4","1.6.7-1ubuntu2.6+esm5","1.6.7-1ubuntu2.6+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.0-2ubuntu1","1.9.0-2ubuntu2","1.9.4-2","1.9.4-2ubuntu1","1.9.4-2ubuntu1.1","1.9.4-2ubuntu1.2","1.9.4-2ubuntu1.3","1.9.4-2ubuntu1.4","1.9.4-2ubuntu1.5","1.9.4-2ubuntu1.6","1.9.4-2ubuntu1.8","1.9.4-2ubuntu1.9","1.9.4-2ubuntu1.11","1.9.4-2ubuntu1.11+esm1","1.9.4-2ubuntu1.11+esm2","1.9.4-2ubuntu1.11+esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.1-1ubuntu1","1.13.1-1ubuntu3","1.13.1-1ubuntu5","1.13.1-1ubuntu5.1","1.13.1-1ubuntu5.2","1.13.1-1ubuntu5.3","1.13.1-1ubuntu5.4","1.13.1-1ubuntu5.5","1.13.1-1ubuntu5.7","1.13.1-1ubuntu5.8","1.13.1-1ubuntu5.10","1.13.1-1ubuntu5.11","1.13.1-1ubuntu5.12","1.13.1-1ubuntu5.13","1.13.1-1ubuntu5.14","1.13.1-1ubuntu5.15","1.13.1-1ubuntu5.16","1.13.1-1ubuntu5.17"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17.1-2","1.18.0-2ubuntu1","1.18.0-2ubuntu2","1.19.1-1ubuntu1","1.19.2-1ubuntu1","1.19.2-1ubuntu3","1.19.2-1ubuntu3.1","1.19.2-1ubuntu3.2","1.19.2-1ubuntu3.3","1.19.2-1ubuntu3.4","1.19.2-1ubuntu3.5","1.19.2-1ubuntu3.6","1.19.2-1ubuntu3.7","1.19.2-1ubuntu3.8","1.19.2-1ubuntu3.9","1.19.2-1ubuntu3.10","1.19.2-1ubuntu3.12"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.2-1ubuntu2","1.25.1-1ubuntu1","1.25.1-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.0-2ubuntu2","1.22.0-2ubuntu4","1.24.2-1ubuntu1","1.24.2-1ubuntu2","1.24.2-1ubuntu2.1","1.24.2-1ubuntu2.2","1.24.2-1ubuntu2.3","1.24.2-1ubuntu2.4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-1.1"}]}],"bundled":24}],"products":[{"vendor":"nlnet labs","product":"unbound"},{"vendor":"nlnetlabs","product":"unbound"}],"references":[{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-52863.txt","tags":["vendor-advisory","Vendor Advisory","advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52863","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-5gh2-8ch2-g46c"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-52863","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-52863","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0316.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35991","tags":["report"]},{"url":"https://community.nlnetlabs.nl/t/unbound-1-25-2-released/3430","tags":["web","report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/22/7","tags":["web"]},{"url":"https://nlnetlabs.nl/projects/unbound/security-advisories/","tags":["advisory","article"]},{"url":"https://advisories.mageia.org/MGASA-2026-0451.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36346","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:43588","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-40691","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55717","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56416","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50251","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41637","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-52863","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55990","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42955","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55708","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50243","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50252","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-46582","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56444","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55991","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50046","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54478","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14586","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50248","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44687","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50045","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55973","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44690","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32665","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_43588.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506128","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14586","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14586","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-14586.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503060","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32665","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32665","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503062","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40691","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40691","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506143","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41637","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41637","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-41637.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506144","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42955","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42955","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42955.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506130","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44687","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44687","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-44687.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503063","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44690","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44690","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-44690.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506139","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-46582","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46582","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-46582.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506136","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50045","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50045","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50045.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506138","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50046","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50046","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50046.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506132","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50243","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50243","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50243.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506129","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50248","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50248","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50248.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506150","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50251","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50251","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50251.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506133","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50252","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50252","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50252.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506141","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-52863","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506146","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54478","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54478","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-54478.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506131","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55708","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55708","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-55708.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506135","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55717","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55717","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-55717.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503075","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55973","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55973","tags":["advisory"]},{"url":"https://nlnetlabs.nl/projects/unbound/download/#unbound-1-25-2","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506148","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55990","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55990","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-55990.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506147","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55991","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55991","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-55991.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506137","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56416","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56416","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-56416.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506142","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56444","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56444","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-56444.txt","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2026-52863","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44690","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46582","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54478","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56444","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-52863","title":"Memory corruption could lead to crash and denial of service","description":"In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of the view name in effect that could lead to memory corruption if the owner of the original view name is jostled out when Unbound is under pressure. Unbound needs to be configured with one of 'respip'/'rpz' modules, together with a module that can attach subqueries (respip CNAME redirection, dns64, subnetcache) and a configured 'access-control-view' while Unbound is under pressure so that joslte logic kicks in and starts dropping slow queries. The subquery is getting a shallow copy of the view name and if the super query which owns the view name is jostled out, memory corruption can occur. Likelihood of a crash is low, since it relies heavily on the underlying memory allocator and the memory layout. Debug memory builds (e.g., ASAN) that catch the free terminate the server.","status":"published","published":"2026-07-22T13:09:06.454Z","modified":"2026-07-22T14:17:58.654Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T13:40:57.334596Z"}],"euvd":[{"id":"EUVD-2026-47677","description":"In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of the view name in effect that could lead to memory corruption if the owner of the original view name is jostled out when Unbound is under pressure. Unbound needs to be configured with one of 'respip'/'rpz' modules, together with a module that can attach subqueries (respip CNAME redirection, dns64, subnetcache) and a configured 'access-control-view' while Unbound is under pressure so that joslte logic kicks in and starts dropping slow queries. The subquery is getting a shallow copy of the view name and if the super query which owns the view name is jostled out, memory corruption can occur. Likelihood of a crash is low, since it relies heavily on the underlying memory allocator and the memory layout. Debug memory builds (e.g., ASAN) that catch the free terminate the server.","status":"published","published":"2026-07-22T13:09:06Z","modified":"2026-07-22T14:17:58Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:19:46.391735Z"}],"ghsa":[{"id":"GHSA-5gh2-8ch2-g46c","title":"In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64...","description":"In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of the view name in effect that could lead to memory corruption if the owner of the original view name is jostled out when Unbound is under pressure. Unbound needs to be configured with one of 'respip'/'rpz' modules, together with a module that can attach subqueries (respip CNAME redirection, dns64, subnetcache) and a configured 'access-control-view' while Unbound is under pressure so that joslte logic kicks in and starts dropping slow queries. The subquery is getting a shallow copy of the view name and if the super query which owns the view name is jostled out, memory corruption can occur. Likelihood of a crash is low, since it relies heavily on the underlying memory allocator and the memory layout. Debug memory builds (e.g., ASAN) that catch the free terminate the server.","status":"published","published":"2026-07-22T15:31:24Z","modified":"2026-07-22T15:31:33Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:09:39.270941Z"}],"nvd":[{"id":"CVE-2026-52863","description":"In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of the view name in effect that could lead to memory corruption if the owner of the original view name is jostled out when Unbound is under pressure. Unbound needs to be configured with one of 'respip'/'rpz' modules, together with a module that can attach subqueries (respip CNAME redirection, dns64, subnetcache) and a configured 'access-control-view' while Unbound is under pressure so that joslte logic kicks in and starts dropping slow queries. The subquery is getting a shallow copy of the view name and if the super query which owns the view name is jostled out, memory corruption can occur. Likelihood of a crash is low, since it relies heavily on the underlying memory allocator and the memory layout. Debug memory builds (e.g., ASAN) that catch the free terminate the server.","status":"published","published":"2026-07-22T14:17:20.757Z","modified":"2026-10-24T13:10:00.147Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:12:32.089897Z"}],"osv":[{"id":"ALPINE-CVE-2026-52863","description":"In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of the view name in effect that could lead to memory corruption if the owner of the original view name is jostled out when Unbound is under pressure. Unbound needs to be configured with one of 'respip'/'rpz' modules, together with a module that can attach subqueries (respip CNAME redirection, dns64, subnetcache) and a configured 'access-control-view' while Unbound is under pressure so that joslte logic kicks in and starts dropping slow queries. The subquery is getting a shallow copy of the view name and if the super query which owns the view name is jostled out, memory corruption can occur. Likelihood of a crash is low, since it relies heavily on the underlying memory allocator and the memory layout. Debug memory builds (e.g., ASAN) that catch the free terminate the server.","status":"published","published":"2026-07-22T14:17:20.757Z","modified":"2026-10-01T02:17:49.335989582Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"CVE-2026-52863","description":"In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of the view name in effect that could lead to memory corruption if the owner of the original view name is jostled out when Unbound is under pressure. Unbound needs to be configured with one of 'respip'/'rpz' modules, together with a module that can attach subqueries (respip CNAME redirection, dns64, subnetcache) and a configured 'access-control-view' while Unbound is under pressure so that joslte logic kicks in and starts dropping slow queries. The subquery is getting a shallow copy of the view name and if the super query which owns the view name is jostled out, memory corruption can occur. Likelihood of a crash is low, since it relies heavily on the underlying memory allocator and the memory layout. Debug memory builds (e.g., ASAN) that catch the free terminate the server.","status":"published","published":"2026-07-22T14:17:20.757Z","modified":"2026-10-26T02:30:49.69083957Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:07.431113Z"},{"id":"DEBIAN-CVE-2026-52863","description":"In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of the view name in effect that could lead to memory corruption if the owner of the original view name is jostled out when Unbound is under pressure. Unbound needs to be configured with one of 'respip'/'rpz' modules, together with a module that can attach subqueries (respip CNAME redirection, dns64, subnetcache) and a configured 'access-control-view' while Unbound is under pressure so that joslte logic kicks in and starts dropping slow queries. The subquery is getting a shallow copy of the view name and if the super query which owns the view name is jostled out, memory corruption can occur. Likelihood of a crash is low, since it relies heavily on the underlying memory allocator and the memory layout. Debug memory builds (e.g., ASAN) that catch the free terminate the server.","status":"published","published":"2026-07-22T14:17:20.757Z","modified":"2026-10-25T10:00:55.833525884Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:56.877408Z"},{"id":"RHSA-2026:43588","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-23T10:14:32Z","modified":"2026-10-20T10:09:15Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"UBUNTU-CVE-2026-52863","description":"In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of the view name in effect that could lead to memory corruption if the owner of the original view name is jostled out when Unbound is under pressure. Unbound needs to be configured with one of 'respip'/'rpz' modules, together with a module that can attach subqueries (respip CNAME redirection, dns64, subnetcache) and a configured 'access-control-view' while Unbound is under pressure so that joslte logic kicks in and starts dropping slow queries. The subquery is getting a shallow copy of the view name and if the super query which owns the view name is jostled out, memory corruption can occur. Likelihood of a crash is low, since it relies heavily on the underlying memory allocator and the memory layout. Debug memory builds (e.g., ASAN) that catch the free terminate the server.","status":"published","published":"2026-07-22T14:17:00Z","modified":"2026-10-21T16:30:59.894873062Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"AZL-92937","title":"CVE-2026-52863 affecting package unbound for versions less than 1.25.2-1","description":"In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of the view name in effect that could lead to memory corruption if the owner of the original view name is jostled out when Unbound is under pressure. Unbound needs to be configured with one of 'respip'/'rpz' modules, together with a module that can attach subqueries (respip CNAME redirection, dns64, subnetcache) and a configured 'access-control-view' while Unbound is under pressure so that joslte logic kicks in and starts dropping slow queries. The subquery is getting a shallow copy of the view name and if the super query which owns the view name is jostled out, memory corruption can occur. Likelihood of a crash is low, since it relies heavily on the underlying memory allocator and the memory layout. Debug memory builds (e.g., ASAN) that catch the free terminate the server.","status":"published","published":"2026-07-22T14:17:20Z","modified":"2026-08-28T17:56:40.491963Z","updated_at":"2026-11-02T15:28:11.723718Z"},{"id":"MGASA-2026-0316","title":"Updated unbound packages fix security vulnerabilities","description":"Unbound packages updated to version 1.25.2 which incorporates a number\nof security and bug fixes.\n","status":"published","published":"2026-08-03T18:47:23Z","modified":"2026-08-03T19:00:05.516020211Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"MGASA-2026-0451","title":"Updated unbound packages fixes security vulnerabilities","description":"Heap buffer overflow and possible Remote Code Execution when digesting\nDNSKEY\nPossible heap buffer overflow during DNSSEC canonicalization\nCNAME synthesis could lead to heap corruption\nPossible ZONEMD verification bypass window\nUse-after-free in DoQ stream output buffer on reset re-transmission\nPossible degradation of service from continuous queries on the same\nTCP/DoT connection\nUse-after-free in DoH stream cleanup code path\nRetrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks\non DNSSEC\n'serve-expired' can bypass Unbound 'wait-limit'\nRemote DNS-over-QUIC denial of service due to 'quic-size' budget bypass\nPacket of death for DNSCrypt over TCP\nCross-zone wildcard cache poisoning via RRSIG.labels manipulation\n'dns-error-reporting: yes' leads to stack buffer overflow\nAssertion in libngtcp2 when under pressure in high concurrency\nDNS-over-QUIC environments\nLibunbound applications configured with 'unwanted-reply-threshold' could\neventually be abruptly terminated\n'max-global-quota' reset by DNSSEC validation restarts\nPossible heap use-after-free in an error path when a DoT forwarded query\nis jostled out\n'response-ip'/'rpz' can rewrite BOGUS answers instead of returning\nSERVFAIL\nBOGUS configured primary hostname accepted for XFR in auth/rpz zones\nDate:\nAttacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache\nflush\nPossible cache poisoning attack by mapping source port population per\nthread\nMemory corruption could lead to crash and denial of service\n'serve-expired-client-timeout' and 'response-ip' CNAME redirect could\nlead to a crash\nPacket of death for a DNSCrypt misconfigured Unbound\nRemote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2\nPossible heap buffer overflow when validator canonicalizes RDATA that\ncontains domain name\nDegradation of resolution service when 'discard-timeout' and\n'serve-expired-client-timeout' are combined in unusual configuration\nDegradation of resolution service from improperly accounted\nclient-terminated DNS-over-QUIC queries\nExtra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records\ndisallowing a one-time 'ghost domain' delegation renewal via glue\nrecords\nOff-by-one error in 'harden-below-nxdomain' logic can shadow a\nstub/forward zone by a legitimate parent's NXDOMAIN\nA wildcard replay, as another piece of data, triggers poisoning in the\nserve expired reply path\nDNS Cookie bypass when combined with proxy-protocol use\nPrivacy/configuration issue when adding local data in views through\n'unbound-control'\nPossible arbitrary code execution during DNSSEC validation\nHeap overflow with multiple NSID, COOKIE, PADDING EDNS options\nCrash during DNSSEC validation of malicious content\nDate:\nPacket of death with DNSCrypt\nAnother \"ghost domain names\" attack variant\nLong list of incoming EDNS options degrades performance\nJostle logic bypass degrades resolution performance\nDegradation of service with unbounded NSEC3 hash calculations\nPossible cache poisoning via promiscuous records for the authority\nsection\nUnbounded name compression in certain cases causes degradation of\nservice\nUse after free and crash under special conditions in RPZ code\nPossible domain hijacking via promiscuous records in the authority\nsection\nCache poisoning via the ECS-enabled Rebirthday Attack\nUnbounded name compression could lead to Denial of Service\nUnbound vulnerable to the \"DNSBomb\" pulsing DoS amplification attack\nDenial of service when trimming EDE text on positive replies\nDNSSEC verification complexity can be exploited to exhaust CPU resources\nand stall DNS resolvers\nNSEC3 closest encloser proof can exhaust CPU\nNon-Responsive Delegation Attack\nNovel \"ghost domain names\" attack by updating almost expired delegation\ninformation\nNovel \"ghost domain names\" attack by introducing subdomain delegations\nLocal symlink attack\nVulnerability in Domain Parse\nNXNSAttack\nVulnerability in IPSEC module\nVulnerability in parsing NOTIFY queries\nVulnerability in the processing of wildcard synthesized NSEC records\nNo limit to delegation chaining\nGhost domain names attack\nIncorrect proof processing for NSEC3-signed zone\nProcessing of duplicate CNAME records in a signed zone\nEmpty error packet handling assertion failure\n","status":"published","published":"2026-09-25T05:02:40Z","modified":"2026-09-25T05:15:03.49547618Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11380-1","title":"libunbound8-1.25.2-1.1 on GA media","description":"These are all security issues fixed in the libunbound8-1.25.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-26T00:00:00Z","modified":"2026-07-27T09:00:10.044193884Z","updated_at":"2026-11-02T16:58:39.516824Z"}]}}