{"id":"CVE-2026-80225","aliases":["AZL-101724","CLSA-2026-1790784899","CLSA-2026-1790803691","CLSA-2026-1791261872","DEBIAN-CVE-2026-80225","EUVD-2026-80289","GHSA-8wrv-pfvg-j383","MGASA-2026-0451","OESA-2026-4148","OESA-2026-4149","OESA-2026-4150","OESA-2026-4151","RHSA-2026:68590","SUSE-SU-2026:24128-1","SUSE-SU-2026:24135-1","SUSE-SU-2026:24226-1","SUSE-SU-2026:24376-1","SUSE-SU-2026:4620-1","SUSE-SU-2026:4624-1","UBUNTU-CVE-2026-80225","USN-8946-1","openSUSE-SU-2026:11930-1","openSUSE-SU-2026:22082-1"],"status":"published","title":"Possible degradation of service from continuous queries on the same TCP/DoT connection","description":"In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00482,"percentile":0.41889,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2026-09-16T08:30:04Z","modified":"2026-10-27T17:27:19Z","fixes":[{"ecosystem":"Azure Linux:3","package":"unbound","fixed_in":["1.26.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"unbound","fixed_in":["1.26.1-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"unbound","fixed_in":["1.26.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"unbound","fixed_in":["1.9.4-2ubuntu1.11+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"unbound","fixed_in":["1.13.1-1ubuntu5.17"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"unbound","fixed_in":["1.19.2-1ubuntu3.12"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"unbound","fixed_in":["1.24.2-1ubuntu2.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-19.el9_6.1.tuxcare.els14"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-19.el9_6.1.tuxcare.els14"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-19.el9_6.1.tuxcare.els14"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"unbound-dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-19.el9_6.1.tuxcare.els14"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-19.el9_6.1.tuxcare.els14"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-3.el9_2.tuxcare.els16"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-3.el9_2.tuxcare.els16"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-3.el9_2.tuxcare.els16"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-3.el9_2.tuxcare.els16"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-5.el8.tuxcare.els12"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-5.el8.tuxcare.els12"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-5.el8.tuxcare.els12"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-5.el8.tuxcare.els12"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17.1-2","1.17.1-2+deb12u1","1.17.1-2+deb12u2","1.17.1-2+deb12u3","1.17.1-2+deb12u4","1.17.1-2+loong64","1.18.0-1","1.18.0-2","1.19.1-1","1.19.2-1","1.20.0-1","1.21.1-1","1.22.0-1","1.22.0-2","1.23.1-1","1.24.0-1","1.24.0-2","1.24.1-1","1.24.1-2","1.24.2-1","1.25.0-1","1.25.1-1","1.25.2-1","1.26.0-1","1.26.0-2","1.26.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-0+deb13u1"}]}],"versions":["1.22.0-2","1.22.0-2+deb13u1","1.22.0-2+deb13u2","1.22.0-2+deb13u3","1.23.1-1","1.24.0-1","1.24.0-2","1.24.1-1","1.24.1-2","1.24.2-1","1.25.0-1","1.25.1-1","1.25.2-1","1.26.0-1","1.26.0-2"]},{"source":"osv","ecosystem":"Debian:14","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-1"}]}],"versions":["1.22.0-2","1.23.1-1","1.24.0-1","1.24.0-2","1.24.1-1","1.24.1-2","1.24.2-1","1.25.0-1","1.25.1-1","1.25.2-1","1.26.0-1","1.26.0-2"]},{"source":"osv","ecosystem":"Mageia:10","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-1.mga10"}]}],"bundled":34},{"source":"osv","ecosystem":"Mageia:9","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-1.mga9"}]}],"bundled":34},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-22.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-22.oe2403sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-22.oe2403sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-28.oe2203sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.1-1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.1-1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-anchor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.1-1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.1-1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.1-1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.1-1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-munin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.1-1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.1-1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-159998.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-slfo.1.1_1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150600.23.24.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150600.23.24.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150600.23.24.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150600.23.24.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150100.10.31.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150100.10.31.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150100.10.31.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150100.10.31.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150100.10.31.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150100.10.31.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150100.10.31.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150100.10.31.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150100.10.31.1"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-2ubuntu1.11+esm3"}]}],"versions":["1.9.0-2ubuntu1","1.9.0-2ubuntu2","1.9.4-2","1.9.4-2ubuntu1","1.9.4-2ubuntu1.1","1.9.4-2ubuntu1.2","1.9.4-2ubuntu1.3","1.9.4-2ubuntu1.4","1.9.4-2ubuntu1.5","1.9.4-2ubuntu1.6","1.9.4-2ubuntu1.8","1.9.4-2ubuntu1.9","1.9.4-2ubuntu1.11","1.9.4-2ubuntu1.11+esm1","1.9.4-2ubuntu1.11+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-1ubuntu5.17"}]}],"versions":["1.13.1-1ubuntu1","1.13.1-1ubuntu3","1.13.1-1ubuntu5","1.13.1-1ubuntu5.1","1.13.1-1ubuntu5.2","1.13.1-1ubuntu5.3","1.13.1-1ubuntu5.4","1.13.1-1ubuntu5.5","1.13.1-1ubuntu5.7","1.13.1-1ubuntu5.8","1.13.1-1ubuntu5.10","1.13.1-1ubuntu5.11","1.13.1-1ubuntu5.12","1.13.1-1ubuntu5.13","1.13.1-1ubuntu5.14","1.13.1-1ubuntu5.15","1.13.1-1ubuntu5.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-1ubuntu3.12"}]}],"versions":["1.17.1-2","1.18.0-2ubuntu1","1.18.0-2ubuntu2","1.19.1-1ubuntu1","1.19.2-1ubuntu1","1.19.2-1ubuntu3","1.19.2-1ubuntu3.1","1.19.2-1ubuntu3.2","1.19.2-1ubuntu3.3","1.19.2-1ubuntu3.4","1.19.2-1ubuntu3.5","1.19.2-1ubuntu3.6","1.19.2-1ubuntu3.7","1.19.2-1ubuntu3.8","1.19.2-1ubuntu3.9","1.19.2-1ubuntu3.10"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.2-1ubuntu2","1.25.1-1ubuntu1","1.25.1-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-1ubuntu2.4"}]}],"versions":["1.22.0-2ubuntu2","1.22.0-2ubuntu4","1.24.2-1ubuntu1","1.24.2-1ubuntu2","1.24.2-1ubuntu2.1","1.24.2-1ubuntu2.2","1.24.2-1ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.22-1ubuntu4.14.04.3+esm5"}]}],"versions":["1.4.20-1","1.4.21-1","1.4.21-1ubuntu1","1.4.21-1ubuntu2","1.4.22-1ubuntu1","1.4.22-1ubuntu2","1.4.22-1ubuntu3","1.4.22-1ubuntu4","1.4.22-1ubuntu4.14.04.1","1.4.22-1ubuntu4.14.04.2","1.4.22-1ubuntu4.14.04.3","1.4.22-1ubuntu4.14.04.3+esm1","1.4.22-1ubuntu4.14.04.3+esm2","1.4.22-1ubuntu4.14.04.3+esm3","1.4.22-1ubuntu4.14.04.3+esm4"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.8-1ubuntu1.1+esm5"}]}],"versions":["1.4.22-1ubuntu6","1.5.7-1ubuntu1","1.5.7-1ubuntu2","1.5.8-1ubuntu1","1.5.8-1ubuntu1.1","1.5.8-1ubuntu1.1+esm1","1.5.8-1ubuntu1.1+esm2","1.5.8-1ubuntu1.1+esm3","1.5.8-1ubuntu1.1+esm4"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.7-1ubuntu2.6+esm6"}]}],"versions":["1.6.5-1","1.6.7-1","1.6.7-1build1","1.6.7-1ubuntu1","1.6.7-1ubuntu2","1.6.7-1ubuntu2.1","1.6.7-1ubuntu2.2","1.6.7-1ubuntu2.3","1.6.7-1ubuntu2.4","1.6.7-1ubuntu2.5","1.6.7-1ubuntu2.6","1.6.7-1ubuntu2.6+esm2","1.6.7-1ubuntu2.6+esm3","1.6.7-1ubuntu2.6+esm4","1.6.7-1ubuntu2.6+esm5"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-2ubuntu1.11+esm3"}]}],"versions":["1.9.0-2ubuntu1","1.9.0-2ubuntu2","1.9.4-2","1.9.4-2ubuntu1","1.9.4-2ubuntu1.1","1.9.4-2ubuntu1.2","1.9.4-2ubuntu1.3","1.9.4-2ubuntu1.4","1.9.4-2ubuntu1.5","1.9.4-2ubuntu1.6","1.9.4-2ubuntu1.8","1.9.4-2ubuntu1.9","1.9.4-2ubuntu1.11","1.9.4-2ubuntu1.11+esm1","1.9.4-2ubuntu1.11+esm2"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-1ubuntu5.17"}]}],"versions":["1.13.1-1ubuntu1","1.13.1-1ubuntu3","1.13.1-1ubuntu5","1.13.1-1ubuntu5.1","1.13.1-1ubuntu5.2","1.13.1-1ubuntu5.3","1.13.1-1ubuntu5.4","1.13.1-1ubuntu5.5","1.13.1-1ubuntu5.7","1.13.1-1ubuntu5.8","1.13.1-1ubuntu5.10","1.13.1-1ubuntu5.11","1.13.1-1ubuntu5.12","1.13.1-1ubuntu5.13","1.13.1-1ubuntu5.14","1.13.1-1ubuntu5.15","1.13.1-1ubuntu5.16"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-1ubuntu3.12"}]}],"versions":["1.17.1-2","1.18.0-2ubuntu1","1.18.0-2ubuntu2","1.19.1-1ubuntu1","1.19.2-1ubuntu1","1.19.2-1ubuntu3","1.19.2-1ubuntu3.1","1.19.2-1ubuntu3.2","1.19.2-1ubuntu3.3","1.19.2-1ubuntu3.4","1.19.2-1ubuntu3.5","1.19.2-1ubuntu3.6","1.19.2-1ubuntu3.7","1.19.2-1ubuntu3.8","1.19.2-1ubuntu3.9","1.19.2-1ubuntu3.10"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-1ubuntu2.4"}]}],"versions":["1.22.0-2ubuntu2","1.22.0-2ubuntu4","1.24.2-1ubuntu1","1.24.2-1ubuntu2","1.24.2-1ubuntu2.1","1.24.2-1ubuntu2.2","1.24.2-1ubuntu2.3"],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-160000.1.1"}]}],"bundled":9}],"products":[{"vendor":"nlnet labs","product":"unbound"},{"vendor":"nlnetlabs","product":"unbound"}],"references":[{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-80225.txt","tags":["vendor-advisory","Patch","Vendor Advisory","fix","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80225","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-8wrv-pfvg-j383"},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1790784899.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81634","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1790803691.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1791261872.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-50387","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85501","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-80225","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0451.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36346","tags":["report"]},{"url":"https://nlnetlabs.nl/projects/unbound/security-advisories/","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4148","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82717","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4149","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4150","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4151","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68590","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-81642","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-82720","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-81634","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-80225","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-77860","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-77955","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-85501","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-82717","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-78227","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68590.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535050","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-77860","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77860","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-77860.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535053","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-77955","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77955","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-77955.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535052","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-78227","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78227","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-78227.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535055","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80225","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535054","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81634","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81634.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535059","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81642","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81642","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81642.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535051","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-82717","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-82717.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535060","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-82720","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82720","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-82720.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535057","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85501","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-85501.txt","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624128-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1280403","tags":["report"]},{"url":"https://bugzilla.suse.com/1280404","tags":["report"]},{"url":"https://bugzilla.suse.com/1280405","tags":["report"]},{"url":"https://bugzilla.suse.com/1280406","tags":["report"]},{"url":"https://bugzilla.suse.com/1280409","tags":["report"]},{"url":"https://bugzilla.suse.com/1280411","tags":["report"]},{"url":"https://bugzilla.suse.com/1280412","tags":["report"]},{"url":"https://bugzilla.suse.com/1280413","tags":["report"]},{"url":"https://bugzilla.suse.com/1280414","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81642","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-82717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-82720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85501","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624135-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50248","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624226-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624376-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264620-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264624-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-80225","tags":["report"]},{"url":"https://nlnetlabs.nl/downloads/unbound/CVE-2026-80225.txt","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8946-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-50387","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-50868","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-32665","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-40691","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-44690","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-50252","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55973","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-81634","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-85501","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-80225","title":"Possible degradation of service from continuous queries on the same TCP/DoT connection","description":"In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.","status":"published","published":"2026-09-16T08:30:04.246Z","modified":"2026-09-16T14:33:08.344Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T13:45:25.313702Z"}],"euvd":[{"id":"EUVD-2026-80289","description":"In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.","status":"published","published":"2026-09-16T08:30:04Z","modified":"2026-09-16T14:33:08Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T17:28:15.854171Z"}],"ghsa":[{"id":"GHSA-8wrv-pfvg-j383","title":"In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is...","description":"In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.","status":"published","published":"2026-09-16T09:30:27Z","modified":"2026-09-16T09:30:27Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:11:57.71972Z"}],"nvd":[{"id":"CVE-2026-80225","description":"In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.","status":"published","published":"2026-09-16T09:17:06.1Z","modified":"2026-09-23T19:57:08.517Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:12:48.287983Z"}],"osv":[{"id":"CVE-2026-80225","description":"In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.","status":"published","published":"2026-09-16T09:17:06.1Z","modified":"2026-10-27T17:27:19.674769012Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:17.44708Z"},{"id":"DEBIAN-CVE-2026-80225","description":"In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.","status":"published","published":"2026-09-16T09:17:06.1Z","modified":"2026-09-24T09:00:13.978630748Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:04.001673Z"},{"id":"OESA-2026-4148","title":"unbound security update","description":"Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn\u0026amp;apos;t make custom builds or provide specific features to paying customers only.\r\n\r\nSecurity Fix(es):\n\nIn NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker\u0026apos;s entire event loop for as long as its writes stay ahead of the drain.(CVE-2026-80225)\n\nIn NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNSSEC validation), can trigger the vulnerability.(CVE-2026-81634)\n\nIn NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.(CVE-2026-82717)","status":"published","published":"2026-09-30T13:47:04Z","modified":"2026-10-01T02:00:05.381438713Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4149","title":"unbound security update","description":"Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn\u0026amp;apos;t make custom builds or provide specific features to paying customers only.\r\n\r\nSecurity Fix(es):\n\nIn NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker\u0026apos;s entire event loop for as long as its writes stay ahead of the drain.(CVE-2026-80225)\n\nIn NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNSSEC validation), can trigger the vulnerability.(CVE-2026-81634)\n\nIn NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.(CVE-2026-82717)","status":"published","published":"2026-09-30T13:47:04Z","modified":"2026-10-01T02:00:03.610130517Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4150","title":"unbound security update","description":"Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn\u0026amp;apos;t make custom builds or provide specific features to paying customers only.\r\n\r\nSecurity Fix(es):\n\nIn NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker\u0026apos;s entire event loop for as long as its writes stay ahead of the drain.(CVE-2026-80225)\n\nIn NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNSSEC validation), can trigger the vulnerability.(CVE-2026-81634)\n\nIn NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.(CVE-2026-82717)","status":"published","published":"2026-09-30T13:47:05Z","modified":"2026-10-01T02:00:06.079840941Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4151","title":"unbound security update","description":"Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn\u0026amp;apos;t make custom builds or provide specific features to paying customers only.\r\n\r\nSecurity Fix(es):\n\nIn NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker\u0026apos;s entire event loop for as long as its writes stay ahead of the drain.(CVE-2026-80225)\n\nIn NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNSSEC validation), can trigger the vulnerability.(CVE-2026-81634)\n\nIn NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.(CVE-2026-82717)","status":"published","published":"2026-09-30T13:47:05Z","modified":"2026-10-01T02:00:06.077792682Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"RHSA-2026:68590","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-22T10:19:16Z","modified":"2026-10-17T10:18:35Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"UBUNTU-CVE-2026-80225","description":"In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.","status":"published","published":"2026-09-16T09:17:00Z","modified":"2026-10-21T23:02:21.463975127Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:18.015985Z"},{"id":"AZL-101724","title":"CVE-2026-80225 affecting package unbound for versions less than 1.26.1-1","description":"In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.","status":"published","published":"2026-09-16T09:17:06Z","modified":"2026-09-23T14:15:57.165359115Z","updated_at":"2026-11-02T15:28:00.508704Z"},{"id":"CLSA-2026-1790784899","title":"unbound: Fix of 2 CVEs","description":"- CVE-2026-81634: bounds-check the scratch buffer in rrset_canonical() and\n  rrset_canonicalize_to_buffer() before writing the RRSIG rdata, the first\n  canonical owner name and each RR's rdata, so a large rrset can no longer\n  be written past the end of the buffer\n- CVE-2026-80225: cap the number of pipelined TCP/DoT queries drained per\n  event-loop visit in tcp_req_info_read_again() and tcp_more_read_again()\n  and defer the remainder via a zero-delay timer, so one connection can no\n  longer starve the other file descriptors","status":"published","published":"2026-09-30T16:15:13Z","modified":"2026-10-26T09:43:43.545823384Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790803691","title":"unbound: Fix of 2 CVEs","description":"- CVE-2026-81634: check the remaining buffer space in rrset_canonical()\n  and rrset_canonicalize_to_buffer() before writing the signature, owner\n  name and RDATA, so an oversized RRset can no longer overflow the heap\n  buffer during DNSSEC canonicalization; includes the upstream unit test\n- CVE-2026-80225: cap the pipelined queries drained from one TCP/DoT\n  connection per event-loop turn (NUM_TCP_PER_SELECT) and defer the rest\n  with a zero-delay timer, so one client can no longer starve other\n  connections","status":"published","published":"2026-09-30T21:28:25Z","modified":"2026-10-26T09:43:50.59905145Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1791261872","title":"unbound: Fix of 4 CVEs","description":"- CVE-2026-81634: bounds-check the scratch buffer in rrset_canonical() and\n  rrset_canonicalize_to_buffer() before writing the RRSIG rdata, the first\n  canonical owner name and each RR's rdata, so a large rrset can no longer\n  be written past the end of the buffer\n- CVE-2026-80225: cap the number of pipelined TCP/DoT queries drained per\n  event-loop visit in tcp_req_info_read_again() and tcp_more_read_again()\n  and defer the remainder via a zero-delay timer, so one connection can no\n  longer starve the other file descriptors\n- CVE-2026-85501: bound the DNSSEC validation work per query (ReTrap): add\n  the val-validation-attempts and val-hash-attempts limits (default 32),\n  limit DNSKEY/RRSIG and DS key-tag matches and the NSEC/NSEC3 records\n  checked per message, shorten oversized referral DS RRsets, stop validator\n  restarts once the limits are hit, and require only the answer and\n  authority sections to be secure; the built-in val-clean-additional\n  default is now no, the shipped unbound.conf keeps val-clean-additional: yes","status":"published","published":"2026-10-19T14:45:10Z","modified":"2026-10-26T09:43:32.552617974Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"MGASA-2026-0451","title":"Updated unbound packages fixes security vulnerabilities","description":"Heap buffer overflow and possible Remote Code Execution when digesting\nDNSKEY\nPossible heap buffer overflow during DNSSEC canonicalization\nCNAME synthesis could lead to heap corruption\nPossible ZONEMD verification bypass window\nUse-after-free in DoQ stream output buffer on reset re-transmission\nPossible degradation of service from continuous queries on the same\nTCP/DoT connection\nUse-after-free in DoH stream cleanup code path\nRetrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks\non DNSSEC\n'serve-expired' can bypass Unbound 'wait-limit'\nRemote DNS-over-QUIC denial of service due to 'quic-size' budget bypass\nPacket of death for DNSCrypt over TCP\nCross-zone wildcard cache poisoning via RRSIG.labels manipulation\n'dns-error-reporting: yes' leads to stack buffer overflow\nAssertion in libngtcp2 when under pressure in high concurrency\nDNS-over-QUIC environments\nLibunbound applications configured with 'unwanted-reply-threshold' could\neventually be abruptly terminated\n'max-global-quota' reset by DNSSEC validation restarts\nPossible heap use-after-free in an error path when a DoT forwarded query\nis jostled out\n'response-ip'/'rpz' can rewrite BOGUS answers instead of returning\nSERVFAIL\nBOGUS configured primary hostname accepted for XFR in auth/rpz zones\nDate:\nAttacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache\nflush\nPossible cache poisoning attack by mapping source port population per\nthread\nMemory corruption could lead to crash and denial of service\n'serve-expired-client-timeout' and 'response-ip' CNAME redirect could\nlead to a crash\nPacket of death for a DNSCrypt misconfigured Unbound\nRemote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2\nPossible heap buffer overflow when validator canonicalizes RDATA that\ncontains domain name\nDegradation of resolution service when 'discard-timeout' and\n'serve-expired-client-timeout' are combined in unusual configuration\nDegradation of resolution service from improperly accounted\nclient-terminated DNS-over-QUIC queries\nExtra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records\ndisallowing a one-time 'ghost domain' delegation renewal via glue\nrecords\nOff-by-one error in 'harden-below-nxdomain' logic can shadow a\nstub/forward zone by a legitimate parent's NXDOMAIN\nA wildcard replay, as another piece of data, triggers poisoning in the\nserve expired reply path\nDNS Cookie bypass when combined with proxy-protocol use\nPrivacy/configuration issue when adding local data in views through\n'unbound-control'\nPossible arbitrary code execution during DNSSEC validation\nHeap overflow with multiple NSID, COOKIE, PADDING EDNS options\nCrash during DNSSEC validation of malicious content\nDate:\nPacket of death with DNSCrypt\nAnother \"ghost domain names\" attack variant\nLong list of incoming EDNS options degrades performance\nJostle logic bypass degrades resolution performance\nDegradation of service with unbounded NSEC3 hash calculations\nPossible cache poisoning via promiscuous records for the authority\nsection\nUnbounded name compression in certain cases causes degradation of\nservice\nUse after free and crash under special conditions in RPZ code\nPossible domain hijacking via promiscuous records in the authority\nsection\nCache poisoning via the ECS-enabled Rebirthday Attack\nUnbounded name compression could lead to Denial of Service\nUnbound vulnerable to the \"DNSBomb\" pulsing DoS amplification attack\nDenial of service when trimming EDE text on positive replies\nDNSSEC verification complexity can be exploited to exhaust CPU resources\nand stall DNS resolvers\nNSEC3 closest encloser proof can exhaust CPU\nNon-Responsive Delegation Attack\nNovel \"ghost domain names\" attack by updating almost expired delegation\ninformation\nNovel \"ghost domain names\" attack by introducing subdomain delegations\nLocal symlink attack\nVulnerability in Domain Parse\nNXNSAttack\nVulnerability in IPSEC module\nVulnerability in parsing NOTIFY queries\nVulnerability in the processing of wildcard synthesized NSEC records\nNo limit to delegation chaining\nGhost domain names attack\nIncorrect proof processing for NSEC3-signed zone\nProcessing of duplicate CNAME records in a signed zone\nEmpty error packet handling assertion failure\n","status":"published","published":"2026-09-25T05:02:40Z","modified":"2026-09-25T05:15:03.49547618Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11930-1","title":"libunbound8-1.26.1-1.1 on GA media","description":"These are all security issues fixed in the libunbound8-1.26.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-29T00:00:00Z","modified":"2026-09-30T18:23:14.940782144Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22082-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\n- CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' (bsc#1280403).\n- CVE-2026-77955: Possible ZONEMD verification bypass window (bsc#1280404).\n- CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission (bsc#1280405).\n- CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection (bsc#1280406).\n- CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization (bsc#1280409).\n- CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (bsc#1280411).\n- CVE-2026-82717: CNAME synthesis could lead to heap corruption (bsc#1280412).\n- CVE-2026-82720: Use-after-free in DoH stream cleanup code path (bsc#1280413).\n- CVE-2026-85501: Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC (bsc#1280414).\n\nChanges for unbound:\n\n- Update to 1.26.1:\n * Update icannbundle.pem certificates in unbound-anchor, valid\n for 2009-2029 and 2025-2045\n * Add max-transfer-size and max-transfer-time options to limit\n auth-zone and rpz transfer size and time, default disabled\n * Overload local_data_remove in unbound-control to also remove\n specific records\n * Add local-zone types block_aaaa, block_a_wdata and\n block_aaaa_wdata; fix respip+dns64 to use original A records\n instead of ones already modified by respip\n * ipsecmod hook script now needs to start with '#!/bin/sh', it\n is executed with execv instead of system for security\n * Server now continues to start if a secondary zone fails to\n load from its zonefile, or if a primary zonefile is missing;\n $INCLUDE is no longer allowed in secondary zone zonefiles\n * Auth-zone and RPZ zones now drop out-of-zone content on load\n * Primary hostname for zone transfers can now use CNAME(s)\n * Fix windows 64bit build for libssp dependency\n * Update IANA portlist\n * Fix heap out-of-bounds write via size_t-to-int truncation in\n setup_if()/outside_network_create() for large num_ports values\n * Fix to clean up log ids after a failure to start a worker\n thread\n * Relax assertions after the TTL 0 handling change in cachedb\n and packet_rrset_copy_region\n * Fix val_find_DS to check the result of packet_rrset_copy_region\n before using it\n * Fix that dns64 answers check the AAAA query is DNSSEC\n validated, improving RFC6147 conformance\n * Fix allocation-failure hardening of rrset cache wildcard\n storage and canonical NSEC owner replacement\n * Fix DNSSEC validation and DNSKEY size calculation for\n noncanonical RSA DNSKEYs with leading zeroes\n * Fix mixed class referrals to use the query class\n * Fix serve-expired responses from cachedb to not store bogus\n data\n * Fix lame server detection for selfpointed glue records\n * Fix cleanup of DoH sessions when the same query is on multiple\n streams\n * Fix for signed same-owner CNAME and ordinary RRset responses\n * Fix mesh new client/callback to roll back added address, tcp\n mesh state and callback on initialization failure\n * Fix autotrust state-file line overflow that could give a\n hold-down bypass\n * Fix to limit the DSNS per-label walk in the iterator\n * Fix that the ratelimit is decremented on successful referrals\n * Fix msgencode insert_query assertion for a local_alias\n * Fix to reset the tcp-timeout before applying a load based\n reduction\n * Fix to correctly decrement per-netblock tcp connection limits\n * Fix, in depth, for respip rewrite of dns64 responses\n * Fix that dns64 with subnetcache does not write ECS scoped\n answers to the global cache\n * Fix ipset module name-too-long checks and race conditions on\n the local name buffer and socket close\n * Fix validator to cap the number of ANY RRsets it validates and\n shorten the wait timer\n * Fix race condition causing segfault when starting threads\n * Fix header_seen detection for trust anchor files to detect the\n id line\n * Fix heap use-after-free in class response processing when at\n least two distinct classes are configured\n * Fix negative cache to work with NSEC3 records without salt\n * Fix parse of svcbparam ech, it had an incorrect length\n * Fix that quotation and escaping works the same in auth-zone\n url content as in zonefile reads\n * Fix ipset module to use larger domain name buffers and check\n buffer lengths\n * Fix PROXYv2 header read and consume to check the header size\n * Fix negative cache NSEC3 nodata proof to use the correct\n message size\n * Fix fast_reload for when a ZONEMD lookup is in progress\n * Fix that validation canonicalization of domain names in rdata\n checks buffer bounds\n * Fix dump_cache to use a larger record buffer and check that an\n owner name does not collide with BADRR\n * Fix that dns64 cleans up the allocated message if the adjust\n routines fail, and checks for malformed A/AAAA in auth-zones\n * Fix pythonmod script read for numeric overflow\n * Fix configure to detect the correct QUIC early-data function\n and to check for the ngtcp2_crypto_ossl header\n * Fix compile with OpenSSL 4.0.1, and with OpenSSL 1.0.2 and\n earlier in server cleanup\n * Fix that auth-zone/rpz allow-notify addresses and netblocks\n are available from start, and fix the probe step skip\n * Fix to perform a full transfer periodically to stop increasing\n memory usage for rpz zones\n * Fix assertion failure for a long HTTP header that fills the\n buffer, and buffer overflow with lower than default size and\n http transfer\n * Fix that misconfigured iter-scrub-ns: 0 causes request failures\n * Fix fast_reload handling of in-progress ZONEMD lookups and of\n removing an auth zone while its lookups are in progress\n * Fix integer overflow in infra-cache-max-rtt calculation and for\n very high values of sock-queue-timeout\n * Fix erroneous DNS error report values after a bogus AAAA query\n * Fix fast_reload to not terminate the server on config errors\n for key files\n * Fix log of an aliased qname to not use freed region memory\n * Fix DNAME synthesis from cache to keep using 0TTL entries\n within a sliding window without surpassing RRSIG expiry\n * Fix that dns64 bypasses the rpz-passthru rule during synthesis\n * Fix to disallow $INCLUDE for secondary zones; failed loads now\n clear the zone data so there is no partial zone\n * Fix zone read to allow SVCB records in unknown format that\n cannot be written out\n * Fix that a half-written trust anchor file does not crash the\n server at runtime\n * Fix that auth-zone and RPZ zones drop out-of-zone records\n * Fix that dns64 honors the forward-no-cache and stub-no-cache\n options\n * Fix that a signed wildcard NSEC is checked before use, so it\n does not allow insecure DS proofs inappropriately\n * Fix several crashes after malloc failure: half-built\n local_alias, RPZ list, delegation point cleanup,\n dns64_inform_super, new_local_rrset for RPZ qname trigger, doq\n connection setup, ngtcp2_conn_server_new, TCP accept handling,\n rpz_strip_nsdname, edns subnet addrtree insert, and rpz\n response create\n * Fix that a zonefile-only zone continues server startup with a\n warning if the file is missing on start\n * Fix that dnscrypt configuration does not crash on a\n secret/public key mismatch, and duplicate files are skipped\n * Fix locking in libunbound ub_ctx_set_event\n * Fix that libunbound pipe functions fail with an error after an\n event base is set\n * Fix incorrect cleanup after an allocation failure for a\n delegation point\n * Fix that the server does not crash if shared memory cannot be\n created for shm-enable\n * Fix auth primary host name lookup to allow CNAMEs\n * Fix memory leak on DNAME 0TTL records\n * Fix that fast_reload disown of the auth zone transfer task\n cleans up the chunk list\n * Fix unbound-checkconf to check for auth-zone download filename\n collisions\n * Fix malloc failure in auth-zone insert rr to avoid an empty\n node and infinite loop\n * Fix that unbound-control auth_zone_reload stops answering from\n the zone after a read failure\n * Fix stats pipe draining after a malloc failure so internal\n messaging stays correct, and the server no longer exits on\n stats pipe communication failure\n * Fix that fast_reload does not terminate the server if random\n init for DNS cookies fails\n * Fix thread setname for dnstap and fast_reload thread start\n * Add libunbound/remote.h, a shared header with prototypes for\n remote control connections\n * Fix DEREF_AFTER_NULL on worker_init when stat_timer allocation\n fails with an out of memory error\n * Fix DoH POST requests missing content-length causing :status\n 400 from strict resolvers like Cloudflare and Mullvad\n * Fix randomness generation on macOS/iOS under chroot\n * Fix ipsecmod deref on null in ipsecmod-whitelist after OOM, and\n possible deref on null after reply_find_answer_rrset()\n * Fix that DoQ responses were never padded; pad-responses now\n applies to comm_doq per RFC 9250 section 5.4\n * Fix log printout error in the fix for CVE-2026-50248 when the\n primary name is bogus\n * Fix NSEC3 proofs to check the b32 name matches the signer name;\n RRSIGs are no longer valid when this does not match\n * Fix aggressive negative cache to not insert NSEC records with\n an overreaching next owner name outside the trust anchor's\n bailiwick\n * Fix mesh cycle detection for respip CNAME loop with tagged\n clients\n * Fix unbound-anchor to check the return value of\n X509_NAME_get_text_by_NID for the emailaddress\n * Fix locking of the shared_ports structure during\n initialisation, and of the anchor structure when a file is set\n during header parsing\n * Fix memory leak in xfer_set_masters() error path in authzone\n * Fix to use tls-port after a referral when tls-upstream is set\n * Fix pthread detection on Solaris 11.4\n * Fix to call OPENSSL_cleanup on exit when it is defined\n * pythonmod: check the return value after ftell()\n","status":"published","published":"2026-10-09T15:11:12Z","modified":"2026-10-19T17:23:13.48392302Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:24128-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\n- CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' (bsc#1280403).\n- CVE-2026-77955: Possible ZONEMD verification bypass window (bsc#1280404).\n- CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission (bsc#1280405).\n- CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection (bsc#1280406).\n- CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization (bsc#1280409).\n- CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (bsc#1280411).\n- CVE-2026-82717: CNAME synthesis could lead to heap corruption (bsc#1280412).\n- CVE-2026-82720: Use-after-free in DoH stream cleanup code path (bsc#1280413).\n- CVE-2026-85501: Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC (bsc#1280414).\n\nChanges for unbound:\n\n- Update to 1.26.1:\n * Update icannbundle.pem certificates in unbound-anchor, valid\n for 2009-2029 and 2025-2045\n * Add max-transfer-size and max-transfer-time options to limit\n auth-zone and rpz transfer size and time, default disabled\n * Overload local_data_remove in unbound-control to also remove\n specific records\n * Add local-zone types block_aaaa, block_a_wdata and\n block_aaaa_wdata; fix respip+dns64 to use original A records\n instead of ones already modified by respip\n * ipsecmod hook script now needs to start with '#!/bin/sh', it\n is executed with execv instead of system for security\n * Server now continues to start if a secondary zone fails to\n load from its zonefile, or if a primary zonefile is missing;\n $INCLUDE is no longer allowed in secondary zone zonefiles\n * Auth-zone and RPZ zones now drop out-of-zone content on load\n * Primary hostname for zone transfers can now use CNAME(s)\n * Fix windows 64bit build for libssp dependency\n * Update IANA portlist\n * Fix heap out-of-bounds write via size_t-to-int truncation in\n setup_if()/outside_network_create() for large num_ports values\n * Fix to clean up log ids after a failure to start a worker\n thread\n * Relax assertions after the TTL 0 handling change in cachedb\n and packet_rrset_copy_region\n * Fix val_find_DS to check the result of packet_rrset_copy_region\n before using it\n * Fix that dns64 answers check the AAAA query is DNSSEC\n validated, improving RFC6147 conformance\n * Fix allocation-failure hardening of rrset cache wildcard\n storage and canonical NSEC owner replacement\n * Fix DNSSEC validation and DNSKEY size calculation for\n noncanonical RSA DNSKEYs with leading zeroes\n * Fix mixed class referrals to use the query class\n * Fix serve-expired responses from cachedb to not store bogus\n data\n * Fix lame server detection for selfpointed glue records\n * Fix cleanup of DoH sessions when the same query is on multiple\n streams\n * Fix for signed same-owner CNAME and ordinary RRset responses\n * Fix mesh new client/callback to roll back added address, tcp\n mesh state and callback on initialization failure\n * Fix autotrust state-file line overflow that could give a\n hold-down bypass\n * Fix to limit the DSNS per-label walk in the iterator\n * Fix that the ratelimit is decremented on successful referrals\n * Fix msgencode insert_query assertion for a local_alias\n * Fix to reset the tcp-timeout before applying a load based\n reduction\n * Fix to correctly decrement per-netblock tcp connection limits\n * Fix, in depth, for respip rewrite of dns64 responses\n * Fix that dns64 with subnetcache does not write ECS scoped\n answers to the global cache\n * Fix ipset module name-too-long checks and race conditions on\n the local name buffer and socket close\n * Fix validator to cap the number of ANY RRsets it validates and\n shorten the wait timer\n * Fix race condition causing segfault when starting threads\n * Fix header_seen detection for trust anchor files to detect the\n id line\n * Fix heap use-after-free in class response processing when at\n least two distinct classes are configured\n * Fix negative cache to work with NSEC3 records without salt\n * Fix parse of svcbparam ech, it had an incorrect length\n * Fix that quotation and escaping works the same in auth-zone\n url content as in zonefile reads\n * Fix ipset module to use larger domain name buffers and check\n buffer lengths\n * Fix PROXYv2 header read and consume to check the header size\n * Fix negative cache NSEC3 nodata proof to use the correct\n message size\n * Fix fast_reload for when a ZONEMD lookup is in progress\n * Fix that validation canonicalization of domain names in rdata\n checks buffer bounds\n * Fix dump_cache to use a larger record buffer and check that an\n owner name does not collide with BADRR\n * Fix that dns64 cleans up the allocated message if the adjust\n routines fail, and checks for malformed A/AAAA in auth-zones\n * Fix pythonmod script read for numeric overflow\n * Fix configure to detect the correct QUIC early-data function\n and to check for the ngtcp2_crypto_ossl header\n * Fix compile with OpenSSL 4.0.1, and with OpenSSL 1.0.2 and\n earlier in server cleanup\n * Fix that auth-zone/rpz allow-notify addresses and netblocks\n are available from start, and fix the probe step skip\n * Fix to perform a full transfer periodically to stop increasing\n memory usage for rpz zones\n * Fix assertion failure for a long HTTP header that fills the\n buffer, and buffer overflow with lower than default size and\n http transfer\n * Fix that misconfigured iter-scrub-ns: 0 causes request failures\n * Fix fast_reload handling of in-progress ZONEMD lookups and of\n removing an auth zone while its lookups are in progress\n * Fix integer overflow in infra-cache-max-rtt calculation and for\n very high values of sock-queue-timeout\n * Fix erroneous DNS error report values after a bogus AAAA query\n * Fix fast_reload to not terminate the server on config errors\n for key files\n * Fix log of an aliased qname to not use freed region memory\n * Fix DNAME synthesis from cache to keep using 0TTL entries\n within a sliding window without surpassing RRSIG expiry\n * Fix that dns64 bypasses the rpz-passthru rule during synthesis\n * Fix to disallow $INCLUDE for secondary zones; failed loads now\n clear the zone data so there is no partial zone\n * Fix zone read to allow SVCB records in unknown format that\n cannot be written out\n * Fix that a half-written trust anchor file does not crash the\n server at runtime\n * Fix that auth-zone and RPZ zones drop out-of-zone records\n * Fix that dns64 honors the forward-no-cache and stub-no-cache\n options\n * Fix that a signed wildcard NSEC is checked before use, so it\n does not allow insecure DS proofs inappropriately\n * Fix several crashes after malloc failure: half-built\n local_alias, RPZ list, delegation point cleanup,\n dns64_inform_super, new_local_rrset for RPZ qname trigger, doq\n connection setup, ngtcp2_conn_server_new, TCP accept handling,\n rpz_strip_nsdname, edns subnet addrtree insert, and rpz\n response create\n * Fix that a zonefile-only zone continues server startup with a\n warning if the file is missing on start\n * Fix that dnscrypt configuration does not crash on a\n secret/public key mismatch, and duplicate files are skipped\n * Fix locking in libunbound ub_ctx_set_event\n * Fix that libunbound pipe functions fail with an error after an\n event base is set\n * Fix incorrect cleanup after an allocation failure for a\n delegation point\n * Fix that the server does not crash if shared memory cannot be\n created for shm-enable\n * Fix auth primary host name lookup to allow CNAMEs\n * Fix memory leak on DNAME 0TTL records\n * Fix that fast_reload disown of the auth zone transfer task\n cleans up the chunk list\n * Fix unbound-checkconf to check for auth-zone download filename\n collisions\n * Fix malloc failure in auth-zone insert rr to avoid an empty\n node and infinite loop\n * Fix that unbound-control auth_zone_reload stops answering from\n the zone after a read failure\n * Fix stats pipe draining after a malloc failure so internal\n messaging stays correct, and the server no longer exits on\n stats pipe communication failure\n * Fix that fast_reload does not terminate the server if random\n init for DNS cookies fails\n * Fix thread setname for dnstap and fast_reload thread start\n * Add libunbound/remote.h, a shared header with prototypes for\n remote control connections\n * Fix DEREF_AFTER_NULL on worker_init when stat_timer allocation\n fails with an out of memory error\n * Fix DoH POST requests missing content-length causing :status\n 400 from strict resolvers like Cloudflare and Mullvad\n * Fix randomness generation on macOS/iOS under chroot\n * Fix ipsecmod deref on null in ipsecmod-whitelist after OOM, and\n possible deref on null after reply_find_answer_rrset()\n * Fix that DoQ responses were never padded; pad-responses now\n applies to comm_doq per RFC 9250 section 5.4\n * Fix log printout error in the fix for CVE-2026-50248 when the\n primary name is bogus\n * Fix NSEC3 proofs to check the b32 name matches the signer name;\n RRSIGs are no longer valid when this does not match\n * Fix aggressive negative cache to not insert NSEC records with\n an overreaching next owner name outside the trust anchor's\n bailiwick\n * Fix mesh cycle detection for respip CNAME loop with tagged\n clients\n * Fix unbound-anchor to check the return value of\n X509_NAME_get_text_by_NID for the emailaddress\n * Fix locking of the shared_ports structure during\n initialisation, and of the anchor structure when a file is set\n during header parsing\n * Fix memory leak in xfer_set_masters() error path in authzone\n * Fix to use tls-port after a referral when tls-upstream is set\n * Fix pthread detection on Solaris 11.4\n * Fix to call OPENSSL_cleanup on exit when it is defined\n * pythonmod: check the return value after ftell()\n","status":"published","published":"2026-10-09T15:11:19Z","modified":"2026-10-13T17:23:10.19936105Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24135-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\n- CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' (bsc#1280403).\n- CVE-2026-77955: Possible ZONEMD verification bypass window (bsc#1280404).\n- CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission (bsc#1280405).\n- CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection (bsc#1280406).\n- CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization (bsc#1280409).\n- CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (bsc#1280411).\n- CVE-2026-82717: CNAME synthesis could lead to heap corruption (bsc#1280412).\n- CVE-2026-82720: Use-after-free in DoH stream cleanup code path (bsc#1280413).\n- CVE-2026-85501: Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC (bsc#1280414).\n\nChanges for unbound:\n\n- Update to 1.26.1:\n * Update icannbundle.pem certificates in unbound-anchor, valid\n for 2009-2029 and 2025-2045\n * Add max-transfer-size and max-transfer-time options to limit\n auth-zone and rpz transfer size and time, default disabled\n * Overload local_data_remove in unbound-control to also remove\n specific records\n * Add local-zone types block_aaaa, block_a_wdata and\n block_aaaa_wdata; fix respip+dns64 to use original A records\n instead of ones already modified by respip\n * ipsecmod hook script now needs to start with '#!/bin/sh', it\n is executed with execv instead of system for security\n * Server now continues to start if a secondary zone fails to\n load from its zonefile, or if a primary zonefile is missing;\n $INCLUDE is no longer allowed in secondary zone zonefiles\n * Auth-zone and RPZ zones now drop out-of-zone content on load\n * Primary hostname for zone transfers can now use CNAME(s)\n * Fix windows 64bit build for libssp dependency\n * Update IANA portlist\n * Fix heap out-of-bounds write via size_t-to-int truncation in\n setup_if()/outside_network_create() for large num_ports values\n * Fix to clean up log ids after a failure to start a worker\n thread\n * Relax assertions after the TTL 0 handling change in cachedb\n and packet_rrset_copy_region\n * Fix val_find_DS to check the result of packet_rrset_copy_region\n before using it\n * Fix that dns64 answers check the AAAA query is DNSSEC\n validated, improving RFC6147 conformance\n * Fix allocation-failure hardening of rrset cache wildcard\n storage and canonical NSEC owner replacement\n * Fix DNSSEC validation and DNSKEY size calculation for\n noncanonical RSA DNSKEYs with leading zeroes\n * Fix mixed class referrals to use the query class\n * Fix serve-expired responses from cachedb to not store bogus\n data\n * Fix lame server detection for selfpointed glue records\n * Fix cleanup of DoH sessions when the same query is on multiple\n streams\n * Fix for signed same-owner CNAME and ordinary RRset responses\n * Fix mesh new client/callback to roll back added address, tcp\n mesh state and callback on initialization failure\n * Fix autotrust state-file line overflow that could give a\n hold-down bypass\n * Fix to limit the DSNS per-label walk in the iterator\n * Fix that the ratelimit is decremented on successful referrals\n * Fix msgencode insert_query assertion for a local_alias\n * Fix to reset the tcp-timeout before applying a load based\n reduction\n * Fix to correctly decrement per-netblock tcp connection limits\n * Fix, in depth, for respip rewrite of dns64 responses\n * Fix that dns64 with subnetcache does not write ECS scoped\n answers to the global cache\n * Fix ipset module name-too-long checks and race conditions on\n the local name buffer and socket close\n * Fix validator to cap the number of ANY RRsets it validates and\n shorten the wait timer\n * Fix race condition causing segfault when starting threads\n * Fix header_seen detection for trust anchor files to detect the\n id line\n * Fix heap use-after-free in class response processing when at\n least two distinct classes are configured\n * Fix negative cache to work with NSEC3 records without salt\n * Fix parse of svcbparam ech, it had an incorrect length\n * Fix that quotation and escaping works the same in auth-zone\n url content as in zonefile reads\n * Fix ipset module to use larger domain name buffers and check\n buffer lengths\n * Fix PROXYv2 header read and consume to check the header size\n * Fix negative cache NSEC3 nodata proof to use the correct\n message size\n * Fix fast_reload for when a ZONEMD lookup is in progress\n * Fix that validation canonicalization of domain names in rdata\n checks buffer bounds\n * Fix dump_cache to use a larger record buffer and check that an\n owner name does not collide with BADRR\n * Fix that dns64 cleans up the allocated message if the adjust\n routines fail, and checks for malformed A/AAAA in auth-zones\n * Fix pythonmod script read for numeric overflow\n * Fix configure to detect the correct QUIC early-data function\n and to check for the ngtcp2_crypto_ossl header\n * Fix compile with OpenSSL 4.0.1, and with OpenSSL 1.0.2 and\n earlier in server cleanup\n * Fix that auth-zone/rpz allow-notify addresses and netblocks\n are available from start, and fix the probe step skip\n * Fix to perform a full transfer periodically to stop increasing\n memory usage for rpz zones\n * Fix assertion failure for a long HTTP header that fills the\n buffer, and buffer overflow with lower than default size and\n http transfer\n * Fix that misconfigured iter-scrub-ns: 0 causes request failures\n * Fix fast_reload handling of in-progress ZONEMD lookups and of\n removing an auth zone while its lookups are in progress\n * Fix integer overflow in infra-cache-max-rtt calculation and for\n very high values of sock-queue-timeout\n * Fix erroneous DNS error report values after a bogus AAAA query\n * Fix fast_reload to not terminate the server on config errors\n for key files\n * Fix log of an aliased qname to not use freed region memory\n * Fix DNAME synthesis from cache to keep using 0TTL entries\n within a sliding window without surpassing RRSIG expiry\n * Fix that dns64 bypasses the rpz-passthru rule during synthesis\n * Fix to disallow $INCLUDE for secondary zones; failed loads now\n clear the zone data so there is no partial zone\n * Fix zone read to allow SVCB records in unknown format that\n cannot be written out\n * Fix that a half-written trust anchor file does not crash the\n server at runtime\n * Fix that auth-zone and RPZ zones drop out-of-zone records\n * Fix that dns64 honors the forward-no-cache and stub-no-cache\n options\n * Fix that a signed wildcard NSEC is checked before use, so it\n does not allow insecure DS proofs inappropriately\n * Fix several crashes after malloc failure: half-built\n local_alias, RPZ list, delegation point cleanup,\n dns64_inform_super, new_local_rrset for RPZ qname trigger, doq\n connection setup, ngtcp2_conn_server_new, TCP accept handling,\n rpz_strip_nsdname, edns subnet addrtree insert, and rpz\n response create\n * Fix that a zonefile-only zone continues server startup with a\n warning if the file is missing on start\n * Fix that dnscrypt configuration does not crash on a\n secret/public key mismatch, and duplicate files are skipped\n * Fix locking in libunbound ub_ctx_set_event\n * Fix that libunbound pipe functions fail with an error after an\n event base is set\n * Fix incorrect cleanup after an allocation failure for a\n delegation point\n * Fix that the server does not crash if shared memory cannot be\n created for shm-enable\n * Fix auth primary host name lookup to allow CNAMEs\n * Fix memory leak on DNAME 0TTL records\n * Fix that fast_reload disown of the auth zone transfer task\n cleans up the chunk list\n * Fix unbound-checkconf to check for auth-zone download filename\n collisions\n * Fix malloc failure in auth-zone insert rr to avoid an empty\n node and infinite loop\n * Fix that unbound-control auth_zone_reload stops answering from\n the zone after a read failure\n * Fix stats pipe draining after a malloc failure so internal\n messaging stays correct, and the server no longer exits on\n stats pipe communication failure\n * Fix that fast_reload does not terminate the server if random\n init for DNS cookies fails\n * Fix thread setname for dnstap and fast_reload thread start\n * Add libunbound/remote.h, a shared header with prototypes for\n remote control connections\n * Fix DEREF_AFTER_NULL on worker_init when stat_timer allocation\n fails with an out of memory error\n * Fix DoH POST requests missing content-length causing :status\n 400 from strict resolvers like Cloudflare and Mullvad\n * Fix randomness generation on macOS/iOS under chroot\n * Fix ipsecmod deref on null in ipsecmod-whitelist after OOM, and\n possible deref on null after reply_find_answer_rrset()\n * Fix that DoQ responses were never padded; pad-responses now\n applies to comm_doq per RFC 9250 section 5.4\n * Fix log printout error in the fix for CVE-2026-50248 when the\n primary name is bogus\n * Fix NSEC3 proofs to check the b32 name matches the signer name;\n RRSIGs are no longer valid when this does not match\n * Fix aggressive negative cache to not insert NSEC records with\n an overreaching next owner name outside the trust anchor's\n bailiwick\n * Fix mesh cycle detection for respip CNAME loop with tagged\n clients\n * Fix unbound-anchor to check the return value of\n X509_NAME_get_text_by_NID for the emailaddress\n * Fix locking of the shared_ports structure during\n initialisation, and of the anchor structure when a file is set\n during header parsing\n * Fix memory leak in xfer_set_masters() error path in authzone\n * Fix to use tls-port after a referral when tls-upstream is set\n * Fix pthread detection on Solaris 11.4\n * Fix to call OPENSSL_cleanup on exit when it is defined\n * pythonmod: check the return value after ftell()\n","status":"published","published":"2026-10-09T11:52:52Z","modified":"2026-10-15T17:23:11.709343277Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24226-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\n- CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' (bsc#1280403).\n- CVE-2026-77955: Possible ZONEMD verification bypass window (bsc#1280404).\n- CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission (bsc#1280405).\n- CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection (bsc#1280406).\n- CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization (bsc#1280409).\n- CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (bsc#1280411).\n- CVE-2026-82717: CNAME synthesis could lead to heap corruption (bsc#1280412).\n- CVE-2026-82720: Use-after-free in DoH stream cleanup code path (bsc#1280413).\n- CVE-2026-85501: Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC (bsc#1280414).\n\nChanges for unbound:\n\n- Update to 1.26.1:\n * Update icannbundle.pem certificates in unbound-anchor, valid\n for 2009-2029 and 2025-2045\n * Add max-transfer-size and max-transfer-time options to limit\n auth-zone and rpz transfer size and time, default disabled\n * Overload local_data_remove in unbound-control to also remove\n specific records\n * Add local-zone types block_aaaa, block_a_wdata and\n block_aaaa_wdata; fix respip+dns64 to use original A records\n instead of ones already modified by respip\n * ipsecmod hook script now needs to start with '#!/bin/sh', it\n is executed with execv instead of system for security\n * Server now continues to start if a secondary zone fails to\n load from its zonefile, or if a primary zonefile is missing;\n $INCLUDE is no longer allowed in secondary zone zonefiles\n * Auth-zone and RPZ zones now drop out-of-zone content on load\n * Primary hostname for zone transfers can now use CNAME(s)\n * Fix windows 64bit build for libssp dependency\n * Update IANA portlist\n * Fix heap out-of-bounds write via size_t-to-int truncation in\n setup_if()/outside_network_create() for large num_ports values\n * Fix to clean up log ids after a failure to start a worker\n thread\n * Relax assertions after the TTL 0 handling change in cachedb\n and packet_rrset_copy_region\n * Fix val_find_DS to check the result of packet_rrset_copy_region\n before using it\n * Fix that dns64 answers check the AAAA query is DNSSEC\n validated, improving RFC6147 conformance\n * Fix allocation-failure hardening of rrset cache wildcard\n storage and canonical NSEC owner replacement\n * Fix DNSSEC validation and DNSKEY size calculation for\n noncanonical RSA DNSKEYs with leading zeroes\n * Fix mixed class referrals to use the query class\n * Fix serve-expired responses from cachedb to not store bogus\n data\n * Fix lame server detection for selfpointed glue records\n * Fix cleanup of DoH sessions when the same query is on multiple\n streams\n * Fix for signed same-owner CNAME and ordinary RRset responses\n * Fix mesh new client/callback to roll back added address, tcp\n mesh state and callback on initialization failure\n * Fix autotrust state-file line overflow that could give a\n hold-down bypass\n * Fix to limit the DSNS per-label walk in the iterator\n * Fix that the ratelimit is decremented on successful referrals\n * Fix msgencode insert_query assertion for a local_alias\n * Fix to reset the tcp-timeout before applying a load based\n reduction\n * Fix to correctly decrement per-netblock tcp connection limits\n * Fix, in depth, for respip rewrite of dns64 responses\n * Fix that dns64 with subnetcache does not write ECS scoped\n answers to the global cache\n * Fix ipset module name-too-long checks and race conditions on\n the local name buffer and socket close\n * Fix validator to cap the number of ANY RRsets it validates and\n shorten the wait timer\n * Fix race condition causing segfault when starting threads\n * Fix header_seen detection for trust anchor files to detect the\n id line\n * Fix heap use-after-free in class response processing when at\n least two distinct classes are configured\n * Fix negative cache to work with NSEC3 records without salt\n * Fix parse of svcbparam ech, it had an incorrect length\n * Fix that quotation and escaping works the same in auth-zone\n url content as in zonefile reads\n * Fix ipset module to use larger domain name buffers and check\n buffer lengths\n * Fix PROXYv2 header read and consume to check the header size\n * Fix negative cache NSEC3 nodata proof to use the correct\n message size\n * Fix fast_reload for when a ZONEMD lookup is in progress\n * Fix that validation canonicalization of domain names in rdata\n checks buffer bounds\n * Fix dump_cache to use a larger record buffer and check that an\n owner name does not collide with BADRR\n * Fix that dns64 cleans up the allocated message if the adjust\n routines fail, and checks for malformed A/AAAA in auth-zones\n * Fix pythonmod script read for numeric overflow\n * Fix configure to detect the correct QUIC early-data function\n and to check for the ngtcp2_crypto_ossl header\n * Fix compile with OpenSSL 4.0.1, and with OpenSSL 1.0.2 and\n earlier in server cleanup\n * Fix that auth-zone/rpz allow-notify addresses and netblocks\n are available from start, and fix the probe step skip\n * Fix to perform a full transfer periodically to stop increasing\n memory usage for rpz zones\n * Fix assertion failure for a long HTTP header that fills the\n buffer, and buffer overflow with lower than default size and\n http transfer\n * Fix that misconfigured iter-scrub-ns: 0 causes request failures\n * Fix fast_reload handling of in-progress ZONEMD lookups and of\n removing an auth zone while its lookups are in progress\n * Fix integer overflow in infra-cache-max-rtt calculation and for\n very high values of sock-queue-timeout\n * Fix erroneous DNS error report values after a bogus AAAA query\n * Fix fast_reload to not terminate the server on config errors\n for key files\n * Fix log of an aliased qname to not use freed region memory\n * Fix DNAME synthesis from cache to keep using 0TTL entries\n within a sliding window without surpassing RRSIG expiry\n * Fix that dns64 bypasses the rpz-passthru rule during synthesis\n * Fix to disallow $INCLUDE for secondary zones; failed loads now\n clear the zone data so there is no partial zone\n * Fix zone read to allow SVCB records in unknown format that\n cannot be written out\n * Fix that a half-written trust anchor file does not crash the\n server at runtime\n * Fix that auth-zone and RPZ zones drop out-of-zone records\n * Fix that dns64 honors the forward-no-cache and stub-no-cache\n options\n * Fix that a signed wildcard NSEC is checked before use, so it\n does not allow insecure DS proofs inappropriately\n * Fix several crashes after malloc failure: half-built\n local_alias, RPZ list, delegation point cleanup,\n dns64_inform_super, new_local_rrset for RPZ qname trigger, doq\n connection setup, ngtcp2_conn_server_new, TCP accept handling,\n rpz_strip_nsdname, edns subnet addrtree insert, and rpz\n response create\n * Fix that a zonefile-only zone continues server startup with a\n warning if the file is missing on start\n * Fix that dnscrypt configuration does not crash on a\n secret/public key mismatch, and duplicate files are skipped\n * Fix locking in libunbound ub_ctx_set_event\n * Fix that libunbound pipe functions fail with an error after an\n event base is set\n * Fix incorrect cleanup after an allocation failure for a\n delegation point\n * Fix that the server does not crash if shared memory cannot be\n created for shm-enable\n * Fix auth primary host name lookup to allow CNAMEs\n * Fix memory leak on DNAME 0TTL records\n * Fix that fast_reload disown of the auth zone transfer task\n cleans up the chunk list\n * Fix unbound-checkconf to check for auth-zone download filename\n collisions\n * Fix malloc failure in auth-zone insert rr to avoid an empty\n node and infinite loop\n * Fix that unbound-control auth_zone_reload stops answering from\n the zone after a read failure\n * Fix stats pipe draining after a malloc failure so internal\n messaging stays correct, and the server no longer exits on\n stats pipe communication failure\n * Fix that fast_reload does not terminate the server if random\n init for DNS cookies fails\n * Fix thread setname for dnstap and fast_reload thread start\n * Add libunbound/remote.h, a shared header with prototypes for\n remote control connections\n * Fix DEREF_AFTER_NULL on worker_init when stat_timer allocation\n fails with an out of memory error\n * Fix DoH POST requests missing content-length causing :status\n 400 from strict resolvers like Cloudflare and Mullvad\n * Fix randomness generation on macOS/iOS under chroot\n * Fix ipsecmod deref on null in ipsecmod-whitelist after OOM, and\n possible deref on null after reply_find_answer_rrset()\n * Fix that DoQ responses were never padded; pad-responses now\n applies to comm_doq per RFC 9250 section 5.4\n * Fix log printout error in the fix for CVE-2026-50248 when the\n primary name is bogus\n * Fix NSEC3 proofs to check the b32 name matches the signer name;\n RRSIGs are no longer valid when this does not match\n * Fix aggressive negative cache to not insert NSEC records with\n an overreaching next owner name outside the trust anchor's\n bailiwick\n * Fix mesh cycle detection for respip CNAME loop with tagged\n clients\n * Fix unbound-anchor to check the return value of\n X509_NAME_get_text_by_NID for the emailaddress\n * Fix locking of the shared_ports structure during\n initialisation, and of the anchor structure when a file is set\n during header parsing\n * Fix memory leak in xfer_set_masters() error path in authzone\n * Fix to use tls-port after a referral when tls-upstream is set\n * Fix pthread detection on Solaris 11.4\n * Fix to call OPENSSL_cleanup on exit when it is defined\n * pythonmod: check the return value after ftell()\n","status":"published","published":"2026-10-09T15:11:19Z","modified":"2026-10-21T17:23:11.050283658Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24376-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\n- CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' (bsc#1280403).\n- CVE-2026-77955: Possible ZONEMD verification bypass window (bsc#1280404).\n- CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission (bsc#1280405).\n- CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection (bsc#1280406).\n- CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization (bsc#1280409).\n- CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (bsc#1280411).\n- CVE-2026-82717: CNAME synthesis could lead to heap corruption (bsc#1280412).\n- CVE-2026-82720: Use-after-free in DoH stream cleanup code path (bsc#1280413).\n- CVE-2026-85501: Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC (bsc#1280414).\n\nChanges for unbound:\n\n- Update to 1.26.1:\n * Update icannbundle.pem certificates in unbound-anchor, valid\n for 2009-2029 and 2025-2045\n * Add max-transfer-size and max-transfer-time options to limit\n auth-zone and rpz transfer size and time, default disabled\n * Overload local_data_remove in unbound-control to also remove\n specific records\n * Add local-zone types block_aaaa, block_a_wdata and\n block_aaaa_wdata; fix respip+dns64 to use original A records\n instead of ones already modified by respip\n * ipsecmod hook script now needs to start with '#!/bin/sh', it\n is executed with execv instead of system for security\n * Server now continues to start if a secondary zone fails to\n load from its zonefile, or if a primary zonefile is missing;\n $INCLUDE is no longer allowed in secondary zone zonefiles\n * Auth-zone and RPZ zones now drop out-of-zone content on load\n * Primary hostname for zone transfers can now use CNAME(s)\n * Fix windows 64bit build for libssp dependency\n * Update IANA portlist\n * Fix heap out-of-bounds write via size_t-to-int truncation in\n setup_if()/outside_network_create() for large num_ports values\n * Fix to clean up log ids after a failure to start a worker\n thread\n * Relax assertions after the TTL 0 handling change in cachedb\n and packet_rrset_copy_region\n * Fix val_find_DS to check the result of packet_rrset_copy_region\n before using it\n * Fix that dns64 answers check the AAAA query is DNSSEC\n validated, improving RFC6147 conformance\n * Fix allocation-failure hardening of rrset cache wildcard\n storage and canonical NSEC owner replacement\n * Fix DNSSEC validation and DNSKEY size calculation for\n noncanonical RSA DNSKEYs with leading zeroes\n * Fix mixed class referrals to use the query class\n * Fix serve-expired responses from cachedb to not store bogus\n data\n * Fix lame server detection for selfpointed glue records\n * Fix cleanup of DoH sessions when the same query is on multiple\n streams\n * Fix for signed same-owner CNAME and ordinary RRset responses\n * Fix mesh new client/callback to roll back added address, tcp\n mesh state and callback on initialization failure\n * Fix autotrust state-file line overflow that could give a\n hold-down bypass\n * Fix to limit the DSNS per-label walk in the iterator\n * Fix that the ratelimit is decremented on successful referrals\n * Fix msgencode insert_query assertion for a local_alias\n * Fix to reset the tcp-timeout before applying a load based\n reduction\n * Fix to correctly decrement per-netblock tcp connection limits\n * Fix, in depth, for respip rewrite of dns64 responses\n * Fix that dns64 with subnetcache does not write ECS scoped\n answers to the global cache\n * Fix ipset module name-too-long checks and race conditions on\n the local name buffer and socket close\n * Fix validator to cap the number of ANY RRsets it validates and\n shorten the wait timer\n * Fix race condition causing segfault when starting threads\n * Fix header_seen detection for trust anchor files to detect the\n id line\n * Fix heap use-after-free in class response processing when at\n least two distinct classes are configured\n * Fix negative cache to work with NSEC3 records without salt\n * Fix parse of svcbparam ech, it had an incorrect length\n * Fix that quotation and escaping works the same in auth-zone\n url content as in zonefile reads\n * Fix ipset module to use larger domain name buffers and check\n buffer lengths\n * Fix PROXYv2 header read and consume to check the header size\n * Fix negative cache NSEC3 nodata proof to use the correct\n message size\n * Fix fast_reload for when a ZONEMD lookup is in progress\n * Fix that validation canonicalization of domain names in rdata\n checks buffer bounds\n * Fix dump_cache to use a larger record buffer and check that an\n owner name does not collide with BADRR\n * Fix that dns64 cleans up the allocated message if the adjust\n routines fail, and checks for malformed A/AAAA in auth-zones\n * Fix pythonmod script read for numeric overflow\n * Fix configure to detect the correct QUIC early-data function\n and to check for the ngtcp2_crypto_ossl header\n * Fix compile with OpenSSL 4.0.1, and with OpenSSL 1.0.2 and\n earlier in server cleanup\n * Fix that auth-zone/rpz allow-notify addresses and netblocks\n are available from start, and fix the probe step skip\n * Fix to perform a full transfer periodically to stop increasing\n memory usage for rpz zones\n * Fix assertion failure for a long HTTP header that fills the\n buffer, and buffer overflow with lower than default size and\n http transfer\n * Fix that misconfigured iter-scrub-ns: 0 causes request failures\n * Fix fast_reload handling of in-progress ZONEMD lookups and of\n removing an auth zone while its lookups are in progress\n * Fix integer overflow in infra-cache-max-rtt calculation and for\n very high values of sock-queue-timeout\n * Fix erroneous DNS error report values after a bogus AAAA query\n * Fix fast_reload to not terminate the server on config errors\n for key files\n * Fix log of an aliased qname to not use freed region memory\n * Fix DNAME synthesis from cache to keep using 0TTL entries\n within a sliding window without surpassing RRSIG expiry\n * Fix that dns64 bypasses the rpz-passthru rule during synthesis\n * Fix to disallow $INCLUDE for secondary zones; failed loads now\n clear the zone data so there is no partial zone\n * Fix zone read to allow SVCB records in unknown format that\n cannot be written out\n * Fix that a half-written trust anchor file does not crash the\n server at runtime\n * Fix that auth-zone and RPZ zones drop out-of-zone records\n * Fix that dns64 honors the forward-no-cache and stub-no-cache\n options\n * Fix that a signed wildcard NSEC is checked before use, so it\n does not allow insecure DS proofs inappropriately\n * Fix several crashes after malloc failure: half-built\n local_alias, RPZ list, delegation point cleanup,\n dns64_inform_super, new_local_rrset for RPZ qname trigger, doq\n connection setup, ngtcp2_conn_server_new, TCP accept handling,\n rpz_strip_nsdname, edns subnet addrtree insert, and rpz\n response create\n * Fix that a zonefile-only zone continues server startup with a\n warning if the file is missing on start\n * Fix that dnscrypt configuration does not crash on a\n secret/public key mismatch, and duplicate files are skipped\n * Fix locking in libunbound ub_ctx_set_event\n * Fix that libunbound pipe functions fail with an error after an\n event base is set\n * Fix incorrect cleanup after an allocation failure for a\n delegation point\n * Fix that the server does not crash if shared memory cannot be\n created for shm-enable\n * Fix auth primary host name lookup to allow CNAMEs\n * Fix memory leak on DNAME 0TTL records\n * Fix that fast_reload disown of the auth zone transfer task\n cleans up the chunk list\n * Fix unbound-checkconf to check for auth-zone download filename\n collisions\n * Fix malloc failure in auth-zone insert rr to avoid an empty\n node and infinite loop\n * Fix that unbound-control auth_zone_reload stops answering from\n the zone after a read failure\n * Fix stats pipe draining after a malloc failure so internal\n messaging stays correct, and the server no longer exits on\n stats pipe communication failure\n * Fix that fast_reload does not terminate the server if random\n init for DNS cookies fails\n * Fix thread setname for dnstap and fast_reload thread start\n * Add libunbound/remote.h, a shared header with prototypes for\n remote control connections\n * Fix DEREF_AFTER_NULL on worker_init when stat_timer allocation\n fails with an out of memory error\n * Fix DoH POST requests missing content-length causing :status\n 400 from strict resolvers like Cloudflare and Mullvad\n * Fix randomness generation on macOS/iOS under chroot\n * Fix ipsecmod deref on null in ipsecmod-whitelist after OOM, and\n possible deref on null after reply_find_answer_rrset()\n * Fix that DoQ responses were never padded; pad-responses now\n applies to comm_doq per RFC 9250 section 5.4\n * Fix log printout error in the fix for CVE-2026-50248 when the\n primary name is bogus\n * Fix NSEC3 proofs to check the b32 name matches the signer name;\n RRSIGs are no longer valid when this does not match\n * Fix aggressive negative cache to not insert NSEC records with\n an overreaching next owner name outside the trust anchor's\n bailiwick\n * Fix mesh cycle detection for respip CNAME loop with tagged\n clients\n * Fix unbound-anchor to check the return value of\n X509_NAME_get_text_by_NID for the emailaddress\n * Fix locking of the shared_ports structure during\n initialisation, and of the anchor structure when a file is set\n during header parsing\n * Fix memory leak in xfer_set_masters() error path in authzone\n * Fix to use tls-port after a referral when tls-upstream is set\n * Fix pthread detection on Solaris 11.4\n * Fix to call OPENSSL_cleanup on exit when it is defined\n * pythonmod: check the return value after ftell()\n","status":"published","published":"2026-10-20T08:21:41Z","modified":"2026-10-27T17:23:17.402819815Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:4620-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\n- CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' (bsc#1280403).\n- CVE-2026-77955: Possible ZONEMD verification bypass window (bsc#1280404).\n- CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission (bsc#1280405).\n- CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection (bsc#1280406).\n- CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization (bsc#1280409).\n- CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (bsc#1280411).\n- CVE-2026-82717: CNAME synthesis could lead to heap corruption (bsc#1280412).\n- CVE-2026-82720: Use-after-free in DoH stream cleanup code path (bsc#1280413).\n- CVE-2026-85501: Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC (bsc#1280414).\n\nChanges for libunbound-devel-mini:\n\n- Updated to version 1.26.1\n\nChanges for unbound:\n\n- Updated to version 1.26.1\n","status":"published","published":"2026-10-12T07:23:36Z","modified":"2026-10-13T10:30:05.848682848Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4624-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\n- CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' (bsc#1280403).\n- CVE-2026-77955: Possible ZONEMD verification bypass window (bsc#1280404).\n- CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission (bsc#1280405).\n- CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection (bsc#1280406).\n- CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization (bsc#1280409).\n- CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (bsc#1280411).\n- CVE-2026-82717: CNAME synthesis could lead to heap corruption (bsc#1280412).\n- CVE-2026-82720: Use-after-free in DoH stream cleanup code path (bsc#1280413).\n- CVE-2026-85501: Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC (bsc#1280414).\n\nChanges for libunbound-devel-mini:\n\n- Updated to version 1.26.1\n\nChanges for unbound:\n\n- Updated to version 1.26.1\n","status":"published","published":"2026-10-12T07:29:19Z","modified":"2026-10-13T10:30:05.856272931Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"USN-8946-1","title":"unbound vulnerabilities","description":"It was discovered that Unbound incorrectly handled certain TCP connections.\nA remote attacker could possibly use this issue to cause Unbound to consume\nresources, leading to a denial of service. This issue only affected Ubuntu\n26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS and Ubuntu 20.04 LTS.\n(CVE-2026-80225)\n\nIt was discovered that Unbound incorrectly handled certain DNS responses. A\nremote attacker could possibly use this issue to crash Unbound, resulting\nin a denial of service. (CVE-2026-81634)\n\nIt was discovered that Unbound incorrectly handled certain DNS responses\nduring DNSSEC validation. A remote attacker could possibly use this issue\nto cause Unbound to consume resources, leading to a denial of service.\n(CVE-2026-85501)\n\nIt was discovered that Unbound incorrectly handled outgoing network ports.\nA remote attacker could possibly use this issue to crash Unbound, resulting\nin a denial of service. (CVE-2026-50252)\n\nIt was discovered that Unbound incorrectly handled certain DNSCrypt\npackets. A remote attacker could possibly use this issue to crash Unbound,\nresulting in a denial of service. This issue only affected Ubuntu 26.04\nLTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS and Ubuntu 18.04\nLTS. (CVE-2026-40691)\n\nIt was discovered that Unbound incorrectly handled certain cached DNS\nresponses. A remote attacker could possibly use this issue to poison\nUnbound's cache. This issue only affected Ubuntu 26.04 LTS, Ubuntu 24.04\nLTS, Ubuntu 22.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-44690)\n\nIt was discovered that Unbound incorrectly handled certain DNS-over-QUIC\nconnections. A remote attacker could possibly use this issue to cause\nUnbound to consume resources, leading to a denial of service. This issue\nonly affected Ubuntu 26.04 LTS. (CVE-2026-32665)\n\nIt was discovered that Unbound incorrectly handled certain EDNS options. A\nremote attacker could possibly use this issue to crash Unbound, resulting\nin a denial of service. This issue only affected Ubuntu 26.04 LTS.\n(CVE-2026-55973)\n\nElias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered\nthat Unbound incorrectly handled validating DNSSEC messages. A remote\nattacker could possibly use this issue to cause Unbound to consume\nresources, leading to a denial of service. This issue only affected Ubuntu\n18.04 LTS, Ubuntu 16.04 LTS and Ubuntu 14.04 LTS. (CVE-2023-50387)\n\nIt was discovered that Unbound incorrectly handled preparing an NSEC3\nclosest encloser proof. A remote attacker could possibly use this issue to\ncause Unbound to consume resources, leading to a denial of service. This\nissue only affected Ubuntu 18.04 LTS, Ubuntu 16.04 LTS and Ubuntu 14.04\nLTS. (CVE-2023-50868)","status":"published","published":"2026-10-21T09:48:45Z","modified":"2026-10-21T23:13:04.088658103Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}