{"id":"CVE-2026-82717","aliases":["ALPINE-CVE-2026-82717","ALSA-2026:70754","ALSA-2026:71419","ALSA-2026:71487","AZL-101700","CLSA-2026-1791327169","DEBIAN-CVE-2026-82717","EUVD-2026-80292","GHSA-r5xg-xh8m-9q2w","MGASA-2026-0451","OESA-2026-4148","OESA-2026-4149","OESA-2026-4150","OESA-2026-4151","RHSA-2026:68590","RHSA-2026:70754","RHSA-2026:71419","RHSA-2026:71487","RLSA-2026:70754","RLSA-2026:71419","RLSA-2026:71487","ROOT-OS-DEBIAN-12-CVE-2026-82717","ROOT-OS-DEBIAN-13-CVE-2026-82717","SUSE-SU-2026:24128-1","SUSE-SU-2026:24135-1","SUSE-SU-2026:24226-1","SUSE-SU-2026:24376-1","SUSE-SU-2026:4620-1","SUSE-SU-2026:4624-1","UBUNTU-CVE-2026-82717","USN-8873-1","openSUSE-SU-2026:11930-1","openSUSE-SU-2026:22082-1"],"status":"published","title":"CNAME synthesis could lead to heap corruption","description":"In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.","severity":{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00782,"percentile":0.56477,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122"],"published":"2026-09-16T08:31:59Z","modified":"2026-11-11T09:41:11Z","fixes":[{"ecosystem":"Alpine:v3.22","package":"unbound","fixed_in":["1.25.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"unbound","fixed_in":["1.25.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"unbound","fixed_in":["1.25.2-r2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"unbound","fixed_in":["1.26.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"unbound","fixed_in":["1.26.1-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"unbound","fixed_in":["1.26.1-1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"unbound","fixed_in":["1.17.1-2+deb12u4.aikido.5"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-unbound","fixed_in":["1.17.1-2+deb12u4.aikido.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"unbound","fixed_in":["1.4.22-1ubuntu4.14.04.3+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"unbound","fixed_in":["1.5.8-1ubuntu1.1+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"unbound","fixed_in":["1.6.7-1ubuntu2.6+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"unbound","fixed_in":["1.9.4-2ubuntu1.11+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"unbound","fixed_in":["1.13.1-1ubuntu5.16"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"unbound","fixed_in":["1.19.2-1ubuntu3.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"unbound","fixed_in":["1.24.2-1ubuntu2.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.22","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-r2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-5.14.el8_10.4"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-5.14.el8_10.4"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-5.14.el8_10.4"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-5.14.el8_10.4"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-7.el10_2.6"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-7.el10_2.6"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"unbound-anchor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-7.el10_2.6"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-7.el10_2.6"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"unbound-dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-7.el10_2.6"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-7.el10_2.6"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"unbound-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-7.el10_2.6"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-3.el9_8.8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-3.el9_8.8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-3.el9_8.8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"unbound-dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-3.el9_8.8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-3.el9_8.8"}]}],"bundled":3},{"source":"osv","ecosystem":"Azure Linux:3","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-5.0.1.el7_8.tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-5.0.1.el7_8.tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-5.0.1.el7_8.tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"unbound-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-5.0.1.el7_8.tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17.1-2","1.17.1-2+deb12u1","1.17.1-2+deb12u2","1.17.1-2+deb12u3","1.17.1-2+deb12u4","1.17.1-2+loong64","1.18.0-1","1.18.0-2","1.19.1-1","1.19.2-1","1.20.0-1","1.21.1-1","1.22.0-1","1.22.0-2","1.23.1-1","1.24.0-1","1.24.0-2","1.24.1-1","1.24.1-2","1.24.2-1","1.25.0-1","1.25.1-1","1.25.2-1","1.26.0-1","1.26.0-2","1.26.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-0+deb13u1"}]}],"versions":["1.22.0-2","1.22.0-2+deb13u1","1.22.0-2+deb13u2","1.22.0-2+deb13u3","1.23.1-1","1.24.0-1","1.24.0-2","1.24.1-1","1.24.1-2","1.24.2-1","1.25.0-1","1.25.1-1","1.25.2-1","1.26.0-1","1.26.0-2"]},{"source":"osv","ecosystem":"Debian:14","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-1"}]}],"versions":["1.22.0-2","1.23.1-1","1.24.0-1","1.24.0-2","1.24.1-1","1.24.1-2","1.24.2-1","1.25.0-1","1.25.1-1","1.25.2-1","1.26.0-1","1.26.0-2"]},{"source":"osv","ecosystem":"Mageia:10","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-1.mga10"}]}],"bundled":34},{"source":"osv","ecosystem":"Mageia:9","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-1.mga9"}]}],"bundled":34},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-22.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-22.oe2403sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-22.oe2403sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-28.oe2203sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.1-1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.1-1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-anchor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.1-1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.1-1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.1-1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.1-1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-munin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.1-1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.1-1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.14.el8_10.4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.14.el8_10.4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.14.el8_10.4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.14.el8_10.4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.14.el8_10.4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.14.el8_10.4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.14.el8_10.4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.14.el8_10.4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3-unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"unbound-anchor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"unbound-anchor-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"unbound-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"unbound-dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"unbound-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"unbound-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"unbound-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"unbound-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"unbound-dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"unbound-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"python3-unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"unbound-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"unbound-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.8"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.2-5.14.el8_10.4"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:10","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-7.el10_2.6"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.2-3.el9_8.8"}]}],"bundled":3},{"source":"osv","ecosystem":"Root:Debian:12","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-2+deb12u4.aikido.5"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-2+deb12u4.aikido.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-159998.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-slfo.1.1_1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150600.23.24.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150600.23.24.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150600.23.24.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150600.23.24.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150100.10.31.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150100.10.31.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150100.10.31.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150100.10.31.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150100.10.31.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150100.10.31.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150100.10.31.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150100.10.31.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150100.10.31.1"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.22-1ubuntu4.14.04.3+esm4"}]}],"versions":["1.4.20-1","1.4.21-1","1.4.21-1ubuntu1","1.4.21-1ubuntu2","1.4.22-1ubuntu1","1.4.22-1ubuntu2","1.4.22-1ubuntu3","1.4.22-1ubuntu4","1.4.22-1ubuntu4.14.04.1","1.4.22-1ubuntu4.14.04.2","1.4.22-1ubuntu4.14.04.3","1.4.22-1ubuntu4.14.04.3+esm1","1.4.22-1ubuntu4.14.04.3+esm2","1.4.22-1ubuntu4.14.04.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.8-1ubuntu1.1+esm4"}]}],"versions":["1.4.22-1ubuntu6","1.5.7-1ubuntu1","1.5.7-1ubuntu2","1.5.8-1ubuntu1","1.5.8-1ubuntu1.1","1.5.8-1ubuntu1.1+esm1","1.5.8-1ubuntu1.1+esm2","1.5.8-1ubuntu1.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.7-1ubuntu2.6+esm5"}]}],"versions":["1.6.5-1","1.6.7-1","1.6.7-1build1","1.6.7-1ubuntu1","1.6.7-1ubuntu2","1.6.7-1ubuntu2.1","1.6.7-1ubuntu2.2","1.6.7-1ubuntu2.3","1.6.7-1ubuntu2.4","1.6.7-1ubuntu2.5","1.6.7-1ubuntu2.6","1.6.7-1ubuntu2.6+esm2","1.6.7-1ubuntu2.6+esm3","1.6.7-1ubuntu2.6+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-2ubuntu1.11+esm2"}]}],"versions":["1.9.0-2ubuntu1","1.9.0-2ubuntu2","1.9.4-2","1.9.4-2ubuntu1","1.9.4-2ubuntu1.1","1.9.4-2ubuntu1.2","1.9.4-2ubuntu1.3","1.9.4-2ubuntu1.4","1.9.4-2ubuntu1.5","1.9.4-2ubuntu1.6","1.9.4-2ubuntu1.8","1.9.4-2ubuntu1.9","1.9.4-2ubuntu1.11","1.9.4-2ubuntu1.11+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-1ubuntu5.16"}]}],"versions":["1.13.1-1ubuntu1","1.13.1-1ubuntu3","1.13.1-1ubuntu5","1.13.1-1ubuntu5.1","1.13.1-1ubuntu5.2","1.13.1-1ubuntu5.3","1.13.1-1ubuntu5.4","1.13.1-1ubuntu5.5","1.13.1-1ubuntu5.7","1.13.1-1ubuntu5.8","1.13.1-1ubuntu5.10","1.13.1-1ubuntu5.11","1.13.1-1ubuntu5.12","1.13.1-1ubuntu5.13","1.13.1-1ubuntu5.14","1.13.1-1ubuntu5.15"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-1ubuntu3.10"}]}],"versions":["1.17.1-2","1.18.0-2ubuntu1","1.18.0-2ubuntu2","1.19.1-1ubuntu1","1.19.2-1ubuntu1","1.19.2-1ubuntu3","1.19.2-1ubuntu3.1","1.19.2-1ubuntu3.2","1.19.2-1ubuntu3.3","1.19.2-1ubuntu3.4","1.19.2-1ubuntu3.5","1.19.2-1ubuntu3.6","1.19.2-1ubuntu3.7","1.19.2-1ubuntu3.8","1.19.2-1ubuntu3.9"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.2-1ubuntu2","1.25.1-1ubuntu1","1.25.1-1ubuntu3","1.25.1-1ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-1ubuntu2.3"}]}],"versions":["1.22.0-2ubuntu2","1.22.0-2ubuntu4","1.24.2-1ubuntu1","1.24.2-1ubuntu2","1.24.2-1ubuntu2.1","1.24.2-1ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.22-1ubuntu4.14.04.3+esm4"}]}],"versions":["1.4.20-1","1.4.21-1","1.4.21-1ubuntu1","1.4.21-1ubuntu2","1.4.22-1ubuntu1","1.4.22-1ubuntu2","1.4.22-1ubuntu3","1.4.22-1ubuntu4","1.4.22-1ubuntu4.14.04.1","1.4.22-1ubuntu4.14.04.2","1.4.22-1ubuntu4.14.04.3","1.4.22-1ubuntu4.14.04.3+esm1","1.4.22-1ubuntu4.14.04.3+esm2","1.4.22-1ubuntu4.14.04.3+esm3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.8-1ubuntu1.1+esm4"}]}],"versions":["1.4.22-1ubuntu6","1.5.7-1ubuntu1","1.5.7-1ubuntu2","1.5.8-1ubuntu1","1.5.8-1ubuntu1.1","1.5.8-1ubuntu1.1+esm1","1.5.8-1ubuntu1.1+esm2","1.5.8-1ubuntu1.1+esm3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.7-1ubuntu2.6+esm5"}]}],"versions":["1.6.5-1","1.6.7-1","1.6.7-1build1","1.6.7-1ubuntu1","1.6.7-1ubuntu2","1.6.7-1ubuntu2.1","1.6.7-1ubuntu2.2","1.6.7-1ubuntu2.3","1.6.7-1ubuntu2.4","1.6.7-1ubuntu2.5","1.6.7-1ubuntu2.6","1.6.7-1ubuntu2.6+esm2","1.6.7-1ubuntu2.6+esm3","1.6.7-1ubuntu2.6+esm4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-2ubuntu1.11+esm2"}]}],"versions":["1.9.0-2ubuntu1","1.9.0-2ubuntu2","1.9.4-2","1.9.4-2ubuntu1","1.9.4-2ubuntu1.1","1.9.4-2ubuntu1.2","1.9.4-2ubuntu1.3","1.9.4-2ubuntu1.4","1.9.4-2ubuntu1.5","1.9.4-2ubuntu1.6","1.9.4-2ubuntu1.8","1.9.4-2ubuntu1.9","1.9.4-2ubuntu1.11","1.9.4-2ubuntu1.11+esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-1ubuntu5.16"}]}],"versions":["1.13.1-1ubuntu1","1.13.1-1ubuntu3","1.13.1-1ubuntu5","1.13.1-1ubuntu5.1","1.13.1-1ubuntu5.2","1.13.1-1ubuntu5.3","1.13.1-1ubuntu5.4","1.13.1-1ubuntu5.5","1.13.1-1ubuntu5.7","1.13.1-1ubuntu5.8","1.13.1-1ubuntu5.10","1.13.1-1ubuntu5.11","1.13.1-1ubuntu5.12","1.13.1-1ubuntu5.13","1.13.1-1ubuntu5.14","1.13.1-1ubuntu5.15"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-1ubuntu3.10"}]}],"versions":["1.17.1-2","1.18.0-2ubuntu1","1.18.0-2ubuntu2","1.19.1-1ubuntu1","1.19.2-1ubuntu1","1.19.2-1ubuntu3","1.19.2-1ubuntu3.1","1.19.2-1ubuntu3.2","1.19.2-1ubuntu3.3","1.19.2-1ubuntu3.4","1.19.2-1ubuntu3.5","1.19.2-1ubuntu3.6","1.19.2-1ubuntu3.7","1.19.2-1ubuntu3.8","1.19.2-1ubuntu3.9"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-1ubuntu2.3"}]}],"versions":["1.22.0-2ubuntu2","1.22.0-2ubuntu4","1.24.2-1ubuntu1","1.24.2-1ubuntu2","1.24.2-1ubuntu2.1","1.24.2-1ubuntu2.2"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-160000.1.1"}]}],"bundled":9}],"products":[{"vendor":"nlnet labs","product":"unbound"},{"vendor":"nlnetlabs","product":"unbound"}],"references":[{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-82717.txt","tags":["vendor-advisory","Patch","Vendor Advisory","fix","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82717","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-r5xg-xh8m-9q2w"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-82717","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:70754","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-81634","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-81642","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-82717","tags":["report"]},{"url":"https://bugzilla.redhat.com/2535051","tags":["report"]},{"url":"https://bugzilla.redhat.com/2535054","tags":["report"]},{"url":"https://bugzilla.redhat.com/2535059","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-70754.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71419","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-71419.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71487","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-71487.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1791327169.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81634","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81642","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85501","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-82717","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0451.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36346","tags":["report"]},{"url":"https://nlnetlabs.nl/projects/unbound/security-advisories/","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4148","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80225","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4149","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4150","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4151","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68590","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-82720","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-80225","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-77860","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-77955","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-85501","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-78227","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68590.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535050","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-77860","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77860","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-77860.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535053","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-77955","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77955","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-77955.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535052","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-78227","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78227","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-78227.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535055","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80225","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-80225.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535054","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81634","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81634.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535059","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81642","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81642.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535051","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-82717","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535060","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-82720","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82720","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-82720.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535057","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85501","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-85501.txt","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70754.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71419.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71487.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:70754","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:71419","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:71487","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624128-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1280403","tags":["report"]},{"url":"https://bugzilla.suse.com/1280404","tags":["report"]},{"url":"https://bugzilla.suse.com/1280405","tags":["report"]},{"url":"https://bugzilla.suse.com/1280406","tags":["report"]},{"url":"https://bugzilla.suse.com/1280409","tags":["report"]},{"url":"https://bugzilla.suse.com/1280411","tags":["report"]},{"url":"https://bugzilla.suse.com/1280412","tags":["report"]},{"url":"https://bugzilla.suse.com/1280413","tags":["report"]},{"url":"https://bugzilla.suse.com/1280414","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81642","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-82717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-82720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85501","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624135-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50248","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624226-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624376-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264620-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264624-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-82717","tags":["report"]},{"url":"https://nlnetlabs.nl/downloads/unbound/CVE-2026-82717.txt","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8873-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-81642","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-82717","title":"CNAME synthesis could lead to heap corruption","description":"In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.","status":"published","published":"2026-09-16T08:31:59.417Z","modified":"2026-09-16T14:15:55.295Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U","level":"high","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T13:40:46.161838Z"}],"euvd":[{"id":"EUVD-2026-80292","description":"In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.","status":"published","published":"2026-09-16T08:31:59Z","modified":"2026-09-16T14:15:55Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U","level":"high"}],"updated_at":"2026-11-02T17:28:16.201278Z"}],"ghsa":[{"id":"GHSA-r5xg-xh8m-9q2w","title":"In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can...","description":"In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.","status":"published","published":"2026-09-16T09:30:28Z","modified":"2026-09-23T21:30:30Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:12:21.120874Z"}],"nvd":[{"id":"CVE-2026-82717","description":"In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.","status":"published","published":"2026-09-16T09:17:06.55Z","modified":"2026-09-23T19:50:17.347Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:12:48.287983Z"}],"osv":[{"id":"ALPINE-CVE-2026-82717","description":"In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.","status":"published","published":"2026-09-16T09:17:06.55Z","modified":"2026-10-01T02:17:49.415987271Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"CVE-2026-82717","description":"In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.","status":"published","published":"2026-09-16T09:17:06.55Z","modified":"2026-10-27T17:27:08.941687194Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:18.482949Z"},{"id":"DEBIAN-CVE-2026-82717","description":"In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.","status":"published","published":"2026-09-16T09:17:06.55Z","modified":"2026-09-24T09:00:18.425459667Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:46:04.577397Z"},{"id":"OESA-2026-4148","title":"unbound security update","description":"Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn\u0026amp;apos;t make custom builds or provide specific features to paying customers only.\r\n\r\nSecurity Fix(es):\n\nIn NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker\u0026apos;s entire event loop for as long as its writes stay ahead of the drain.(CVE-2026-80225)\n\nIn NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNSSEC validation), can trigger the vulnerability.(CVE-2026-81634)\n\nIn NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.(CVE-2026-82717)","status":"published","published":"2026-09-30T13:47:04Z","modified":"2026-10-01T02:00:05.381438713Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4149","title":"unbound security update","description":"Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn\u0026amp;apos;t make custom builds or provide specific features to paying customers only.\r\n\r\nSecurity Fix(es):\n\nIn NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker\u0026apos;s entire event loop for as long as its writes stay ahead of the drain.(CVE-2026-80225)\n\nIn NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNSSEC validation), can trigger the vulnerability.(CVE-2026-81634)\n\nIn NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.(CVE-2026-82717)","status":"published","published":"2026-09-30T13:47:04Z","modified":"2026-10-01T02:00:03.610130517Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4150","title":"unbound security update","description":"Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn\u0026amp;apos;t make custom builds or provide specific features to paying customers only.\r\n\r\nSecurity Fix(es):\n\nIn NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker\u0026apos;s entire event loop for as long as its writes stay ahead of the drain.(CVE-2026-80225)\n\nIn NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNSSEC validation), can trigger the vulnerability.(CVE-2026-81634)\n\nIn NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.(CVE-2026-82717)","status":"published","published":"2026-09-30T13:47:05Z","modified":"2026-10-01T02:00:06.079840941Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4151","title":"unbound security update","description":"Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn\u0026amp;apos;t make custom builds or provide specific features to paying customers only.\r\n\r\nSecurity Fix(es):\n\nIn NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker\u0026apos;s entire event loop for as long as its writes stay ahead of the drain.(CVE-2026-80225)\n\nIn NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNSSEC validation), can trigger the vulnerability.(CVE-2026-81634)\n\nIn NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.(CVE-2026-82717)","status":"published","published":"2026-09-30T13:47:05Z","modified":"2026-10-01T02:00:06.077792682Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"RHSA-2026:68590","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-22T10:19:16Z","modified":"2026-10-17T10:18:35Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:70754","title":"Red Hat Security Advisory: unbound security update","status":"published","published":"2026-09-24T10:15:06Z","modified":"2026-10-19T10:06:24Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:71419","title":"Red Hat Security Advisory: unbound security update","status":"published","published":"2026-09-25T10:15:25Z","modified":"2026-10-19T10:06:29Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:71487","title":"Red Hat Security Advisory: unbound security update","status":"published","published":"2026-09-25T10:15:28Z","modified":"2026-10-19T10:06:32Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RLSA-2026:70754","title":"Critical: unbound security update","description":"The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. \n\nSecurity Fix(es):\n\n* unbound: Unbound: Remote Code Execution Vulnerability in CNAME Synthesis (CVE-2026-82717)\n\n* unbound: Unbound: Heap buffer overflow via malicious DNSSEC response (CVE-2026-81634)\n\n* unbound: Unbound: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (CVE-2026-81642)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-24T06:01:33.182947Z","modified":"2026-09-24T06:30:02.681812819Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:71419","title":"Critical: unbound security update","description":"The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. \n\nSecurity Fix(es):\n\n* unbound: Unbound: Remote Code Execution Vulnerability in CNAME Synthesis (CVE-2026-82717)\n\n* unbound: Unbound: Heap buffer overflow via malicious DNSSEC response (CVE-2026-81634)\n\n* unbound: Unbound: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (CVE-2026-81642)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-25T12:09:37.504383Z","modified":"2026-09-25T12:30:02.730587798Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:71487","title":"Critical: unbound security update","description":"The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. \n\nSecurity Fix(es):\n\n* unbound: Unbound: Remote Code Execution Vulnerability in CNAME Synthesis (CVE-2026-82717)\n\n* unbound: Unbound: Heap buffer overflow via malicious DNSSEC response (CVE-2026-81634)\n\n* unbound: Unbound: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (CVE-2026-81642)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-25T18:04:58.698983Z","modified":"2026-09-25T18:24:41.506963229Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-82717","description":"In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.","status":"published","published":"2026-09-16T09:17:00Z","modified":"2026-11-11T09:41:11.173569804Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-11T10:03:16.170826Z"},{"id":"ALSA-2026:70754","title":"Critical: unbound security update","description":"The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.   \n\nSecurity Fix(es):  \n\n  * unbound: Unbound: Remote Code Execution Vulnerability in CNAME Synthesis (CVE-2026-82717)\n  * unbound: Unbound: Heap buffer overflow via malicious DNSSEC response (CVE-2026-81634)\n  * unbound: Unbound: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (CVE-2026-81642)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-23T00:00:00Z","modified":"2026-10-29T11:00:27.969842145Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:71419","title":"Critical: unbound security update","description":"The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.   \n\nSecurity Fix(es):  \n\n  * unbound: Unbound: Remote Code Execution Vulnerability in CNAME Synthesis (CVE-2026-82717)\n  * unbound: Unbound: Heap buffer overflow via malicious DNSSEC response (CVE-2026-81634)\n  * unbound: Unbound: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (CVE-2026-81642)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-24T00:00:00Z","modified":"2026-10-29T11:30:51.427227982Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:71487","title":"Critical: unbound security update","description":"The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.   \n\nSecurity Fix(es):  \n\n  * unbound: Unbound: Remote Code Execution Vulnerability in CNAME Synthesis (CVE-2026-82717)\n  * unbound: Unbound: Heap buffer overflow via malicious DNSSEC response (CVE-2026-81634)\n  * unbound: Unbound: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (CVE-2026-81642)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-24T00:00:00Z","modified":"2026-10-29T11:32:32.262141216Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-101700","title":"CVE-2026-82717 affecting package unbound for versions less than 1.26.1-1","description":"In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.","status":"published","published":"2026-09-16T09:17:06Z","modified":"2026-09-23T14:15:56.150668798Z","updated_at":"2026-11-02T15:28:00.508704Z"},{"id":"CLSA-2026-1791327169","title":"unbound: Fix of 4 CVEs","description":"- CVE-2026-81642: fix heap buffer overflow when digesting DNSKEY\n- CVE-2026-81634: add the missing first owner name and signature length\n  bounds checks to rrset_canonical(), preventing a heap buffer overflow\n  during RRset canonicalisation\n- CVE-2026-82717: restore the packet buffer position on malformed names\n  in pkt_dname_len() and bound the copy lengths in rdata_copy(),\n  preventing heap corruption on the CNAME synthesis error path\n- CVE-2026-85501: bound DNSSEC validation work per query: key-tag\n  matches capped at 256, NSEC/NSEC3 verifications at 8 per message, new\n  val-validation-attempts and val-hash-attempts options (default 32),\n  oversized referral DS RRsets shortened to 20, and val-clean-additional\n  now defaults to no","status":"published","published":"2026-10-08T21:56:57Z","modified":"2026-10-26T09:43:27.512691006Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"MGASA-2026-0451","title":"Updated unbound packages fixes security vulnerabilities","description":"Heap buffer overflow and possible Remote Code Execution when digesting\nDNSKEY\nPossible heap buffer overflow during DNSSEC canonicalization\nCNAME synthesis could lead to heap corruption\nPossible ZONEMD verification bypass window\nUse-after-free in DoQ stream output buffer on reset re-transmission\nPossible degradation of service from continuous queries on the same\nTCP/DoT connection\nUse-after-free in DoH stream cleanup code path\nRetrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks\non DNSSEC\n'serve-expired' can bypass Unbound 'wait-limit'\nRemote DNS-over-QUIC denial of service due to 'quic-size' budget bypass\nPacket of death for DNSCrypt over TCP\nCross-zone wildcard cache poisoning via RRSIG.labels manipulation\n'dns-error-reporting: yes' leads to stack buffer overflow\nAssertion in libngtcp2 when under pressure in high concurrency\nDNS-over-QUIC environments\nLibunbound applications configured with 'unwanted-reply-threshold' could\neventually be abruptly terminated\n'max-global-quota' reset by DNSSEC validation restarts\nPossible heap use-after-free in an error path when a DoT forwarded query\nis jostled out\n'response-ip'/'rpz' can rewrite BOGUS answers instead of returning\nSERVFAIL\nBOGUS configured primary hostname accepted for XFR in auth/rpz zones\nDate:\nAttacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache\nflush\nPossible cache poisoning attack by mapping source port population per\nthread\nMemory corruption could lead to crash and denial of service\n'serve-expired-client-timeout' and 'response-ip' CNAME redirect could\nlead to a crash\nPacket of death for a DNSCrypt misconfigured Unbound\nRemote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2\nPossible heap buffer overflow when validator canonicalizes RDATA that\ncontains domain name\nDegradation of resolution service when 'discard-timeout' and\n'serve-expired-client-timeout' are combined in unusual configuration\nDegradation of resolution service from improperly accounted\nclient-terminated DNS-over-QUIC queries\nExtra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records\ndisallowing a one-time 'ghost domain' delegation renewal via glue\nrecords\nOff-by-one error in 'harden-below-nxdomain' logic can shadow a\nstub/forward zone by a legitimate parent's NXDOMAIN\nA wildcard replay, as another piece of data, triggers poisoning in the\nserve expired reply path\nDNS Cookie bypass when combined with proxy-protocol use\nPrivacy/configuration issue when adding local data in views through\n'unbound-control'\nPossible arbitrary code execution during DNSSEC validation\nHeap overflow with multiple NSID, COOKIE, PADDING EDNS options\nCrash during DNSSEC validation of malicious content\nDate:\nPacket of death with DNSCrypt\nAnother \"ghost domain names\" attack variant\nLong list of incoming EDNS options degrades performance\nJostle logic bypass degrades resolution performance\nDegradation of service with unbounded NSEC3 hash calculations\nPossible cache poisoning via promiscuous records for the authority\nsection\nUnbounded name compression in certain cases causes degradation of\nservice\nUse after free and crash under special conditions in RPZ code\nPossible domain hijacking via promiscuous records in the authority\nsection\nCache poisoning via the ECS-enabled Rebirthday Attack\nUnbounded name compression could lead to Denial of Service\nUnbound vulnerable to the \"DNSBomb\" pulsing DoS amplification attack\nDenial of service when trimming EDE text on positive replies\nDNSSEC verification complexity can be exploited to exhaust CPU resources\nand stall DNS resolvers\nNSEC3 closest encloser proof can exhaust CPU\nNon-Responsive Delegation Attack\nNovel \"ghost domain names\" attack by updating almost expired delegation\ninformation\nNovel \"ghost domain names\" attack by introducing subdomain delegations\nLocal symlink attack\nVulnerability in Domain Parse\nNXNSAttack\nVulnerability in IPSEC module\nVulnerability in parsing NOTIFY queries\nVulnerability in the processing of wildcard synthesized NSEC records\nNo limit to delegation chaining\nGhost domain names attack\nIncorrect proof processing for NSEC3-signed zone\nProcessing of duplicate CNAME records in a signed zone\nEmpty error packet handling assertion failure\n","status":"published","published":"2026-09-25T05:02:40Z","modified":"2026-09-25T05:15:03.49547618Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11930-1","title":"libunbound8-1.26.1-1.1 on GA media","description":"These are all security issues fixed in the libunbound8-1.26.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-29T00:00:00Z","modified":"2026-09-30T18:23:14.940782144Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22082-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\n- CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' (bsc#1280403).\n- CVE-2026-77955: Possible ZONEMD verification bypass window (bsc#1280404).\n- CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission (bsc#1280405).\n- CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection (bsc#1280406).\n- CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization (bsc#1280409).\n- CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (bsc#1280411).\n- CVE-2026-82717: CNAME synthesis could lead to heap corruption (bsc#1280412).\n- CVE-2026-82720: Use-after-free in DoH stream cleanup code path (bsc#1280413).\n- CVE-2026-85501: Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC (bsc#1280414).\n\nChanges for unbound:\n\n- Update to 1.26.1:\n * Update icannbundle.pem certificates in unbound-anchor, valid\n for 2009-2029 and 2025-2045\n * Add max-transfer-size and max-transfer-time options to limit\n auth-zone and rpz transfer size and time, default disabled\n * Overload local_data_remove in unbound-control to also remove\n specific records\n * Add local-zone types block_aaaa, block_a_wdata and\n block_aaaa_wdata; fix respip+dns64 to use original A records\n instead of ones already modified by respip\n * ipsecmod hook script now needs to start with '#!/bin/sh', it\n is executed with execv instead of system for security\n * Server now continues to start if a secondary zone fails to\n load from its zonefile, or if a primary zonefile is missing;\n $INCLUDE is no longer allowed in secondary zone zonefiles\n * Auth-zone and RPZ zones now drop out-of-zone content on load\n * Primary hostname for zone transfers can now use CNAME(s)\n * Fix windows 64bit build for libssp dependency\n * Update IANA portlist\n * Fix heap out-of-bounds write via size_t-to-int truncation in\n setup_if()/outside_network_create() for large num_ports values\n * Fix to clean up log ids after a failure to start a worker\n thread\n * Relax assertions after the TTL 0 handling change in cachedb\n and packet_rrset_copy_region\n * Fix val_find_DS to check the result of packet_rrset_copy_region\n before using it\n * Fix that dns64 answers check the AAAA query is DNSSEC\n validated, improving RFC6147 conformance\n * Fix allocation-failure hardening of rrset cache wildcard\n storage and canonical NSEC owner replacement\n * Fix DNSSEC validation and DNSKEY size calculation for\n noncanonical RSA DNSKEYs with leading zeroes\n * Fix mixed class referrals to use the query class\n * Fix serve-expired responses from cachedb to not store bogus\n data\n * Fix lame server detection for selfpointed glue records\n * Fix cleanup of DoH sessions when the same query is on multiple\n streams\n * Fix for signed same-owner CNAME and ordinary RRset responses\n * Fix mesh new client/callback to roll back added address, tcp\n mesh state and callback on initialization failure\n * Fix autotrust state-file line overflow that could give a\n hold-down bypass\n * Fix to limit the DSNS per-label walk in the iterator\n * Fix that the ratelimit is decremented on successful referrals\n * Fix msgencode insert_query assertion for a local_alias\n * Fix to reset the tcp-timeout before applying a load based\n reduction\n * Fix to correctly decrement per-netblock tcp connection limits\n * Fix, in depth, for respip rewrite of dns64 responses\n * Fix that dns64 with subnetcache does not write ECS scoped\n answers to the global cache\n * Fix ipset module name-too-long checks and race conditions on\n the local name buffer and socket close\n * Fix validator to cap the number of ANY RRsets it validates and\n shorten the wait timer\n * Fix race condition causing segfault when starting threads\n * Fix header_seen detection for trust anchor files to detect the\n id line\n * Fix heap use-after-free in class response processing when at\n least two distinct classes are configured\n * Fix negative cache to work with NSEC3 records without salt\n * Fix parse of svcbparam ech, it had an incorrect length\n * Fix that quotation and escaping works the same in auth-zone\n url content as in zonefile reads\n * Fix ipset module to use larger domain name buffers and check\n buffer lengths\n * Fix PROXYv2 header read and consume to check the header size\n * Fix negative cache NSEC3 nodata proof to use the correct\n message size\n * Fix fast_reload for when a ZONEMD lookup is in progress\n * Fix that validation canonicalization of domain names in rdata\n checks buffer bounds\n * Fix dump_cache to use a larger record buffer and check that an\n owner name does not collide with BADRR\n * Fix that dns64 cleans up the allocated message if the adjust\n routines fail, and checks for malformed A/AAAA in auth-zones\n * Fix pythonmod script read for numeric overflow\n * Fix configure to detect the correct QUIC early-data function\n and to check for the ngtcp2_crypto_ossl header\n * Fix compile with OpenSSL 4.0.1, and with OpenSSL 1.0.2 and\n earlier in server cleanup\n * Fix that auth-zone/rpz allow-notify addresses and netblocks\n are available from start, and fix the probe step skip\n * Fix to perform a full transfer periodically to stop increasing\n memory usage for rpz zones\n * Fix assertion failure for a long HTTP header that fills the\n buffer, and buffer overflow with lower than default size and\n http transfer\n * Fix that misconfigured iter-scrub-ns: 0 causes request failures\n * Fix fast_reload handling of in-progress ZONEMD lookups and of\n removing an auth zone while its lookups are in progress\n * Fix integer overflow in infra-cache-max-rtt calculation and for\n very high values of sock-queue-timeout\n * Fix erroneous DNS error report values after a bogus AAAA query\n * Fix fast_reload to not terminate the server on config errors\n for key files\n * Fix log of an aliased qname to not use freed region memory\n * Fix DNAME synthesis from cache to keep using 0TTL entries\n within a sliding window without surpassing RRSIG expiry\n * Fix that dns64 bypasses the rpz-passthru rule during synthesis\n * Fix to disallow $INCLUDE for secondary zones; failed loads now\n clear the zone data so there is no partial zone\n * Fix zone read to allow SVCB records in unknown format that\n cannot be written out\n * Fix that a half-written trust anchor file does not crash the\n server at runtime\n * Fix that auth-zone and RPZ zones drop out-of-zone records\n * Fix that dns64 honors the forward-no-cache and stub-no-cache\n options\n * Fix that a signed wildcard NSEC is checked before use, so it\n does not allow insecure DS proofs inappropriately\n * Fix several crashes after malloc failure: half-built\n local_alias, RPZ list, delegation point cleanup,\n dns64_inform_super, new_local_rrset for RPZ qname trigger, doq\n connection setup, ngtcp2_conn_server_new, TCP accept handling,\n rpz_strip_nsdname, edns subnet addrtree insert, and rpz\n response create\n * Fix that a zonefile-only zone continues server startup with a\n warning if the file is missing on start\n * Fix that dnscrypt configuration does not crash on a\n secret/public key mismatch, and duplicate files are skipped\n * Fix locking in libunbound ub_ctx_set_event\n * Fix that libunbound pipe functions fail with an error after an\n event base is set\n * Fix incorrect cleanup after an allocation failure for a\n delegation point\n * Fix that the server does not crash if shared memory cannot be\n created for shm-enable\n * Fix auth primary host name lookup to allow CNAMEs\n * Fix memory leak on DNAME 0TTL records\n * Fix that fast_reload disown of the auth zone transfer task\n cleans up the chunk list\n * Fix unbound-checkconf to check for auth-zone download filename\n collisions\n * Fix malloc failure in auth-zone insert rr to avoid an empty\n node and infinite loop\n * Fix that unbound-control auth_zone_reload stops answering from\n the zone after a read failure\n * Fix stats pipe draining after a malloc failure so internal\n messaging stays correct, and the server no longer exits on\n stats pipe communication failure\n * Fix that fast_reload does not terminate the server if random\n init for DNS cookies fails\n * Fix thread setname for dnstap and fast_reload thread start\n * Add libunbound/remote.h, a shared header with prototypes for\n remote control connections\n * Fix DEREF_AFTER_NULL on worker_init when stat_timer allocation\n fails with an out of memory error\n * Fix DoH POST requests missing content-length causing :status\n 400 from strict resolvers like Cloudflare and Mullvad\n * Fix randomness generation on macOS/iOS under chroot\n * Fix ipsecmod deref on null in ipsecmod-whitelist after OOM, and\n possible deref on null after reply_find_answer_rrset()\n * Fix that DoQ responses were never padded; pad-responses now\n applies to comm_doq per RFC 9250 section 5.4\n * Fix log printout error in the fix for CVE-2026-50248 when the\n primary name is bogus\n * Fix NSEC3 proofs to check the b32 name matches the signer name;\n RRSIGs are no longer valid when this does not match\n * Fix aggressive negative cache to not insert NSEC records with\n an overreaching next owner name outside the trust anchor's\n bailiwick\n * Fix mesh cycle detection for respip CNAME loop with tagged\n clients\n * Fix unbound-anchor to check the return value of\n X509_NAME_get_text_by_NID for the emailaddress\n * Fix locking of the shared_ports structure during\n initialisation, and of the anchor structure when a file is set\n during header parsing\n * Fix memory leak in xfer_set_masters() error path in authzone\n * Fix to use tls-port after a referral when tls-upstream is set\n * Fix pthread detection on Solaris 11.4\n * Fix to call OPENSSL_cleanup on exit when it is defined\n * pythonmod: check the return value after ftell()\n","status":"published","published":"2026-10-09T15:11:12Z","modified":"2026-10-19T17:23:13.48392302Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-82717","title":"CVE-2026-82717 in unbound - Patched by Root","description":"Root has patched CVE-2026-82717 in the unbound package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-09-22T12:19:46Z","modified":"2026-09-22T13:15:03.145403226Z","updated_at":"2026-11-02T15:53:32.570806Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-82717","title":"CVE-2026-82717 in unbound - Patched by Root","description":"Root has patched CVE-2026-82717 in the unbound package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-09-23T08:20:02Z","modified":"2026-10-09T13:00:18.311552953Z","updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"SUSE-SU-2026:24128-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\n- CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' (bsc#1280403).\n- CVE-2026-77955: Possible ZONEMD verification bypass window (bsc#1280404).\n- CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission (bsc#1280405).\n- CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection (bsc#1280406).\n- CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization (bsc#1280409).\n- CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (bsc#1280411).\n- CVE-2026-82717: CNAME synthesis could lead to heap corruption (bsc#1280412).\n- CVE-2026-82720: Use-after-free in DoH stream cleanup code path (bsc#1280413).\n- CVE-2026-85501: Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC (bsc#1280414).\n\nChanges for unbound:\n\n- Update to 1.26.1:\n * Update icannbundle.pem certificates in unbound-anchor, valid\n for 2009-2029 and 2025-2045\n * Add max-transfer-size and max-transfer-time options to limit\n auth-zone and rpz transfer size and time, default disabled\n * Overload local_data_remove in unbound-control to also remove\n specific records\n * Add local-zone types block_aaaa, block_a_wdata and\n block_aaaa_wdata; fix respip+dns64 to use original A records\n instead of ones already modified by respip\n * ipsecmod hook script now needs to start with '#!/bin/sh', it\n is executed with execv instead of system for security\n * Server now continues to start if a secondary zone fails to\n load from its zonefile, or if a primary zonefile is missing;\n $INCLUDE is no longer allowed in secondary zone zonefiles\n * Auth-zone and RPZ zones now drop out-of-zone content on load\n * Primary hostname for zone transfers can now use CNAME(s)\n * Fix windows 64bit build for libssp dependency\n * Update IANA portlist\n * Fix heap out-of-bounds write via size_t-to-int truncation in\n setup_if()/outside_network_create() for large num_ports values\n * Fix to clean up log ids after a failure to start a worker\n thread\n * Relax assertions after the TTL 0 handling change in cachedb\n and packet_rrset_copy_region\n * Fix val_find_DS to check the result of packet_rrset_copy_region\n before using it\n * Fix that dns64 answers check the AAAA query is DNSSEC\n validated, improving RFC6147 conformance\n * Fix allocation-failure hardening of rrset cache wildcard\n storage and canonical NSEC owner replacement\n * Fix DNSSEC validation and DNSKEY size calculation for\n noncanonical RSA DNSKEYs with leading zeroes\n * Fix mixed class referrals to use the query class\n * Fix serve-expired responses from cachedb to not store bogus\n data\n * Fix lame server detection for selfpointed glue records\n * Fix cleanup of DoH sessions when the same query is on multiple\n streams\n * Fix for signed same-owner CNAME and ordinary RRset responses\n * Fix mesh new client/callback to roll back added address, tcp\n mesh state and callback on initialization failure\n * Fix autotrust state-file line overflow that could give a\n hold-down bypass\n * Fix to limit the DSNS per-label walk in the iterator\n * Fix that the ratelimit is decremented on successful referrals\n * Fix msgencode insert_query assertion for a local_alias\n * Fix to reset the tcp-timeout before applying a load based\n reduction\n * Fix to correctly decrement per-netblock tcp connection limits\n * Fix, in depth, for respip rewrite of dns64 responses\n * Fix that dns64 with subnetcache does not write ECS scoped\n answers to the global cache\n * Fix ipset module name-too-long checks and race conditions on\n the local name buffer and socket close\n * Fix validator to cap the number of ANY RRsets it validates and\n shorten the wait timer\n * Fix race condition causing segfault when starting threads\n * Fix header_seen detection for trust anchor files to detect the\n id line\n * Fix heap use-after-free in class response processing when at\n least two distinct classes are configured\n * Fix negative cache to work with NSEC3 records without salt\n * Fix parse of svcbparam ech, it had an incorrect length\n * Fix that quotation and escaping works the same in auth-zone\n url content as in zonefile reads\n * Fix ipset module to use larger domain name buffers and check\n buffer lengths\n * Fix PROXYv2 header read and consume to check the header size\n * Fix negative cache NSEC3 nodata proof to use the correct\n message size\n * Fix fast_reload for when a ZONEMD lookup is in progress\n * Fix that validation canonicalization of domain names in rdata\n checks buffer bounds\n * Fix dump_cache to use a larger record buffer and check that an\n owner name does not collide with BADRR\n * Fix that dns64 cleans up the allocated message if the adjust\n routines fail, and checks for malformed A/AAAA in auth-zones\n * Fix pythonmod script read for numeric overflow\n * Fix configure to detect the correct QUIC early-data function\n and to check for the ngtcp2_crypto_ossl header\n * Fix compile with OpenSSL 4.0.1, and with OpenSSL 1.0.2 and\n earlier in server cleanup\n * Fix that auth-zone/rpz allow-notify addresses and netblocks\n are available from start, and fix the probe step skip\n * Fix to perform a full transfer periodically to stop increasing\n memory usage for rpz zones\n * Fix assertion failure for a long HTTP header that fills the\n buffer, and buffer overflow with lower than default size and\n http transfer\n * Fix that misconfigured iter-scrub-ns: 0 causes request failures\n * Fix fast_reload handling of in-progress ZONEMD lookups and of\n removing an auth zone while its lookups are in progress\n * Fix integer overflow in infra-cache-max-rtt calculation and for\n very high values of sock-queue-timeout\n * Fix erroneous DNS error report values after a bogus AAAA query\n * Fix fast_reload to not terminate the server on config errors\n for key files\n * Fix log of an aliased qname to not use freed region memory\n * Fix DNAME synthesis from cache to keep using 0TTL entries\n within a sliding window without surpassing RRSIG expiry\n * Fix that dns64 bypasses the rpz-passthru rule during synthesis\n * Fix to disallow $INCLUDE for secondary zones; failed loads now\n clear the zone data so there is no partial zone\n * Fix zone read to allow SVCB records in unknown format that\n cannot be written out\n * Fix that a half-written trust anchor file does not crash the\n server at runtime\n * Fix that auth-zone and RPZ zones drop out-of-zone records\n * Fix that dns64 honors the forward-no-cache and stub-no-cache\n options\n * Fix that a signed wildcard NSEC is checked before use, so it\n does not allow insecure DS proofs inappropriately\n * Fix several crashes after malloc failure: half-built\n local_alias, RPZ list, delegation point cleanup,\n dns64_inform_super, new_local_rrset for RPZ qname trigger, doq\n connection setup, ngtcp2_conn_server_new, TCP accept handling,\n rpz_strip_nsdname, edns subnet addrtree insert, and rpz\n response create\n * Fix that a zonefile-only zone continues server startup with a\n warning if the file is missing on start\n * Fix that dnscrypt configuration does not crash on a\n secret/public key mismatch, and duplicate files are skipped\n * Fix locking in libunbound ub_ctx_set_event\n * Fix that libunbound pipe functions fail with an error after an\n event base is set\n * Fix incorrect cleanup after an allocation failure for a\n delegation point\n * Fix that the server does not crash if shared memory cannot be\n created for shm-enable\n * Fix auth primary host name lookup to allow CNAMEs\n * Fix memory leak on DNAME 0TTL records\n * Fix that fast_reload disown of the auth zone transfer task\n cleans up the chunk list\n * Fix unbound-checkconf to check for auth-zone download filename\n collisions\n * Fix malloc failure in auth-zone insert rr to avoid an empty\n node and infinite loop\n * Fix that unbound-control auth_zone_reload stops answering from\n the zone after a read failure\n * Fix stats pipe draining after a malloc failure so internal\n messaging stays correct, and the server no longer exits on\n stats pipe communication failure\n * Fix that fast_reload does not terminate the server if random\n init for DNS cookies fails\n * Fix thread setname for dnstap and fast_reload thread start\n * Add libunbound/remote.h, a shared header with prototypes for\n remote control connections\n * Fix DEREF_AFTER_NULL on worker_init when stat_timer allocation\n fails with an out of memory error\n * Fix DoH POST requests missing content-length causing :status\n 400 from strict resolvers like Cloudflare and Mullvad\n * Fix randomness generation on macOS/iOS under chroot\n * Fix ipsecmod deref on null in ipsecmod-whitelist after OOM, and\n possible deref on null after reply_find_answer_rrset()\n * Fix that DoQ responses were never padded; pad-responses now\n applies to comm_doq per RFC 9250 section 5.4\n * Fix log printout error in the fix for CVE-2026-50248 when the\n primary name is bogus\n * Fix NSEC3 proofs to check the b32 name matches the signer name;\n RRSIGs are no longer valid when this does not match\n * Fix aggressive negative cache to not insert NSEC records with\n an overreaching next owner name outside the trust anchor's\n bailiwick\n * Fix mesh cycle detection for respip CNAME loop with tagged\n clients\n * Fix unbound-anchor to check the return value of\n X509_NAME_get_text_by_NID for the emailaddress\n * Fix locking of the shared_ports structure during\n initialisation, and of the anchor structure when a file is set\n during header parsing\n * Fix memory leak in xfer_set_masters() error path in authzone\n * Fix to use tls-port after a referral when tls-upstream is set\n * Fix pthread detection on Solaris 11.4\n * Fix to call OPENSSL_cleanup on exit when it is defined\n * pythonmod: check the return value after ftell()\n","status":"published","published":"2026-10-09T15:11:19Z","modified":"2026-10-13T17:23:10.19936105Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24135-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\n- CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' (bsc#1280403).\n- CVE-2026-77955: Possible ZONEMD verification bypass window (bsc#1280404).\n- CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission (bsc#1280405).\n- CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection (bsc#1280406).\n- CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization (bsc#1280409).\n- CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (bsc#1280411).\n- CVE-2026-82717: CNAME synthesis could lead to heap corruption (bsc#1280412).\n- CVE-2026-82720: Use-after-free in DoH stream cleanup code path (bsc#1280413).\n- CVE-2026-85501: Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC (bsc#1280414).\n\nChanges for unbound:\n\n- Update to 1.26.1:\n * Update icannbundle.pem certificates in unbound-anchor, valid\n for 2009-2029 and 2025-2045\n * Add max-transfer-size and max-transfer-time options to limit\n auth-zone and rpz transfer size and time, default disabled\n * Overload local_data_remove in unbound-control to also remove\n specific records\n * Add local-zone types block_aaaa, block_a_wdata and\n block_aaaa_wdata; fix respip+dns64 to use original A records\n instead of ones already modified by respip\n * ipsecmod hook script now needs to start with '#!/bin/sh', it\n is executed with execv instead of system for security\n * Server now continues to start if a secondary zone fails to\n load from its zonefile, or if a primary zonefile is missing;\n $INCLUDE is no longer allowed in secondary zone zonefiles\n * Auth-zone and RPZ zones now drop out-of-zone content on load\n * Primary hostname for zone transfers can now use CNAME(s)\n * Fix windows 64bit build for libssp dependency\n * Update IANA portlist\n * Fix heap out-of-bounds write via size_t-to-int truncation in\n setup_if()/outside_network_create() for large num_ports values\n * Fix to clean up log ids after a failure to start a worker\n thread\n * Relax assertions after the TTL 0 handling change in cachedb\n and packet_rrset_copy_region\n * Fix val_find_DS to check the result of packet_rrset_copy_region\n before using it\n * Fix that dns64 answers check the AAAA query is DNSSEC\n validated, improving RFC6147 conformance\n * Fix allocation-failure hardening of rrset cache wildcard\n storage and canonical NSEC owner replacement\n * Fix DNSSEC validation and DNSKEY size calculation for\n noncanonical RSA DNSKEYs with leading zeroes\n * Fix mixed class referrals to use the query class\n * Fix serve-expired responses from cachedb to not store bogus\n data\n * Fix lame server detection for selfpointed glue records\n * Fix cleanup of DoH sessions when the same query is on multiple\n streams\n * Fix for signed same-owner CNAME and ordinary RRset responses\n * Fix mesh new client/callback to roll back added address, tcp\n mesh state and callback on initialization failure\n * Fix autotrust state-file line overflow that could give a\n hold-down bypass\n * Fix to limit the DSNS per-label walk in the iterator\n * Fix that the ratelimit is decremented on successful referrals\n * Fix msgencode insert_query assertion for a local_alias\n * Fix to reset the tcp-timeout before applying a load based\n reduction\n * Fix to correctly decrement per-netblock tcp connection limits\n * Fix, in depth, for respip rewrite of dns64 responses\n * Fix that dns64 with subnetcache does not write ECS scoped\n answers to the global cache\n * Fix ipset module name-too-long checks and race conditions on\n the local name buffer and socket close\n * Fix validator to cap the number of ANY RRsets it validates and\n shorten the wait timer\n * Fix race condition causing segfault when starting threads\n * Fix header_seen detection for trust anchor files to detect the\n id line\n * Fix heap use-after-free in class response processing when at\n least two distinct classes are configured\n * Fix negative cache to work with NSEC3 records without salt\n * Fix parse of svcbparam ech, it had an incorrect length\n * Fix that quotation and escaping works the same in auth-zone\n url content as in zonefile reads\n * Fix ipset module to use larger domain name buffers and check\n buffer lengths\n * Fix PROXYv2 header read and consume to check the header size\n * Fix negative cache NSEC3 nodata proof to use the correct\n message size\n * Fix fast_reload for when a ZONEMD lookup is in progress\n * Fix that validation canonicalization of domain names in rdata\n checks buffer bounds\n * Fix dump_cache to use a larger record buffer and check that an\n owner name does not collide with BADRR\n * Fix that dns64 cleans up the allocated message if the adjust\n routines fail, and checks for malformed A/AAAA in auth-zones\n * Fix pythonmod script read for numeric overflow\n * Fix configure to detect the correct QUIC early-data function\n and to check for the ngtcp2_crypto_ossl header\n * Fix compile with OpenSSL 4.0.1, and with OpenSSL 1.0.2 and\n earlier in server cleanup\n * Fix that auth-zone/rpz allow-notify addresses and netblocks\n are available from start, and fix the probe step skip\n * Fix to perform a full transfer periodically to stop increasing\n memory usage for rpz zones\n * Fix assertion failure for a long HTTP header that fills the\n buffer, and buffer overflow with lower than default size and\n http transfer\n * Fix that misconfigured iter-scrub-ns: 0 causes request failures\n * Fix fast_reload handling of in-progress ZONEMD lookups and of\n removing an auth zone while its lookups are in progress\n * Fix integer overflow in infra-cache-max-rtt calculation and for\n very high values of sock-queue-timeout\n * Fix erroneous DNS error report values after a bogus AAAA query\n * Fix fast_reload to not terminate the server on config errors\n for key files\n * Fix log of an aliased qname to not use freed region memory\n * Fix DNAME synthesis from cache to keep using 0TTL entries\n within a sliding window without surpassing RRSIG expiry\n * Fix that dns64 bypasses the rpz-passthru rule during synthesis\n * Fix to disallow $INCLUDE for secondary zones; failed loads now\n clear the zone data so there is no partial zone\n * Fix zone read to allow SVCB records in unknown format that\n cannot be written out\n * Fix that a half-written trust anchor file does not crash the\n server at runtime\n * Fix that auth-zone and RPZ zones drop out-of-zone records\n * Fix that dns64 honors the forward-no-cache and stub-no-cache\n options\n * Fix that a signed wildcard NSEC is checked before use, so it\n does not allow insecure DS proofs inappropriately\n * Fix several crashes after malloc failure: half-built\n local_alias, RPZ list, delegation point cleanup,\n dns64_inform_super, new_local_rrset for RPZ qname trigger, doq\n connection setup, ngtcp2_conn_server_new, TCP accept handling,\n rpz_strip_nsdname, edns subnet addrtree insert, and rpz\n response create\n * Fix that a zonefile-only zone continues server startup with a\n warning if the file is missing on start\n * Fix that dnscrypt configuration does not crash on a\n secret/public key mismatch, and duplicate files are skipped\n * Fix locking in libunbound ub_ctx_set_event\n * Fix that libunbound pipe functions fail with an error after an\n event base is set\n * Fix incorrect cleanup after an allocation failure for a\n delegation point\n * Fix that the server does not crash if shared memory cannot be\n created for shm-enable\n * Fix auth primary host name lookup to allow CNAMEs\n * Fix memory leak on DNAME 0TTL records\n * Fix that fast_reload disown of the auth zone transfer task\n cleans up the chunk list\n * Fix unbound-checkconf to check for auth-zone download filename\n collisions\n * Fix malloc failure in auth-zone insert rr to avoid an empty\n node and infinite loop\n * Fix that unbound-control auth_zone_reload stops answering from\n the zone after a read failure\n * Fix stats pipe draining after a malloc failure so internal\n messaging stays correct, and the server no longer exits on\n stats pipe communication failure\n * Fix that fast_reload does not terminate the server if random\n init for DNS cookies fails\n * Fix thread setname for dnstap and fast_reload thread start\n * Add libunbound/remote.h, a shared header with prototypes for\n remote control connections\n * Fix DEREF_AFTER_NULL on worker_init when stat_timer allocation\n fails with an out of memory error\n * Fix DoH POST requests missing content-length causing :status\n 400 from strict resolvers like Cloudflare and Mullvad\n * Fix randomness generation on macOS/iOS under chroot\n * Fix ipsecmod deref on null in ipsecmod-whitelist after OOM, and\n possible deref on null after reply_find_answer_rrset()\n * Fix that DoQ responses were never padded; pad-responses now\n applies to comm_doq per RFC 9250 section 5.4\n * Fix log printout error in the fix for CVE-2026-50248 when the\n primary name is bogus\n * Fix NSEC3 proofs to check the b32 name matches the signer name;\n RRSIGs are no longer valid when this does not match\n * Fix aggressive negative cache to not insert NSEC records with\n an overreaching next owner name outside the trust anchor's\n bailiwick\n * Fix mesh cycle detection for respip CNAME loop with tagged\n clients\n * Fix unbound-anchor to check the return value of\n X509_NAME_get_text_by_NID for the emailaddress\n * Fix locking of the shared_ports structure during\n initialisation, and of the anchor structure when a file is set\n during header parsing\n * Fix memory leak in xfer_set_masters() error path in authzone\n * Fix to use tls-port after a referral when tls-upstream is set\n * Fix pthread detection on Solaris 11.4\n * Fix to call OPENSSL_cleanup on exit when it is defined\n * pythonmod: check the return value after ftell()\n","status":"published","published":"2026-10-09T11:52:52Z","modified":"2026-10-15T17:23:11.709343277Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24226-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\n- CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' (bsc#1280403).\n- CVE-2026-77955: Possible ZONEMD verification bypass window (bsc#1280404).\n- CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission (bsc#1280405).\n- CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection (bsc#1280406).\n- CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization (bsc#1280409).\n- CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (bsc#1280411).\n- CVE-2026-82717: CNAME synthesis could lead to heap corruption (bsc#1280412).\n- CVE-2026-82720: Use-after-free in DoH stream cleanup code path (bsc#1280413).\n- CVE-2026-85501: Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC (bsc#1280414).\n\nChanges for unbound:\n\n- Update to 1.26.1:\n * Update icannbundle.pem certificates in unbound-anchor, valid\n for 2009-2029 and 2025-2045\n * Add max-transfer-size and max-transfer-time options to limit\n auth-zone and rpz transfer size and time, default disabled\n * Overload local_data_remove in unbound-control to also remove\n specific records\n * Add local-zone types block_aaaa, block_a_wdata and\n block_aaaa_wdata; fix respip+dns64 to use original A records\n instead of ones already modified by respip\n * ipsecmod hook script now needs to start with '#!/bin/sh', it\n is executed with execv instead of system for security\n * Server now continues to start if a secondary zone fails to\n load from its zonefile, or if a primary zonefile is missing;\n $INCLUDE is no longer allowed in secondary zone zonefiles\n * Auth-zone and RPZ zones now drop out-of-zone content on load\n * Primary hostname for zone transfers can now use CNAME(s)\n * Fix windows 64bit build for libssp dependency\n * Update IANA portlist\n * Fix heap out-of-bounds write via size_t-to-int truncation in\n setup_if()/outside_network_create() for large num_ports values\n * Fix to clean up log ids after a failure to start a worker\n thread\n * Relax assertions after the TTL 0 handling change in cachedb\n and packet_rrset_copy_region\n * Fix val_find_DS to check the result of packet_rrset_copy_region\n before using it\n * Fix that dns64 answers check the AAAA query is DNSSEC\n validated, improving RFC6147 conformance\n * Fix allocation-failure hardening of rrset cache wildcard\n storage and canonical NSEC owner replacement\n * Fix DNSSEC validation and DNSKEY size calculation for\n noncanonical RSA DNSKEYs with leading zeroes\n * Fix mixed class referrals to use the query class\n * Fix serve-expired responses from cachedb to not store bogus\n data\n * Fix lame server detection for selfpointed glue records\n * Fix cleanup of DoH sessions when the same query is on multiple\n streams\n * Fix for signed same-owner CNAME and ordinary RRset responses\n * Fix mesh new client/callback to roll back added address, tcp\n mesh state and callback on initialization failure\n * Fix autotrust state-file line overflow that could give a\n hold-down bypass\n * Fix to limit the DSNS per-label walk in the iterator\n * Fix that the ratelimit is decremented on successful referrals\n * Fix msgencode insert_query assertion for a local_alias\n * Fix to reset the tcp-timeout before applying a load based\n reduction\n * Fix to correctly decrement per-netblock tcp connection limits\n * Fix, in depth, for respip rewrite of dns64 responses\n * Fix that dns64 with subnetcache does not write ECS scoped\n answers to the global cache\n * Fix ipset module name-too-long checks and race conditions on\n the local name buffer and socket close\n * Fix validator to cap the number of ANY RRsets it validates and\n shorten the wait timer\n * Fix race condition causing segfault when starting threads\n * Fix header_seen detection for trust anchor files to detect the\n id line\n * Fix heap use-after-free in class response processing when at\n least two distinct classes are configured\n * Fix negative cache to work with NSEC3 records without salt\n * Fix parse of svcbparam ech, it had an incorrect length\n * Fix that quotation and escaping works the same in auth-zone\n url content as in zonefile reads\n * Fix ipset module to use larger domain name buffers and check\n buffer lengths\n * Fix PROXYv2 header read and consume to check the header size\n * Fix negative cache NSEC3 nodata proof to use the correct\n message size\n * Fix fast_reload for when a ZONEMD lookup is in progress\n * Fix that validation canonicalization of domain names in rdata\n checks buffer bounds\n * Fix dump_cache to use a larger record buffer and check that an\n owner name does not collide with BADRR\n * Fix that dns64 cleans up the allocated message if the adjust\n routines fail, and checks for malformed A/AAAA in auth-zones\n * Fix pythonmod script read for numeric overflow\n * Fix configure to detect the correct QUIC early-data function\n and to check for the ngtcp2_crypto_ossl header\n * Fix compile with OpenSSL 4.0.1, and with OpenSSL 1.0.2 and\n earlier in server cleanup\n * Fix that auth-zone/rpz allow-notify addresses and netblocks\n are available from start, and fix the probe step skip\n * Fix to perform a full transfer periodically to stop increasing\n memory usage for rpz zones\n * Fix assertion failure for a long HTTP header that fills the\n buffer, and buffer overflow with lower than default size and\n http transfer\n * Fix that misconfigured iter-scrub-ns: 0 causes request failures\n * Fix fast_reload handling of in-progress ZONEMD lookups and of\n removing an auth zone while its lookups are in progress\n * Fix integer overflow in infra-cache-max-rtt calculation and for\n very high values of sock-queue-timeout\n * Fix erroneous DNS error report values after a bogus AAAA query\n * Fix fast_reload to not terminate the server on config errors\n for key files\n * Fix log of an aliased qname to not use freed region memory\n * Fix DNAME synthesis from cache to keep using 0TTL entries\n within a sliding window without surpassing RRSIG expiry\n * Fix that dns64 bypasses the rpz-passthru rule during synthesis\n * Fix to disallow $INCLUDE for secondary zones; failed loads now\n clear the zone data so there is no partial zone\n * Fix zone read to allow SVCB records in unknown format that\n cannot be written out\n * Fix that a half-written trust anchor file does not crash the\n server at runtime\n * Fix that auth-zone and RPZ zones drop out-of-zone records\n * Fix that dns64 honors the forward-no-cache and stub-no-cache\n options\n * Fix that a signed wildcard NSEC is checked before use, so it\n does not allow insecure DS proofs inappropriately\n * Fix several crashes after malloc failure: half-built\n local_alias, RPZ list, delegation point cleanup,\n dns64_inform_super, new_local_rrset for RPZ qname trigger, doq\n connection setup, ngtcp2_conn_server_new, TCP accept handling,\n rpz_strip_nsdname, edns subnet addrtree insert, and rpz\n response create\n * Fix that a zonefile-only zone continues server startup with a\n warning if the file is missing on start\n * Fix that dnscrypt configuration does not crash on a\n secret/public key mismatch, and duplicate files are skipped\n * Fix locking in libunbound ub_ctx_set_event\n * Fix that libunbound pipe functions fail with an error after an\n event base is set\n * Fix incorrect cleanup after an allocation failure for a\n delegation point\n * Fix that the server does not crash if shared memory cannot be\n created for shm-enable\n * Fix auth primary host name lookup to allow CNAMEs\n * Fix memory leak on DNAME 0TTL records\n * Fix that fast_reload disown of the auth zone transfer task\n cleans up the chunk list\n * Fix unbound-checkconf to check for auth-zone download filename\n collisions\n * Fix malloc failure in auth-zone insert rr to avoid an empty\n node and infinite loop\n * Fix that unbound-control auth_zone_reload stops answering from\n the zone after a read failure\n * Fix stats pipe draining after a malloc failure so internal\n messaging stays correct, and the server no longer exits on\n stats pipe communication failure\n * Fix that fast_reload does not terminate the server if random\n init for DNS cookies fails\n * Fix thread setname for dnstap and fast_reload thread start\n * Add libunbound/remote.h, a shared header with prototypes for\n remote control connections\n * Fix DEREF_AFTER_NULL on worker_init when stat_timer allocation\n fails with an out of memory error\n * Fix DoH POST requests missing content-length causing :status\n 400 from strict resolvers like Cloudflare and Mullvad\n * Fix randomness generation on macOS/iOS under chroot\n * Fix ipsecmod deref on null in ipsecmod-whitelist after OOM, and\n possible deref on null after reply_find_answer_rrset()\n * Fix that DoQ responses were never padded; pad-responses now\n applies to comm_doq per RFC 9250 section 5.4\n * Fix log printout error in the fix for CVE-2026-50248 when the\n primary name is bogus\n * Fix NSEC3 proofs to check the b32 name matches the signer name;\n RRSIGs are no longer valid when this does not match\n * Fix aggressive negative cache to not insert NSEC records with\n an overreaching next owner name outside the trust anchor's\n bailiwick\n * Fix mesh cycle detection for respip CNAME loop with tagged\n clients\n * Fix unbound-anchor to check the return value of\n X509_NAME_get_text_by_NID for the emailaddress\n * Fix locking of the shared_ports structure during\n initialisation, and of the anchor structure when a file is set\n during header parsing\n * Fix memory leak in xfer_set_masters() error path in authzone\n * Fix to use tls-port after a referral when tls-upstream is set\n * Fix pthread detection on Solaris 11.4\n * Fix to call OPENSSL_cleanup on exit when it is defined\n * pythonmod: check the return value after ftell()\n","status":"published","published":"2026-10-09T15:11:19Z","modified":"2026-10-21T17:23:11.050283658Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24376-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\n- CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' (bsc#1280403).\n- CVE-2026-77955: Possible ZONEMD verification bypass window (bsc#1280404).\n- CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission (bsc#1280405).\n- CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection (bsc#1280406).\n- CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization (bsc#1280409).\n- CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (bsc#1280411).\n- CVE-2026-82717: CNAME synthesis could lead to heap corruption (bsc#1280412).\n- CVE-2026-82720: Use-after-free in DoH stream cleanup code path (bsc#1280413).\n- CVE-2026-85501: Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC (bsc#1280414).\n\nChanges for unbound:\n\n- Update to 1.26.1:\n * Update icannbundle.pem certificates in unbound-anchor, valid\n for 2009-2029 and 2025-2045\n * Add max-transfer-size and max-transfer-time options to limit\n auth-zone and rpz transfer size and time, default disabled\n * Overload local_data_remove in unbound-control to also remove\n specific records\n * Add local-zone types block_aaaa, block_a_wdata and\n block_aaaa_wdata; fix respip+dns64 to use original A records\n instead of ones already modified by respip\n * ipsecmod hook script now needs to start with '#!/bin/sh', it\n is executed with execv instead of system for security\n * Server now continues to start if a secondary zone fails to\n load from its zonefile, or if a primary zonefile is missing;\n $INCLUDE is no longer allowed in secondary zone zonefiles\n * Auth-zone and RPZ zones now drop out-of-zone content on load\n * Primary hostname for zone transfers can now use CNAME(s)\n * Fix windows 64bit build for libssp dependency\n * Update IANA portlist\n * Fix heap out-of-bounds write via size_t-to-int truncation in\n setup_if()/outside_network_create() for large num_ports values\n * Fix to clean up log ids after a failure to start a worker\n thread\n * Relax assertions after the TTL 0 handling change in cachedb\n and packet_rrset_copy_region\n * Fix val_find_DS to check the result of packet_rrset_copy_region\n before using it\n * Fix that dns64 answers check the AAAA query is DNSSEC\n validated, improving RFC6147 conformance\n * Fix allocation-failure hardening of rrset cache wildcard\n storage and canonical NSEC owner replacement\n * Fix DNSSEC validation and DNSKEY size calculation for\n noncanonical RSA DNSKEYs with leading zeroes\n * Fix mixed class referrals to use the query class\n * Fix serve-expired responses from cachedb to not store bogus\n data\n * Fix lame server detection for selfpointed glue records\n * Fix cleanup of DoH sessions when the same query is on multiple\n streams\n * Fix for signed same-owner CNAME and ordinary RRset responses\n * Fix mesh new client/callback to roll back added address, tcp\n mesh state and callback on initialization failure\n * Fix autotrust state-file line overflow that could give a\n hold-down bypass\n * Fix to limit the DSNS per-label walk in the iterator\n * Fix that the ratelimit is decremented on successful referrals\n * Fix msgencode insert_query assertion for a local_alias\n * Fix to reset the tcp-timeout before applying a load based\n reduction\n * Fix to correctly decrement per-netblock tcp connection limits\n * Fix, in depth, for respip rewrite of dns64 responses\n * Fix that dns64 with subnetcache does not write ECS scoped\n answers to the global cache\n * Fix ipset module name-too-long checks and race conditions on\n the local name buffer and socket close\n * Fix validator to cap the number of ANY RRsets it validates and\n shorten the wait timer\n * Fix race condition causing segfault when starting threads\n * Fix header_seen detection for trust anchor files to detect the\n id line\n * Fix heap use-after-free in class response processing when at\n least two distinct classes are configured\n * Fix negative cache to work with NSEC3 records without salt\n * Fix parse of svcbparam ech, it had an incorrect length\n * Fix that quotation and escaping works the same in auth-zone\n url content as in zonefile reads\n * Fix ipset module to use larger domain name buffers and check\n buffer lengths\n * Fix PROXYv2 header read and consume to check the header size\n * Fix negative cache NSEC3 nodata proof to use the correct\n message size\n * Fix fast_reload for when a ZONEMD lookup is in progress\n * Fix that validation canonicalization of domain names in rdata\n checks buffer bounds\n * Fix dump_cache to use a larger record buffer and check that an\n owner name does not collide with BADRR\n * Fix that dns64 cleans up the allocated message if the adjust\n routines fail, and checks for malformed A/AAAA in auth-zones\n * Fix pythonmod script read for numeric overflow\n * Fix configure to detect the correct QUIC early-data function\n and to check for the ngtcp2_crypto_ossl header\n * Fix compile with OpenSSL 4.0.1, and with OpenSSL 1.0.2 and\n earlier in server cleanup\n * Fix that auth-zone/rpz allow-notify addresses and netblocks\n are available from start, and fix the probe step skip\n * Fix to perform a full transfer periodically to stop increasing\n memory usage for rpz zones\n * Fix assertion failure for a long HTTP header that fills the\n buffer, and buffer overflow with lower than default size and\n http transfer\n * Fix that misconfigured iter-scrub-ns: 0 causes request failures\n * Fix fast_reload handling of in-progress ZONEMD lookups and of\n removing an auth zone while its lookups are in progress\n * Fix integer overflow in infra-cache-max-rtt calculation and for\n very high values of sock-queue-timeout\n * Fix erroneous DNS error report values after a bogus AAAA query\n * Fix fast_reload to not terminate the server on config errors\n for key files\n * Fix log of an aliased qname to not use freed region memory\n * Fix DNAME synthesis from cache to keep using 0TTL entries\n within a sliding window without surpassing RRSIG expiry\n * Fix that dns64 bypasses the rpz-passthru rule during synthesis\n * Fix to disallow $INCLUDE for secondary zones; failed loads now\n clear the zone data so there is no partial zone\n * Fix zone read to allow SVCB records in unknown format that\n cannot be written out\n * Fix that a half-written trust anchor file does not crash the\n server at runtime\n * Fix that auth-zone and RPZ zones drop out-of-zone records\n * Fix that dns64 honors the forward-no-cache and stub-no-cache\n options\n * Fix that a signed wildcard NSEC is checked before use, so it\n does not allow insecure DS proofs inappropriately\n * Fix several crashes after malloc failure: half-built\n local_alias, RPZ list, delegation point cleanup,\n dns64_inform_super, new_local_rrset for RPZ qname trigger, doq\n connection setup, ngtcp2_conn_server_new, TCP accept handling,\n rpz_strip_nsdname, edns subnet addrtree insert, and rpz\n response create\n * Fix that a zonefile-only zone continues server startup with a\n warning if the file is missing on start\n * Fix that dnscrypt configuration does not crash on a\n secret/public key mismatch, and duplicate files are skipped\n * Fix locking in libunbound ub_ctx_set_event\n * Fix that libunbound pipe functions fail with an error after an\n event base is set\n * Fix incorrect cleanup after an allocation failure for a\n delegation point\n * Fix that the server does not crash if shared memory cannot be\n created for shm-enable\n * Fix auth primary host name lookup to allow CNAMEs\n * Fix memory leak on DNAME 0TTL records\n * Fix that fast_reload disown of the auth zone transfer task\n cleans up the chunk list\n * Fix unbound-checkconf to check for auth-zone download filename\n collisions\n * Fix malloc failure in auth-zone insert rr to avoid an empty\n node and infinite loop\n * Fix that unbound-control auth_zone_reload stops answering from\n the zone after a read failure\n * Fix stats pipe draining after a malloc failure so internal\n messaging stays correct, and the server no longer exits on\n stats pipe communication failure\n * Fix that fast_reload does not terminate the server if random\n init for DNS cookies fails\n * Fix thread setname for dnstap and fast_reload thread start\n * Add libunbound/remote.h, a shared header with prototypes for\n remote control connections\n * Fix DEREF_AFTER_NULL on worker_init when stat_timer allocation\n fails with an out of memory error\n * Fix DoH POST requests missing content-length causing :status\n 400 from strict resolvers like Cloudflare and Mullvad\n * Fix randomness generation on macOS/iOS under chroot\n * Fix ipsecmod deref on null in ipsecmod-whitelist after OOM, and\n possible deref on null after reply_find_answer_rrset()\n * Fix that DoQ responses were never padded; pad-responses now\n applies to comm_doq per RFC 9250 section 5.4\n * Fix log printout error in the fix for CVE-2026-50248 when the\n primary name is bogus\n * Fix NSEC3 proofs to check the b32 name matches the signer name;\n RRSIGs are no longer valid when this does not match\n * Fix aggressive negative cache to not insert NSEC records with\n an overreaching next owner name outside the trust anchor's\n bailiwick\n * Fix mesh cycle detection for respip CNAME loop with tagged\n clients\n * Fix unbound-anchor to check the return value of\n X509_NAME_get_text_by_NID for the emailaddress\n * Fix locking of the shared_ports structure during\n initialisation, and of the anchor structure when a file is set\n during header parsing\n * Fix memory leak in xfer_set_masters() error path in authzone\n * Fix to use tls-port after a referral when tls-upstream is set\n * Fix pthread detection on Solaris 11.4\n * Fix to call OPENSSL_cleanup on exit when it is defined\n * pythonmod: check the return value after ftell()\n","status":"published","published":"2026-10-20T08:21:41Z","modified":"2026-10-27T17:23:17.402819815Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:4620-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\n- CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' (bsc#1280403).\n- CVE-2026-77955: Possible ZONEMD verification bypass window (bsc#1280404).\n- CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission (bsc#1280405).\n- CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection (bsc#1280406).\n- CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization (bsc#1280409).\n- CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (bsc#1280411).\n- CVE-2026-82717: CNAME synthesis could lead to heap corruption (bsc#1280412).\n- CVE-2026-82720: Use-after-free in DoH stream cleanup code path (bsc#1280413).\n- CVE-2026-85501: Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC (bsc#1280414).\n\nChanges for libunbound-devel-mini:\n\n- Updated to version 1.26.1\n\nChanges for unbound:\n\n- Updated to version 1.26.1\n","status":"published","published":"2026-10-12T07:23:36Z","modified":"2026-10-13T10:30:05.848682848Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4624-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\n- CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' (bsc#1280403).\n- CVE-2026-77955: Possible ZONEMD verification bypass window (bsc#1280404).\n- CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission (bsc#1280405).\n- CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection (bsc#1280406).\n- CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization (bsc#1280409).\n- CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (bsc#1280411).\n- CVE-2026-82717: CNAME synthesis could lead to heap corruption (bsc#1280412).\n- CVE-2026-82720: Use-after-free in DoH stream cleanup code path (bsc#1280413).\n- CVE-2026-85501: Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC (bsc#1280414).\n\nChanges for libunbound-devel-mini:\n\n- Updated to version 1.26.1\n\nChanges for unbound:\n\n- Updated to version 1.26.1\n","status":"published","published":"2026-10-12T07:29:19Z","modified":"2026-10-13T10:30:05.856272931Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"USN-8873-1","title":"unbound vulnerabilities","description":"Yuqi Qiu and Xiang Li discovered that Unbound did not correctly handle\ncertain memory operations. An attacker could possibly use this issue to\ncause a denial of service or execute arbitrary code. (CVE-2026-81642)\n\nBen Morris discovered that Unbound did not correctly handle certain\nmemory operations. An attacker could possibly use this issue to cause a\ndenial of service or execute arbitary code. (CVE-2026-82717)","status":"published","published":"2026-10-06T04:41:00Z","modified":"2026-10-06T10:57:51.434711255Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}