{"id":"CVE-2026-85501","aliases":["AZL-101706","CLSA-2026-1790962865","CLSA-2026-1791261872","CLSA-2026-1791278576","CLSA-2026-1791327169","DEBIAN-CVE-2026-85501","EUVD-2026-80294","GHSA-qwgf-hj58-8c2w","MGASA-2026-0451","OESA-2026-4276","OESA-2026-4277","OESA-2026-4278","OESA-2026-4279","RHSA-2026:68590","SUSE-SU-2026:24128-1","SUSE-SU-2026:24135-1","SUSE-SU-2026:24226-1","SUSE-SU-2026:24376-1","SUSE-SU-2026:4620-1","SUSE-SU-2026:4624-1","UBUNTU-CVE-2026-85501","USN-8946-1","openSUSE-SU-2026:11930-1","openSUSE-SU-2026:22082-1"],"status":"published","title":"Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC","description":"Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where  the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested domains, this results in significant computational overhead. NsecTrap, where  responses with excessive invalid NSEC records compel the resolver to validate each one. AdditionalTrap, where Unbound by default would try to DNSSEC validate the ADDITIONAL section as well. This can be exploited to waste validation resources by malicious users.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00482,"percentile":0.41843,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2026-09-16T08:32:25Z","modified":"2026-10-27T17:27:18Z","fixes":[{"ecosystem":"Azure Linux:3","package":"unbound","fixed_in":["1.26.1-1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-unbound","fixed_in":["1.16.2-19.el9_6.1.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"unbound","fixed_in":["1.16.2-19.el9_6.1.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"unbound-devel","fixed_in":["1.16.2-19.el9_6.1.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"unbound-dracut","fixed_in":["1.16.2-19.el9_6.1.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"unbound-libs","fixed_in":["1.16.2-19.el9_6.1.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"unbound","fixed_in":["1.26.1-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"unbound","fixed_in":["1.26.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"unbound","fixed_in":["1.4.22-1ubuntu4.14.04.3+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"unbound","fixed_in":["1.5.8-1ubuntu1.1+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"unbound","fixed_in":["1.6.7-1ubuntu2.6+esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"unbound","fixed_in":["1.9.4-2ubuntu1.11+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"unbound","fixed_in":["1.13.1-1ubuntu5.17"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"unbound","fixed_in":["1.19.2-1ubuntu3.12"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"unbound","fixed_in":["1.24.2-1ubuntu2.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-3.el9_2.tuxcare.els17"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-3.el9_2.tuxcare.els17"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-3.el9_2.tuxcare.els17"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-3.el9_2.tuxcare.els17"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-5.el8.tuxcare.els12"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-5.el8.tuxcare.els12"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-5.el8.tuxcare.els12"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-5.el8.tuxcare.els12"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-19.el9_6.1.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-19.el9_6.1.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-19.el9_6.1.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"unbound-dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-19.el9_6.1.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-19.el9_6.1.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-5.0.1.el7_8.tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-5.0.1.el7_8.tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-5.0.1.el7_8.tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"unbound-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-5.0.1.el7_8.tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17.1-2","1.17.1-2+deb12u1","1.17.1-2+deb12u2","1.17.1-2+deb12u3","1.17.1-2+deb12u4","1.17.1-2+loong64","1.18.0-1","1.18.0-2","1.19.1-1","1.19.2-1","1.20.0-1","1.21.1-1","1.22.0-1","1.22.0-2","1.23.1-1","1.24.0-1","1.24.0-2","1.24.1-1","1.24.1-2","1.24.2-1","1.25.0-1","1.25.1-1","1.25.2-1","1.26.0-1","1.26.0-2","1.26.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-0+deb13u1"}]}],"versions":["1.22.0-2","1.22.0-2+deb13u1","1.22.0-2+deb13u2","1.22.0-2+deb13u3","1.23.1-1","1.24.0-1","1.24.0-2","1.24.1-1","1.24.1-2","1.24.2-1","1.25.0-1","1.25.1-1","1.25.2-1","1.26.0-1","1.26.0-2"]},{"source":"osv","ecosystem":"Debian:14","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-1"}]}],"versions":["1.22.0-2","1.23.1-1","1.24.0-1","1.24.0-2","1.24.1-1","1.24.1-2","1.24.2-1","1.25.0-1","1.25.1-1","1.25.2-1","1.26.0-1","1.26.0-2"]},{"source":"osv","ecosystem":"Mageia:10","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-1.mga10"}]}],"bundled":34},{"source":"osv","ecosystem":"Mageia:9","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-1.mga9"}]}],"bundled":34},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-29.oe2203sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-23.oe2403sp1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-23.oe2403sp3"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-23.oe2403sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.1-1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.1-1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-anchor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.1-1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.1-1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.1-1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.1-1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-munin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.1-1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"unbound-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.1-1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-159998.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-slfo.1.1_1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150600.23.24.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150600.23.24.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150600.23.24.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150600.23.24.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150100.10.31.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150100.10.31.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150100.10.31.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150100.10.31.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150100.10.31.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150100.10.31.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150100.10.31.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150100.10.31.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-150100.10.31.1"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.22-1ubuntu4.14.04.3+esm5"}]}],"versions":["1.4.20-1","1.4.21-1","1.4.21-1ubuntu1","1.4.21-1ubuntu2","1.4.22-1ubuntu1","1.4.22-1ubuntu2","1.4.22-1ubuntu3","1.4.22-1ubuntu4","1.4.22-1ubuntu4.14.04.1","1.4.22-1ubuntu4.14.04.2","1.4.22-1ubuntu4.14.04.3","1.4.22-1ubuntu4.14.04.3+esm1","1.4.22-1ubuntu4.14.04.3+esm2","1.4.22-1ubuntu4.14.04.3+esm3","1.4.22-1ubuntu4.14.04.3+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.8-1ubuntu1.1+esm5"}]}],"versions":["1.4.22-1ubuntu6","1.5.7-1ubuntu1","1.5.7-1ubuntu2","1.5.8-1ubuntu1","1.5.8-1ubuntu1.1","1.5.8-1ubuntu1.1+esm1","1.5.8-1ubuntu1.1+esm2","1.5.8-1ubuntu1.1+esm3","1.5.8-1ubuntu1.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.7-1ubuntu2.6+esm6"}]}],"versions":["1.6.5-1","1.6.7-1","1.6.7-1build1","1.6.7-1ubuntu1","1.6.7-1ubuntu2","1.6.7-1ubuntu2.1","1.6.7-1ubuntu2.2","1.6.7-1ubuntu2.3","1.6.7-1ubuntu2.4","1.6.7-1ubuntu2.5","1.6.7-1ubuntu2.6","1.6.7-1ubuntu2.6+esm2","1.6.7-1ubuntu2.6+esm3","1.6.7-1ubuntu2.6+esm4","1.6.7-1ubuntu2.6+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-2ubuntu1.11+esm3"}]}],"versions":["1.9.0-2ubuntu1","1.9.0-2ubuntu2","1.9.4-2","1.9.4-2ubuntu1","1.9.4-2ubuntu1.1","1.9.4-2ubuntu1.2","1.9.4-2ubuntu1.3","1.9.4-2ubuntu1.4","1.9.4-2ubuntu1.5","1.9.4-2ubuntu1.6","1.9.4-2ubuntu1.8","1.9.4-2ubuntu1.9","1.9.4-2ubuntu1.11","1.9.4-2ubuntu1.11+esm1","1.9.4-2ubuntu1.11+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-1ubuntu5.17"}]}],"versions":["1.13.1-1ubuntu1","1.13.1-1ubuntu3","1.13.1-1ubuntu5","1.13.1-1ubuntu5.1","1.13.1-1ubuntu5.2","1.13.1-1ubuntu5.3","1.13.1-1ubuntu5.4","1.13.1-1ubuntu5.5","1.13.1-1ubuntu5.7","1.13.1-1ubuntu5.8","1.13.1-1ubuntu5.10","1.13.1-1ubuntu5.11","1.13.1-1ubuntu5.12","1.13.1-1ubuntu5.13","1.13.1-1ubuntu5.14","1.13.1-1ubuntu5.15","1.13.1-1ubuntu5.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-1ubuntu3.12"}]}],"versions":["1.17.1-2","1.18.0-2ubuntu1","1.18.0-2ubuntu2","1.19.1-1ubuntu1","1.19.2-1ubuntu1","1.19.2-1ubuntu3","1.19.2-1ubuntu3.1","1.19.2-1ubuntu3.2","1.19.2-1ubuntu3.3","1.19.2-1ubuntu3.4","1.19.2-1ubuntu3.5","1.19.2-1ubuntu3.6","1.19.2-1ubuntu3.7","1.19.2-1ubuntu3.8","1.19.2-1ubuntu3.9","1.19.2-1ubuntu3.10"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.2-1ubuntu2","1.25.1-1ubuntu1","1.25.1-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-1ubuntu2.4"}]}],"versions":["1.22.0-2ubuntu2","1.22.0-2ubuntu4","1.24.2-1ubuntu1","1.24.2-1ubuntu2","1.24.2-1ubuntu2.1","1.24.2-1ubuntu2.2","1.24.2-1ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.22-1ubuntu4.14.04.3+esm5"}]}],"versions":["1.4.20-1","1.4.21-1","1.4.21-1ubuntu1","1.4.21-1ubuntu2","1.4.22-1ubuntu1","1.4.22-1ubuntu2","1.4.22-1ubuntu3","1.4.22-1ubuntu4","1.4.22-1ubuntu4.14.04.1","1.4.22-1ubuntu4.14.04.2","1.4.22-1ubuntu4.14.04.3","1.4.22-1ubuntu4.14.04.3+esm1","1.4.22-1ubuntu4.14.04.3+esm2","1.4.22-1ubuntu4.14.04.3+esm3","1.4.22-1ubuntu4.14.04.3+esm4"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.8-1ubuntu1.1+esm5"}]}],"versions":["1.4.22-1ubuntu6","1.5.7-1ubuntu1","1.5.7-1ubuntu2","1.5.8-1ubuntu1","1.5.8-1ubuntu1.1","1.5.8-1ubuntu1.1+esm1","1.5.8-1ubuntu1.1+esm2","1.5.8-1ubuntu1.1+esm3","1.5.8-1ubuntu1.1+esm4"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.7-1ubuntu2.6+esm6"}]}],"versions":["1.6.5-1","1.6.7-1","1.6.7-1build1","1.6.7-1ubuntu1","1.6.7-1ubuntu2","1.6.7-1ubuntu2.1","1.6.7-1ubuntu2.2","1.6.7-1ubuntu2.3","1.6.7-1ubuntu2.4","1.6.7-1ubuntu2.5","1.6.7-1ubuntu2.6","1.6.7-1ubuntu2.6+esm2","1.6.7-1ubuntu2.6+esm3","1.6.7-1ubuntu2.6+esm4","1.6.7-1ubuntu2.6+esm5"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-2ubuntu1.11+esm3"}]}],"versions":["1.9.0-2ubuntu1","1.9.0-2ubuntu2","1.9.4-2","1.9.4-2ubuntu1","1.9.4-2ubuntu1.1","1.9.4-2ubuntu1.2","1.9.4-2ubuntu1.3","1.9.4-2ubuntu1.4","1.9.4-2ubuntu1.5","1.9.4-2ubuntu1.6","1.9.4-2ubuntu1.8","1.9.4-2ubuntu1.9","1.9.4-2ubuntu1.11","1.9.4-2ubuntu1.11+esm1","1.9.4-2ubuntu1.11+esm2"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-1ubuntu5.17"}]}],"versions":["1.13.1-1ubuntu1","1.13.1-1ubuntu3","1.13.1-1ubuntu5","1.13.1-1ubuntu5.1","1.13.1-1ubuntu5.2","1.13.1-1ubuntu5.3","1.13.1-1ubuntu5.4","1.13.1-1ubuntu5.5","1.13.1-1ubuntu5.7","1.13.1-1ubuntu5.8","1.13.1-1ubuntu5.10","1.13.1-1ubuntu5.11","1.13.1-1ubuntu5.12","1.13.1-1ubuntu5.13","1.13.1-1ubuntu5.14","1.13.1-1ubuntu5.15","1.13.1-1ubuntu5.16"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-1ubuntu3.12"}]}],"versions":["1.17.1-2","1.18.0-2ubuntu1","1.18.0-2ubuntu2","1.19.1-1ubuntu1","1.19.2-1ubuntu1","1.19.2-1ubuntu3","1.19.2-1ubuntu3.1","1.19.2-1ubuntu3.2","1.19.2-1ubuntu3.3","1.19.2-1ubuntu3.4","1.19.2-1ubuntu3.5","1.19.2-1ubuntu3.6","1.19.2-1ubuntu3.7","1.19.2-1ubuntu3.8","1.19.2-1ubuntu3.9","1.19.2-1ubuntu3.10"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-1ubuntu2.4"}]}],"versions":["1.22.0-2ubuntu2","1.22.0-2ubuntu4","1.24.2-1ubuntu1","1.24.2-1ubuntu2","1.24.2-1ubuntu2.1","1.24.2-1ubuntu2.2","1.24.2-1ubuntu2.3"],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-160000.1.1"}]}],"bundled":9}],"products":[{"vendor":"nlnet labs","product":"unbound"},{"vendor":"nlnetlabs","product":"unbound"}],"references":[{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-85501.txt","tags":["vendor-advisory","Patch","Vendor Advisory","fix","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85501","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-qwgf-hj58-8c2w"},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1790962865.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56444","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77955","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82720","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1791261872.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-50387","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80225","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81634","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1791278576.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1791327169.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81642","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82717","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-85501","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0451.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36346","tags":["report"]},{"url":"https://nlnetlabs.nl/projects/unbound/security-advisories/","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4276","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77860","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4277","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4278","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4279","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68590","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-81642","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-82720","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-81634","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-80225","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-77860","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-77955","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-85501","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-82717","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-78227","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68590.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535050","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-77860","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-77860.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535053","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-77955","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-77955.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535052","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-78227","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78227","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-78227.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535055","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80225","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-80225.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535054","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81634","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81634.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535059","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81642","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81642.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535051","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-82717","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-82717.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535060","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-82720","tags":["advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-82720.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535057","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85501","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624128-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1280403","tags":["report"]},{"url":"https://bugzilla.suse.com/1280404","tags":["report"]},{"url":"https://bugzilla.suse.com/1280405","tags":["report"]},{"url":"https://bugzilla.suse.com/1280406","tags":["report"]},{"url":"https://bugzilla.suse.com/1280409","tags":["report"]},{"url":"https://bugzilla.suse.com/1280411","tags":["report"]},{"url":"https://bugzilla.suse.com/1280412","tags":["report"]},{"url":"https://bugzilla.suse.com/1280413","tags":["report"]},{"url":"https://bugzilla.suse.com/1280414","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81642","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-82717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-82720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85501","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624135-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50248","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624226-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624376-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264620-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264624-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-85501","tags":["report"]},{"url":"https://nlnetlabs.nl/downloads/unbound/CVE-2026-85501.txt","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8946-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-50387","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-50868","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-32665","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-40691","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-44690","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-50252","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55973","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80225","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-81634","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-85501","title":"Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC","description":"Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where  the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested domains, this results in significant computational overhead. NsecTrap, where  responses with excessive invalid NSEC records compel the resolver to validate each one. AdditionalTrap, where Unbound by default would try to DNSSEC validate the ADDITIONAL section as well. This can be exploited to waste validation resources by malicious users.","status":"published","published":"2026-09-16T08:32:25.398Z","modified":"2026-09-16T14:12:18.996Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:19:52.410665Z"}],"euvd":[{"id":"EUVD-2026-80294","description":"Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where  the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested domains, this results in significant computational overhead. NsecTrap, where  responses with excessive invalid NSEC records compel the resolver to validate each one. AdditionalTrap, where Unbound by default would try to DNSSEC validate the ADDITIONAL section as well. This can be exploited to waste validation resources by malicious users.","status":"published","published":"2026-09-16T08:32:25Z","modified":"2026-09-16T14:12:18Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T17:28:16.201278Z"}],"ghsa":[{"id":"GHSA-qwgf-hj58-8c2w","title":"Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched...","description":"Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where  the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested domains, this results in significant computational overhead. NsecTrap, where  responses with excessive invalid NSEC records compel the resolver to validate each one. AdditionalTrap, where Unbound by default would try to DNSSEC validate the ADDITIONAL section as well. This can be exploited to waste validation resources by malicious users.","status":"published","published":"2026-09-16T09:30:28Z","modified":"2026-09-16T09:30:35Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:11:57.71972Z"}],"nvd":[{"id":"CVE-2026-85501","description":"Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where  the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested domains, this results in significant computational overhead. NsecTrap, where  responses with excessive invalid NSEC records compel the resolver to validate each one. AdditionalTrap, where Unbound by default would try to DNSSEC validate the ADDITIONAL section as well. This can be exploited to waste validation resources by malicious users.","status":"published","published":"2026-09-16T09:17:06.783Z","modified":"2026-09-23T19:10:46.317Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:12:48.287983Z"}],"osv":[{"id":"CVE-2026-85501","description":"Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where  the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested domains, this results in significant computational overhead. NsecTrap, where  responses with excessive invalid NSEC records compel the resolver to validate each one. AdditionalTrap, where Unbound by default would try to DNSSEC validate the ADDITIONAL section as well. This can be exploited to waste validation resources by malicious users.","status":"published","published":"2026-09-16T09:17:06.783Z","modified":"2026-10-27T17:27:18.11194823Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:18.825071Z"},{"id":"DEBIAN-CVE-2026-85501","description":"Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where  the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested domains, this results in significant computational overhead. NsecTrap, where  responses with excessive invalid NSEC records compel the resolver to validate each one. AdditionalTrap, where Unbound by default would try to DNSSEC validate the ADDITIONAL section as well. This can be exploited to waste validation resources by malicious users.","status":"published","published":"2026-09-16T09:17:06.783Z","modified":"2026-09-24T09:00:15.09858103Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:05.022702Z"},{"id":"OESA-2026-4276","title":"unbound security update","description":"Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn\u0026amp;apos;t make custom builds or provide specific features to paying customers only.\r\n\r\nSecurity Fix(es):\n\nIn NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the \u0026apos;serve-expired\u0026apos; code path can cause a double decrement on the \u0026apos;wait-limit\u0026apos; counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb (CVE-2024-33655). A malicious actor can exploit this by controlling an authoritative zone with short TTL, so cached entries expire quickly. Each \u0026apos;slow\u0026apos; query, one the attacker\u0026apos;s authoritative never answers, is followed by one query for an expired cached name, which is answered immediately via the \u0026apos;serve-expired\u0026apos; path and decrements the counter twice. This second query was named \u0026apos;pump\u0026apos;. By alternating slow queries and pumps, the attacker keeps the per-client counter at or below the configured \u0026apos;wait-limit\u0026apos; indefinitely, and can hold an arbitrary number of pending queries from a single source IP, up to the global mesh quota (num-queries-per-thread); eventually bypassing one of the counter measures introduced for DNSBomb (CVE-2024-33655). This vulnerability is present on the \u0026apos;serve-expired\u0026apos; code path.(CVE-2026-77860)\n\nIn NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check failed, the tampered data are reloaded on startup and available until ZONEMD verification concludes again. If verification fails, the data is not served any more but still persists on disk for future reloads.(CVE-2026-77955)\n\nNLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with \u0026apos;--with-libnghttp2\u0026apos;. During failure code paths (i.e., RPZ drop query, jostle due to heavy traffic), a dropped DoH stream brings down the whole DoH session and does not account properly for other DoH streams in the same session. This leads to use-after-free in those code paths. If the prerequisites are satisfied (possible RPZ drop or heavy client traffic), a malicious actor can trigger the vulnerability with a single DoH connection and the appropriate traffic. Impact is limited as the reads are not user controlled and the use-after-free leads to early returns. However, a hardened allocator can catch the use-after-free and controllably terminate the process resulting to denial of service.(CVE-2026-82720)\n\nNovel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term \u0026apos;ReTrap\u0026apos;. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where  the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested domains, this results in significant computational overhead. NsecTrap, where  responses with excessive invalid NSEC records compel the resolver to validate each one. AdditionalTrap, where Unbound by default would try to DNSSEC validate the ADDITIONAL section as well. This can be exploited to waste validation resources by malicious users.(CVE-2026-85501)","status":"published","published":"2026-10-16T11:58:51Z","modified":"2026-10-16T12:15:17.570837722Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4277","title":"unbound security update","description":"Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn\u0026amp;apos;t make custom builds or provide specific features to paying customers only.\r\n\r\nSecurity Fix(es):\n\nIn NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the \u0026apos;serve-expired\u0026apos; code path can cause a double decrement on the \u0026apos;wait-limit\u0026apos; counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb (CVE-2024-33655). A malicious actor can exploit this by controlling an authoritative zone with short TTL, so cached entries expire quickly. Each \u0026apos;slow\u0026apos; query, one the attacker\u0026apos;s authoritative never answers, is followed by one query for an expired cached name, which is answered immediately via the \u0026apos;serve-expired\u0026apos; path and decrements the counter twice. This second query was named \u0026apos;pump\u0026apos;. By alternating slow queries and pumps, the attacker keeps the per-client counter at or below the configured \u0026apos;wait-limit\u0026apos; indefinitely, and can hold an arbitrary number of pending queries from a single source IP, up to the global mesh quota (num-queries-per-thread); eventually bypassing one of the counter measures introduced for DNSBomb (CVE-2024-33655). This vulnerability is present on the \u0026apos;serve-expired\u0026apos; code path.(CVE-2026-77860)\n\nIn NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check failed, the tampered data are reloaded on startup and available until ZONEMD verification concludes again. If verification fails, the data is not served any more but still persists on disk for future reloads.(CVE-2026-77955)\n\nNLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with \u0026apos;--with-libnghttp2\u0026apos;. During failure code paths (i.e., RPZ drop query, jostle due to heavy traffic), a dropped DoH stream brings down the whole DoH session and does not account properly for other DoH streams in the same session. This leads to use-after-free in those code paths. If the prerequisites are satisfied (possible RPZ drop or heavy client traffic), a malicious actor can trigger the vulnerability with a single DoH connection and the appropriate traffic. Impact is limited as the reads are not user controlled and the use-after-free leads to early returns. However, a hardened allocator can catch the use-after-free and controllably terminate the process resulting to denial of service.(CVE-2026-82720)\n\nNovel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term \u0026apos;ReTrap\u0026apos;. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where  the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested domains, this results in significant computational overhead. NsecTrap, where  responses with excessive invalid NSEC records compel the resolver to validate each one. AdditionalTrap, where Unbound by default would try to DNSSEC validate the ADDITIONAL section as well. This can be exploited to waste validation resources by malicious users.(CVE-2026-85501)","status":"published","published":"2026-10-16T11:58:52Z","modified":"2026-10-16T12:15:16.613207832Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4278","title":"unbound security update","description":"Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn\u0026amp;apos;t make custom builds or provide specific features to paying customers only.\r\n\r\nSecurity Fix(es):\n\nIn NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the \u0026apos;serve-expired\u0026apos; code path can cause a double decrement on the \u0026apos;wait-limit\u0026apos; counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb (CVE-2024-33655). A malicious actor can exploit this by controlling an authoritative zone with short TTL, so cached entries expire quickly. Each \u0026apos;slow\u0026apos; query, one the attacker\u0026apos;s authoritative never answers, is followed by one query for an expired cached name, which is answered immediately via the \u0026apos;serve-expired\u0026apos; path and decrements the counter twice. This second query was named \u0026apos;pump\u0026apos;. By alternating slow queries and pumps, the attacker keeps the per-client counter at or below the configured \u0026apos;wait-limit\u0026apos; indefinitely, and can hold an arbitrary number of pending queries from a single source IP, up to the global mesh quota (num-queries-per-thread); eventually bypassing one of the counter measures introduced for DNSBomb (CVE-2024-33655). This vulnerability is present on the \u0026apos;serve-expired\u0026apos; code path.(CVE-2026-77860)\n\nIn NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check failed, the tampered data are reloaded on startup and available until ZONEMD verification concludes again. If verification fails, the data is not served any more but still persists on disk for future reloads.(CVE-2026-77955)\n\nNLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with \u0026apos;--with-libnghttp2\u0026apos;. During failure code paths (i.e., RPZ drop query, jostle due to heavy traffic), a dropped DoH stream brings down the whole DoH session and does not account properly for other DoH streams in the same session. This leads to use-after-free in those code paths. If the prerequisites are satisfied (possible RPZ drop or heavy client traffic), a malicious actor can trigger the vulnerability with a single DoH connection and the appropriate traffic. Impact is limited as the reads are not user controlled and the use-after-free leads to early returns. However, a hardened allocator can catch the use-after-free and controllably terminate the process resulting to denial of service.(CVE-2026-82720)\n\nNovel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term \u0026apos;ReTrap\u0026apos;. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where  the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested domains, this results in significant computational overhead. NsecTrap, where  responses with excessive invalid NSEC records compel the resolver to validate each one. AdditionalTrap, where Unbound by default would try to DNSSEC validate the ADDITIONAL section as well. This can be exploited to waste validation resources by malicious users.(CVE-2026-85501)","status":"published","published":"2026-10-16T11:58:52Z","modified":"2026-10-16T12:15:16.611241396Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4279","title":"unbound security update","description":"Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn\u0026amp;apos;t make custom builds or provide specific features to paying customers only.\r\n\r\nSecurity Fix(es):\n\nIn NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the \u0026apos;serve-expired\u0026apos; code path can cause a double decrement on the \u0026apos;wait-limit\u0026apos; counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb (CVE-2024-33655). A malicious actor can exploit this by controlling an authoritative zone with short TTL, so cached entries expire quickly. Each \u0026apos;slow\u0026apos; query, one the attacker\u0026apos;s authoritative never answers, is followed by one query for an expired cached name, which is answered immediately via the \u0026apos;serve-expired\u0026apos; path and decrements the counter twice. This second query was named \u0026apos;pump\u0026apos;. By alternating slow queries and pumps, the attacker keeps the per-client counter at or below the configured \u0026apos;wait-limit\u0026apos; indefinitely, and can hold an arbitrary number of pending queries from a single source IP, up to the global mesh quota (num-queries-per-thread); eventually bypassing one of the counter measures introduced for DNSBomb (CVE-2024-33655). This vulnerability is present on the \u0026apos;serve-expired\u0026apos; code path.(CVE-2026-77860)\n\nIn NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check failed, the tampered data are reloaded on startup and available until ZONEMD verification concludes again. If verification fails, the data is not served any more but still persists on disk for future reloads.(CVE-2026-77955)\n\nNLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with \u0026apos;--with-libnghttp2\u0026apos;. During failure code paths (i.e., RPZ drop query, jostle due to heavy traffic), a dropped DoH stream brings down the whole DoH session and does not account properly for other DoH streams in the same session. This leads to use-after-free in those code paths. If the prerequisites are satisfied (possible RPZ drop or heavy client traffic), a malicious actor can trigger the vulnerability with a single DoH connection and the appropriate traffic. Impact is limited as the reads are not user controlled and the use-after-free leads to early returns. However, a hardened allocator can catch the use-after-free and controllably terminate the process resulting to denial of service.(CVE-2026-82720)\n\nNovel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term \u0026apos;ReTrap\u0026apos;. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where  the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested domains, this results in significant computational overhead. NsecTrap, where  responses with excessive invalid NSEC records compel the resolver to validate each one. AdditionalTrap, where Unbound by default would try to DNSSEC validate the ADDITIONAL section as well. This can be exploited to waste validation resources by malicious users.(CVE-2026-85501)","status":"published","published":"2026-10-16T11:58:53Z","modified":"2026-10-16T12:15:16.613303958Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"RHSA-2026:68590","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-22T10:19:16Z","modified":"2026-10-17T10:18:35Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"UBUNTU-CVE-2026-85501","description":"Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where  the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested domains, this results in significant computational overhead. NsecTrap, where  responses with excessive invalid NSEC records compel the resolver to validate each one. AdditionalTrap, where Unbound by default would try to DNSSEC validate the ADDITIONAL section as well. This can be exploited to waste validation resources by malicious users.","status":"published","published":"2026-09-16T09:17:00Z","modified":"2026-10-21T23:02:26.287970492Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"AZL-101706","title":"CVE-2026-85501 affecting package unbound for versions less than 1.26.1-1","description":"Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where  the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested domains, this results in significant computational overhead. NsecTrap, where  responses with excessive invalid NSEC records compel the resolver to validate each one. AdditionalTrap, where Unbound by default would try to DNSSEC validate the ADDITIONAL section as well. This can be exploited to waste validation resources by malicious users.","status":"published","published":"2026-09-16T09:17:06Z","modified":"2026-09-23T14:15:56.116066864Z","updated_at":"2026-11-02T15:28:00.508704Z"},{"id":"CLSA-2026-1790962865","title":"unbound: Fix of 4 CVEs","description":"- CVE-2026-82720: pop each reply off the mesh reply list before it is\n  dropped or answered, detach the tcp_req_info and DoH stream references\n  and clear the h2 stream mesh states when a DoH session is dropped, so\n  an RPZ drop or jostled query can no longer leave a dangling DoH stream\n  reference that is used after free\n- CVE-2026-77955: do not serve or write to disk a zonemd-check zone\n  while its ZONEMD verification is still pending; the zonefile write is\n  deferred to the ZONEMD callback and done only if the zone verified\n- CVE-2026-85501: bound the DNSSEC work per validation (ReTrap): add the\n  val-validation-attempts and val-hash-attempts limits (default 32),\n  limit DNSKEY/RRSIG and DS key-tag matches and NSEC/NSEC3 records\n  checked, shorten oversized referral DS RRsets, stop validator restarts\n  once the limits are hit, and require only the answer and authority\n  sections to be secure; the built-in val-clean-additional default is\n  now no, the shipped unbound.conf keeps val-clean-additional: yes","status":"published","published":"2026-10-20T13:04:17Z","modified":"2026-10-26T09:43:45.172836478Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791261872","title":"unbound: Fix of 4 CVEs","description":"- CVE-2026-81634: bounds-check the scratch buffer in rrset_canonical() and\n  rrset_canonicalize_to_buffer() before writing the RRSIG rdata, the first\n  canonical owner name and each RR's rdata, so a large rrset can no longer\n  be written past the end of the buffer\n- CVE-2026-80225: cap the number of pipelined TCP/DoT queries drained per\n  event-loop visit in tcp_req_info_read_again() and tcp_more_read_again()\n  and defer the remainder via a zero-delay timer, so one connection can no\n  longer starve the other file descriptors\n- CVE-2026-85501: bound the DNSSEC validation work per query (ReTrap): add\n  the val-validation-attempts and val-hash-attempts limits (default 32),\n  limit DNSKEY/RRSIG and DS key-tag matches and the NSEC/NSEC3 records\n  checked per message, shorten oversized referral DS RRsets, stop validator\n  restarts once the limits are hit, and require only the answer and\n  authority sections to be secure; the built-in val-clean-additional\n  default is now no, the shipped unbound.conf keeps val-clean-additional: yes","status":"published","published":"2026-10-19T14:45:10Z","modified":"2026-10-26T09:43:32.552617974Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791278576","title":"unbound: Fix of CVE-2026-85501","description":"- CVE-2026-85501: bound the DNSSEC validation work per query (ReTrap): add\n  the val-validation-attempts and val-hash-attempts limits (default 32),\n  limit DNSKEY/RRSIG and DS key-tag matches and the NSEC/NSEC3 records\n  checked per message, shorten oversized referral DS RRsets, stop validator\n  restarts once the limits are hit, and require only the answer and\n  authority sections to be secure; the built-in val-clean-additional\n  default is now no, the shipped unbound.conf keeps val-clean-additional: yes","status":"published","published":"2026-10-06T09:23:07Z","modified":"2026-10-26T09:31:36.715710408Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791327169","title":"unbound: Fix of 4 CVEs","description":"- CVE-2026-81642: fix heap buffer overflow when digesting DNSKEY\n- CVE-2026-81634: add the missing first owner name and signature length\n  bounds checks to rrset_canonical(), preventing a heap buffer overflow\n  during RRset canonicalisation\n- CVE-2026-82717: restore the packet buffer position on malformed names\n  in pkt_dname_len() and bound the copy lengths in rdata_copy(),\n  preventing heap corruption on the CNAME synthesis error path\n- CVE-2026-85501: bound DNSSEC validation work per query: key-tag\n  matches capped at 256, NSEC/NSEC3 verifications at 8 per message, new\n  val-validation-attempts and val-hash-attempts options (default 32),\n  oversized referral DS RRsets shortened to 20, and val-clean-additional\n  now defaults to no","status":"published","published":"2026-10-08T21:56:57Z","modified":"2026-10-26T09:43:27.512691006Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"MGASA-2026-0451","title":"Updated unbound packages fixes security vulnerabilities","description":"Heap buffer overflow and possible Remote Code Execution when digesting\nDNSKEY\nPossible heap buffer overflow during DNSSEC canonicalization\nCNAME synthesis could lead to heap corruption\nPossible ZONEMD verification bypass window\nUse-after-free in DoQ stream output buffer on reset re-transmission\nPossible degradation of service from continuous queries on the same\nTCP/DoT connection\nUse-after-free in DoH stream cleanup code path\nRetrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks\non DNSSEC\n'serve-expired' can bypass Unbound 'wait-limit'\nRemote DNS-over-QUIC denial of service due to 'quic-size' budget bypass\nPacket of death for DNSCrypt over TCP\nCross-zone wildcard cache poisoning via RRSIG.labels manipulation\n'dns-error-reporting: yes' leads to stack buffer overflow\nAssertion in libngtcp2 when under pressure in high concurrency\nDNS-over-QUIC environments\nLibunbound applications configured with 'unwanted-reply-threshold' could\neventually be abruptly terminated\n'max-global-quota' reset by DNSSEC validation restarts\nPossible heap use-after-free in an error path when a DoT forwarded query\nis jostled out\n'response-ip'/'rpz' can rewrite BOGUS answers instead of returning\nSERVFAIL\nBOGUS configured primary hostname accepted for XFR in auth/rpz zones\nDate:\nAttacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache\nflush\nPossible cache poisoning attack by mapping source port population per\nthread\nMemory corruption could lead to crash and denial of service\n'serve-expired-client-timeout' and 'response-ip' CNAME redirect could\nlead to a crash\nPacket of death for a DNSCrypt misconfigured Unbound\nRemote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2\nPossible heap buffer overflow when validator canonicalizes RDATA that\ncontains domain name\nDegradation of resolution service when 'discard-timeout' and\n'serve-expired-client-timeout' are combined in unusual configuration\nDegradation of resolution service from improperly accounted\nclient-terminated DNS-over-QUIC queries\nExtra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records\ndisallowing a one-time 'ghost domain' delegation renewal via glue\nrecords\nOff-by-one error in 'harden-below-nxdomain' logic can shadow a\nstub/forward zone by a legitimate parent's NXDOMAIN\nA wildcard replay, as another piece of data, triggers poisoning in the\nserve expired reply path\nDNS Cookie bypass when combined with proxy-protocol use\nPrivacy/configuration issue when adding local data in views through\n'unbound-control'\nPossible arbitrary code execution during DNSSEC validation\nHeap overflow with multiple NSID, COOKIE, PADDING EDNS options\nCrash during DNSSEC validation of malicious content\nDate:\nPacket of death with DNSCrypt\nAnother \"ghost domain names\" attack variant\nLong list of incoming EDNS options degrades performance\nJostle logic bypass degrades resolution performance\nDegradation of service with unbounded NSEC3 hash calculations\nPossible cache poisoning via promiscuous records for the authority\nsection\nUnbounded name compression in certain cases causes degradation of\nservice\nUse after free and crash under special conditions in RPZ code\nPossible domain hijacking via promiscuous records in the authority\nsection\nCache poisoning via the ECS-enabled Rebirthday Attack\nUnbounded name compression could lead to Denial of Service\nUnbound vulnerable to the \"DNSBomb\" pulsing DoS amplification attack\nDenial of service when trimming EDE text on positive replies\nDNSSEC verification complexity can be exploited to exhaust CPU resources\nand stall DNS resolvers\nNSEC3 closest encloser proof can exhaust CPU\nNon-Responsive Delegation Attack\nNovel \"ghost domain names\" attack by updating almost expired delegation\ninformation\nNovel \"ghost domain names\" attack by introducing subdomain delegations\nLocal symlink attack\nVulnerability in Domain Parse\nNXNSAttack\nVulnerability in IPSEC module\nVulnerability in parsing NOTIFY queries\nVulnerability in the processing of wildcard synthesized NSEC records\nNo limit to delegation chaining\nGhost domain names attack\nIncorrect proof processing for NSEC3-signed zone\nProcessing of duplicate CNAME records in a signed zone\nEmpty error packet handling assertion failure\n","status":"published","published":"2026-09-25T05:02:40Z","modified":"2026-09-25T05:15:03.49547618Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11930-1","title":"libunbound8-1.26.1-1.1 on GA media","description":"These are all security issues fixed in the libunbound8-1.26.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-29T00:00:00Z","modified":"2026-09-30T18:23:14.940782144Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22082-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\n- CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' (bsc#1280403).\n- CVE-2026-77955: Possible ZONEMD verification bypass window (bsc#1280404).\n- CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission (bsc#1280405).\n- CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection (bsc#1280406).\n- CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization (bsc#1280409).\n- CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (bsc#1280411).\n- CVE-2026-82717: CNAME synthesis could lead to heap corruption (bsc#1280412).\n- CVE-2026-82720: Use-after-free in DoH stream cleanup code path (bsc#1280413).\n- CVE-2026-85501: Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC (bsc#1280414).\n\nChanges for unbound:\n\n- Update to 1.26.1:\n * Update icannbundle.pem certificates in unbound-anchor, valid\n for 2009-2029 and 2025-2045\n * Add max-transfer-size and max-transfer-time options to limit\n auth-zone and rpz transfer size and time, default disabled\n * Overload local_data_remove in unbound-control to also remove\n specific records\n * Add local-zone types block_aaaa, block_a_wdata and\n block_aaaa_wdata; fix respip+dns64 to use original A records\n instead of ones already modified by respip\n * ipsecmod hook script now needs to start with '#!/bin/sh', it\n is executed with execv instead of system for security\n * Server now continues to start if a secondary zone fails to\n load from its zonefile, or if a primary zonefile is missing;\n $INCLUDE is no longer allowed in secondary zone zonefiles\n * Auth-zone and RPZ zones now drop out-of-zone content on load\n * Primary hostname for zone transfers can now use CNAME(s)\n * Fix windows 64bit build for libssp dependency\n * Update IANA portlist\n * Fix heap out-of-bounds write via size_t-to-int truncation in\n setup_if()/outside_network_create() for large num_ports values\n * Fix to clean up log ids after a failure to start a worker\n thread\n * Relax assertions after the TTL 0 handling change in cachedb\n and packet_rrset_copy_region\n * Fix val_find_DS to check the result of packet_rrset_copy_region\n before using it\n * Fix that dns64 answers check the AAAA query is DNSSEC\n validated, improving RFC6147 conformance\n * Fix allocation-failure hardening of rrset cache wildcard\n storage and canonical NSEC owner replacement\n * Fix DNSSEC validation and DNSKEY size calculation for\n noncanonical RSA DNSKEYs with leading zeroes\n * Fix mixed class referrals to use the query class\n * Fix serve-expired responses from cachedb to not store bogus\n data\n * Fix lame server detection for selfpointed glue records\n * Fix cleanup of DoH sessions when the same query is on multiple\n streams\n * Fix for signed same-owner CNAME and ordinary RRset responses\n * Fix mesh new client/callback to roll back added address, tcp\n mesh state and callback on initialization failure\n * Fix autotrust state-file line overflow that could give a\n hold-down bypass\n * Fix to limit the DSNS per-label walk in the iterator\n * Fix that the ratelimit is decremented on successful referrals\n * Fix msgencode insert_query assertion for a local_alias\n * Fix to reset the tcp-timeout before applying a load based\n reduction\n * Fix to correctly decrement per-netblock tcp connection limits\n * Fix, in depth, for respip rewrite of dns64 responses\n * Fix that dns64 with subnetcache does not write ECS scoped\n answers to the global cache\n * Fix ipset module name-too-long checks and race conditions on\n the local name buffer and socket close\n * Fix validator to cap the number of ANY RRsets it validates and\n shorten the wait timer\n * Fix race condition causing segfault when starting threads\n * Fix header_seen detection for trust anchor files to detect the\n id line\n * Fix heap use-after-free in class response processing when at\n least two distinct classes are configured\n * Fix negative cache to work with NSEC3 records without salt\n * Fix parse of svcbparam ech, it had an incorrect length\n * Fix that quotation and escaping works the same in auth-zone\n url content as in zonefile reads\n * Fix ipset module to use larger domain name buffers and check\n buffer lengths\n * Fix PROXYv2 header read and consume to check the header size\n * Fix negative cache NSEC3 nodata proof to use the correct\n message size\n * Fix fast_reload for when a ZONEMD lookup is in progress\n * Fix that validation canonicalization of domain names in rdata\n checks buffer bounds\n * Fix dump_cache to use a larger record buffer and check that an\n owner name does not collide with BADRR\n * Fix that dns64 cleans up the allocated message if the adjust\n routines fail, and checks for malformed A/AAAA in auth-zones\n * Fix pythonmod script read for numeric overflow\n * Fix configure to detect the correct QUIC early-data function\n and to check for the ngtcp2_crypto_ossl header\n * Fix compile with OpenSSL 4.0.1, and with OpenSSL 1.0.2 and\n earlier in server cleanup\n * Fix that auth-zone/rpz allow-notify addresses and netblocks\n are available from start, and fix the probe step skip\n * Fix to perform a full transfer periodically to stop increasing\n memory usage for rpz zones\n * Fix assertion failure for a long HTTP header that fills the\n buffer, and buffer overflow with lower than default size and\n http transfer\n * Fix that misconfigured iter-scrub-ns: 0 causes request failures\n * Fix fast_reload handling of in-progress ZONEMD lookups and of\n removing an auth zone while its lookups are in progress\n * Fix integer overflow in infra-cache-max-rtt calculation and for\n very high values of sock-queue-timeout\n * Fix erroneous DNS error report values after a bogus AAAA query\n * Fix fast_reload to not terminate the server on config errors\n for key files\n * Fix log of an aliased qname to not use freed region memory\n * Fix DNAME synthesis from cache to keep using 0TTL entries\n within a sliding window without surpassing RRSIG expiry\n * Fix that dns64 bypasses the rpz-passthru rule during synthesis\n * Fix to disallow $INCLUDE for secondary zones; failed loads now\n clear the zone data so there is no partial zone\n * Fix zone read to allow SVCB records in unknown format that\n cannot be written out\n * Fix that a half-written trust anchor file does not crash the\n server at runtime\n * Fix that auth-zone and RPZ zones drop out-of-zone records\n * Fix that dns64 honors the forward-no-cache and stub-no-cache\n options\n * Fix that a signed wildcard NSEC is checked before use, so it\n does not allow insecure DS proofs inappropriately\n * Fix several crashes after malloc failure: half-built\n local_alias, RPZ list, delegation point cleanup,\n dns64_inform_super, new_local_rrset for RPZ qname trigger, doq\n connection setup, ngtcp2_conn_server_new, TCP accept handling,\n rpz_strip_nsdname, edns subnet addrtree insert, and rpz\n response create\n * Fix that a zonefile-only zone continues server startup with a\n warning if the file is missing on start\n * Fix that dnscrypt configuration does not crash on a\n secret/public key mismatch, and duplicate files are skipped\n * Fix locking in libunbound ub_ctx_set_event\n * Fix that libunbound pipe functions fail with an error after an\n event base is set\n * Fix incorrect cleanup after an allocation failure for a\n delegation point\n * Fix that the server does not crash if shared memory cannot be\n created for shm-enable\n * Fix auth primary host name lookup to allow CNAMEs\n * Fix memory leak on DNAME 0TTL records\n * Fix that fast_reload disown of the auth zone transfer task\n cleans up the chunk list\n * Fix unbound-checkconf to check for auth-zone download filename\n collisions\n * Fix malloc failure in auth-zone insert rr to avoid an empty\n node and infinite loop\n * Fix that unbound-control auth_zone_reload stops answering from\n the zone after a read failure\n * Fix stats pipe draining after a malloc failure so internal\n messaging stays correct, and the server no longer exits on\n stats pipe communication failure\n * Fix that fast_reload does not terminate the server if random\n init for DNS cookies fails\n * Fix thread setname for dnstap and fast_reload thread start\n * Add libunbound/remote.h, a shared header with prototypes for\n remote control connections\n * Fix DEREF_AFTER_NULL on worker_init when stat_timer allocation\n fails with an out of memory error\n * Fix DoH POST requests missing content-length causing :status\n 400 from strict resolvers like Cloudflare and Mullvad\n * Fix randomness generation on macOS/iOS under chroot\n * Fix ipsecmod deref on null in ipsecmod-whitelist after OOM, and\n possible deref on null after reply_find_answer_rrset()\n * Fix that DoQ responses were never padded; pad-responses now\n applies to comm_doq per RFC 9250 section 5.4\n * Fix log printout error in the fix for CVE-2026-50248 when the\n primary name is bogus\n * Fix NSEC3 proofs to check the b32 name matches the signer name;\n RRSIGs are no longer valid when this does not match\n * Fix aggressive negative cache to not insert NSEC records with\n an overreaching next owner name outside the trust anchor's\n bailiwick\n * Fix mesh cycle detection for respip CNAME loop with tagged\n clients\n * Fix unbound-anchor to check the return value of\n X509_NAME_get_text_by_NID for the emailaddress\n * Fix locking of the shared_ports structure during\n initialisation, and of the anchor structure when a file is set\n during header parsing\n * Fix memory leak in xfer_set_masters() error path in authzone\n * Fix to use tls-port after a referral when tls-upstream is set\n * Fix pthread detection on Solaris 11.4\n * Fix to call OPENSSL_cleanup on exit when it is defined\n * pythonmod: check the return value after ftell()\n","status":"published","published":"2026-10-09T15:11:12Z","modified":"2026-10-19T17:23:13.48392302Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:24128-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\n- CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' (bsc#1280403).\n- CVE-2026-77955: Possible ZONEMD verification bypass window (bsc#1280404).\n- CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission (bsc#1280405).\n- CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection (bsc#1280406).\n- CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization (bsc#1280409).\n- CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (bsc#1280411).\n- CVE-2026-82717: CNAME synthesis could lead to heap corruption (bsc#1280412).\n- CVE-2026-82720: Use-after-free in DoH stream cleanup code path (bsc#1280413).\n- CVE-2026-85501: Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC (bsc#1280414).\n\nChanges for unbound:\n\n- Update to 1.26.1:\n * Update icannbundle.pem certificates in unbound-anchor, valid\n for 2009-2029 and 2025-2045\n * Add max-transfer-size and max-transfer-time options to limit\n auth-zone and rpz transfer size and time, default disabled\n * Overload local_data_remove in unbound-control to also remove\n specific records\n * Add local-zone types block_aaaa, block_a_wdata and\n block_aaaa_wdata; fix respip+dns64 to use original A records\n instead of ones already modified by respip\n * ipsecmod hook script now needs to start with '#!/bin/sh', it\n is executed with execv instead of system for security\n * Server now continues to start if a secondary zone fails to\n load from its zonefile, or if a primary zonefile is missing;\n $INCLUDE is no longer allowed in secondary zone zonefiles\n * Auth-zone and RPZ zones now drop out-of-zone content on load\n * Primary hostname for zone transfers can now use CNAME(s)\n * Fix windows 64bit build for libssp dependency\n * Update IANA portlist\n * Fix heap out-of-bounds write via size_t-to-int truncation in\n setup_if()/outside_network_create() for large num_ports values\n * Fix to clean up log ids after a failure to start a worker\n thread\n * Relax assertions after the TTL 0 handling change in cachedb\n and packet_rrset_copy_region\n * Fix val_find_DS to check the result of packet_rrset_copy_region\n before using it\n * Fix that dns64 answers check the AAAA query is DNSSEC\n validated, improving RFC6147 conformance\n * Fix allocation-failure hardening of rrset cache wildcard\n storage and canonical NSEC owner replacement\n * Fix DNSSEC validation and DNSKEY size calculation for\n noncanonical RSA DNSKEYs with leading zeroes\n * Fix mixed class referrals to use the query class\n * Fix serve-expired responses from cachedb to not store bogus\n data\n * Fix lame server detection for selfpointed glue records\n * Fix cleanup of DoH sessions when the same query is on multiple\n streams\n * Fix for signed same-owner CNAME and ordinary RRset responses\n * Fix mesh new client/callback to roll back added address, tcp\n mesh state and callback on initialization failure\n * Fix autotrust state-file line overflow that could give a\n hold-down bypass\n * Fix to limit the DSNS per-label walk in the iterator\n * Fix that the ratelimit is decremented on successful referrals\n * Fix msgencode insert_query assertion for a local_alias\n * Fix to reset the tcp-timeout before applying a load based\n reduction\n * Fix to correctly decrement per-netblock tcp connection limits\n * Fix, in depth, for respip rewrite of dns64 responses\n * Fix that dns64 with subnetcache does not write ECS scoped\n answers to the global cache\n * Fix ipset module name-too-long checks and race conditions on\n the local name buffer and socket close\n * Fix validator to cap the number of ANY RRsets it validates and\n shorten the wait timer\n * Fix race condition causing segfault when starting threads\n * Fix header_seen detection for trust anchor files to detect the\n id line\n * Fix heap use-after-free in class response processing when at\n least two distinct classes are configured\n * Fix negative cache to work with NSEC3 records without salt\n * Fix parse of svcbparam ech, it had an incorrect length\n * Fix that quotation and escaping works the same in auth-zone\n url content as in zonefile reads\n * Fix ipset module to use larger domain name buffers and check\n buffer lengths\n * Fix PROXYv2 header read and consume to check the header size\n * Fix negative cache NSEC3 nodata proof to use the correct\n message size\n * Fix fast_reload for when a ZONEMD lookup is in progress\n * Fix that validation canonicalization of domain names in rdata\n checks buffer bounds\n * Fix dump_cache to use a larger record buffer and check that an\n owner name does not collide with BADRR\n * Fix that dns64 cleans up the allocated message if the adjust\n routines fail, and checks for malformed A/AAAA in auth-zones\n * Fix pythonmod script read for numeric overflow\n * Fix configure to detect the correct QUIC early-data function\n and to check for the ngtcp2_crypto_ossl header\n * Fix compile with OpenSSL 4.0.1, and with OpenSSL 1.0.2 and\n earlier in server cleanup\n * Fix that auth-zone/rpz allow-notify addresses and netblocks\n are available from start, and fix the probe step skip\n * Fix to perform a full transfer periodically to stop increasing\n memory usage for rpz zones\n * Fix assertion failure for a long HTTP header that fills the\n buffer, and buffer overflow with lower than default size and\n http transfer\n * Fix that misconfigured iter-scrub-ns: 0 causes request failures\n * Fix fast_reload handling of in-progress ZONEMD lookups and of\n removing an auth zone while its lookups are in progress\n * Fix integer overflow in infra-cache-max-rtt calculation and for\n very high values of sock-queue-timeout\n * Fix erroneous DNS error report values after a bogus AAAA query\n * Fix fast_reload to not terminate the server on config errors\n for key files\n * Fix log of an aliased qname to not use freed region memory\n * Fix DNAME synthesis from cache to keep using 0TTL entries\n within a sliding window without surpassing RRSIG expiry\n * Fix that dns64 bypasses the rpz-passthru rule during synthesis\n * Fix to disallow $INCLUDE for secondary zones; failed loads now\n clear the zone data so there is no partial zone\n * Fix zone read to allow SVCB records in unknown format that\n cannot be written out\n * Fix that a half-written trust anchor file does not crash the\n server at runtime\n * Fix that auth-zone and RPZ zones drop out-of-zone records\n * Fix that dns64 honors the forward-no-cache and stub-no-cache\n options\n * Fix that a signed wildcard NSEC is checked before use, so it\n does not allow insecure DS proofs inappropriately\n * Fix several crashes after malloc failure: half-built\n local_alias, RPZ list, delegation point cleanup,\n dns64_inform_super, new_local_rrset for RPZ qname trigger, doq\n connection setup, ngtcp2_conn_server_new, TCP accept handling,\n rpz_strip_nsdname, edns subnet addrtree insert, and rpz\n response create\n * Fix that a zonefile-only zone continues server startup with a\n warning if the file is missing on start\n * Fix that dnscrypt configuration does not crash on a\n secret/public key mismatch, and duplicate files are skipped\n * Fix locking in libunbound ub_ctx_set_event\n * Fix that libunbound pipe functions fail with an error after an\n event base is set\n * Fix incorrect cleanup after an allocation failure for a\n delegation point\n * Fix that the server does not crash if shared memory cannot be\n created for shm-enable\n * Fix auth primary host name lookup to allow CNAMEs\n * Fix memory leak on DNAME 0TTL records\n * Fix that fast_reload disown of the auth zone transfer task\n cleans up the chunk list\n * Fix unbound-checkconf to check for auth-zone download filename\n collisions\n * Fix malloc failure in auth-zone insert rr to avoid an empty\n node and infinite loop\n * Fix that unbound-control auth_zone_reload stops answering from\n the zone after a read failure\n * Fix stats pipe draining after a malloc failure so internal\n messaging stays correct, and the server no longer exits on\n stats pipe communication failure\n * Fix that fast_reload does not terminate the server if random\n init for DNS cookies fails\n * Fix thread setname for dnstap and fast_reload thread start\n * Add libunbound/remote.h, a shared header with prototypes for\n remote control connections\n * Fix DEREF_AFTER_NULL on worker_init when stat_timer allocation\n fails with an out of memory error\n * Fix DoH POST requests missing content-length causing :status\n 400 from strict resolvers like Cloudflare and Mullvad\n * Fix randomness generation on macOS/iOS under chroot\n * Fix ipsecmod deref on null in ipsecmod-whitelist after OOM, and\n possible deref on null after reply_find_answer_rrset()\n * Fix that DoQ responses were never padded; pad-responses now\n applies to comm_doq per RFC 9250 section 5.4\n * Fix log printout error in the fix for CVE-2026-50248 when the\n primary name is bogus\n * Fix NSEC3 proofs to check the b32 name matches the signer name;\n RRSIGs are no longer valid when this does not match\n * Fix aggressive negative cache to not insert NSEC records with\n an overreaching next owner name outside the trust anchor's\n bailiwick\n * Fix mesh cycle detection for respip CNAME loop with tagged\n clients\n * Fix unbound-anchor to check the return value of\n X509_NAME_get_text_by_NID for the emailaddress\n * Fix locking of the shared_ports structure during\n initialisation, and of the anchor structure when a file is set\n during header parsing\n * Fix memory leak in xfer_set_masters() error path in authzone\n * Fix to use tls-port after a referral when tls-upstream is set\n * Fix pthread detection on Solaris 11.4\n * Fix to call OPENSSL_cleanup on exit when it is defined\n * pythonmod: check the return value after ftell()\n","status":"published","published":"2026-10-09T15:11:19Z","modified":"2026-10-13T17:23:10.19936105Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24135-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\n- CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' (bsc#1280403).\n- CVE-2026-77955: Possible ZONEMD verification bypass window (bsc#1280404).\n- CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission (bsc#1280405).\n- CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection (bsc#1280406).\n- CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization (bsc#1280409).\n- CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (bsc#1280411).\n- CVE-2026-82717: CNAME synthesis could lead to heap corruption (bsc#1280412).\n- CVE-2026-82720: Use-after-free in DoH stream cleanup code path (bsc#1280413).\n- CVE-2026-85501: Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC (bsc#1280414).\n\nChanges for unbound:\n\n- Update to 1.26.1:\n * Update icannbundle.pem certificates in unbound-anchor, valid\n for 2009-2029 and 2025-2045\n * Add max-transfer-size and max-transfer-time options to limit\n auth-zone and rpz transfer size and time, default disabled\n * Overload local_data_remove in unbound-control to also remove\n specific records\n * Add local-zone types block_aaaa, block_a_wdata and\n block_aaaa_wdata; fix respip+dns64 to use original A records\n instead of ones already modified by respip\n * ipsecmod hook script now needs to start with '#!/bin/sh', it\n is executed with execv instead of system for security\n * Server now continues to start if a secondary zone fails to\n load from its zonefile, or if a primary zonefile is missing;\n $INCLUDE is no longer allowed in secondary zone zonefiles\n * Auth-zone and RPZ zones now drop out-of-zone content on load\n * Primary hostname for zone transfers can now use CNAME(s)\n * Fix windows 64bit build for libssp dependency\n * Update IANA portlist\n * Fix heap out-of-bounds write via size_t-to-int truncation in\n setup_if()/outside_network_create() for large num_ports values\n * Fix to clean up log ids after a failure to start a worker\n thread\n * Relax assertions after the TTL 0 handling change in cachedb\n and packet_rrset_copy_region\n * Fix val_find_DS to check the result of packet_rrset_copy_region\n before using it\n * Fix that dns64 answers check the AAAA query is DNSSEC\n validated, improving RFC6147 conformance\n * Fix allocation-failure hardening of rrset cache wildcard\n storage and canonical NSEC owner replacement\n * Fix DNSSEC validation and DNSKEY size calculation for\n noncanonical RSA DNSKEYs with leading zeroes\n * Fix mixed class referrals to use the query class\n * Fix serve-expired responses from cachedb to not store bogus\n data\n * Fix lame server detection for selfpointed glue records\n * Fix cleanup of DoH sessions when the same query is on multiple\n streams\n * Fix for signed same-owner CNAME and ordinary RRset responses\n * Fix mesh new client/callback to roll back added address, tcp\n mesh state and callback on initialization failure\n * Fix autotrust state-file line overflow that could give a\n hold-down bypass\n * Fix to limit the DSNS per-label walk in the iterator\n * Fix that the ratelimit is decremented on successful referrals\n * Fix msgencode insert_query assertion for a local_alias\n * Fix to reset the tcp-timeout before applying a load based\n reduction\n * Fix to correctly decrement per-netblock tcp connection limits\n * Fix, in depth, for respip rewrite of dns64 responses\n * Fix that dns64 with subnetcache does not write ECS scoped\n answers to the global cache\n * Fix ipset module name-too-long checks and race conditions on\n the local name buffer and socket close\n * Fix validator to cap the number of ANY RRsets it validates and\n shorten the wait timer\n * Fix race condition causing segfault when starting threads\n * Fix header_seen detection for trust anchor files to detect the\n id line\n * Fix heap use-after-free in class response processing when at\n least two distinct classes are configured\n * Fix negative cache to work with NSEC3 records without salt\n * Fix parse of svcbparam ech, it had an incorrect length\n * Fix that quotation and escaping works the same in auth-zone\n url content as in zonefile reads\n * Fix ipset module to use larger domain name buffers and check\n buffer lengths\n * Fix PROXYv2 header read and consume to check the header size\n * Fix negative cache NSEC3 nodata proof to use the correct\n message size\n * Fix fast_reload for when a ZONEMD lookup is in progress\n * Fix that validation canonicalization of domain names in rdata\n checks buffer bounds\n * Fix dump_cache to use a larger record buffer and check that an\n owner name does not collide with BADRR\n * Fix that dns64 cleans up the allocated message if the adjust\n routines fail, and checks for malformed A/AAAA in auth-zones\n * Fix pythonmod script read for numeric overflow\n * Fix configure to detect the correct QUIC early-data function\n and to check for the ngtcp2_crypto_ossl header\n * Fix compile with OpenSSL 4.0.1, and with OpenSSL 1.0.2 and\n earlier in server cleanup\n * Fix that auth-zone/rpz allow-notify addresses and netblocks\n are available from start, and fix the probe step skip\n * Fix to perform a full transfer periodically to stop increasing\n memory usage for rpz zones\n * Fix assertion failure for a long HTTP header that fills the\n buffer, and buffer overflow with lower than default size and\n http transfer\n * Fix that misconfigured iter-scrub-ns: 0 causes request failures\n * Fix fast_reload handling of in-progress ZONEMD lookups and of\n removing an auth zone while its lookups are in progress\n * Fix integer overflow in infra-cache-max-rtt calculation and for\n very high values of sock-queue-timeout\n * Fix erroneous DNS error report values after a bogus AAAA query\n * Fix fast_reload to not terminate the server on config errors\n for key files\n * Fix log of an aliased qname to not use freed region memory\n * Fix DNAME synthesis from cache to keep using 0TTL entries\n within a sliding window without surpassing RRSIG expiry\n * Fix that dns64 bypasses the rpz-passthru rule during synthesis\n * Fix to disallow $INCLUDE for secondary zones; failed loads now\n clear the zone data so there is no partial zone\n * Fix zone read to allow SVCB records in unknown format that\n cannot be written out\n * Fix that a half-written trust anchor file does not crash the\n server at runtime\n * Fix that auth-zone and RPZ zones drop out-of-zone records\n * Fix that dns64 honors the forward-no-cache and stub-no-cache\n options\n * Fix that a signed wildcard NSEC is checked before use, so it\n does not allow insecure DS proofs inappropriately\n * Fix several crashes after malloc failure: half-built\n local_alias, RPZ list, delegation point cleanup,\n dns64_inform_super, new_local_rrset for RPZ qname trigger, doq\n connection setup, ngtcp2_conn_server_new, TCP accept handling,\n rpz_strip_nsdname, edns subnet addrtree insert, and rpz\n response create\n * Fix that a zonefile-only zone continues server startup with a\n warning if the file is missing on start\n * Fix that dnscrypt configuration does not crash on a\n secret/public key mismatch, and duplicate files are skipped\n * Fix locking in libunbound ub_ctx_set_event\n * Fix that libunbound pipe functions fail with an error after an\n event base is set\n * Fix incorrect cleanup after an allocation failure for a\n delegation point\n * Fix that the server does not crash if shared memory cannot be\n created for shm-enable\n * Fix auth primary host name lookup to allow CNAMEs\n * Fix memory leak on DNAME 0TTL records\n * Fix that fast_reload disown of the auth zone transfer task\n cleans up the chunk list\n * Fix unbound-checkconf to check for auth-zone download filename\n collisions\n * Fix malloc failure in auth-zone insert rr to avoid an empty\n node and infinite loop\n * Fix that unbound-control auth_zone_reload stops answering from\n the zone after a read failure\n * Fix stats pipe draining after a malloc failure so internal\n messaging stays correct, and the server no longer exits on\n stats pipe communication failure\n * Fix that fast_reload does not terminate the server if random\n init for DNS cookies fails\n * Fix thread setname for dnstap and fast_reload thread start\n * Add libunbound/remote.h, a shared header with prototypes for\n remote control connections\n * Fix DEREF_AFTER_NULL on worker_init when stat_timer allocation\n fails with an out of memory error\n * Fix DoH POST requests missing content-length causing :status\n 400 from strict resolvers like Cloudflare and Mullvad\n * Fix randomness generation on macOS/iOS under chroot\n * Fix ipsecmod deref on null in ipsecmod-whitelist after OOM, and\n possible deref on null after reply_find_answer_rrset()\n * Fix that DoQ responses were never padded; pad-responses now\n applies to comm_doq per RFC 9250 section 5.4\n * Fix log printout error in the fix for CVE-2026-50248 when the\n primary name is bogus\n * Fix NSEC3 proofs to check the b32 name matches the signer name;\n RRSIGs are no longer valid when this does not match\n * Fix aggressive negative cache to not insert NSEC records with\n an overreaching next owner name outside the trust anchor's\n bailiwick\n * Fix mesh cycle detection for respip CNAME loop with tagged\n clients\n * Fix unbound-anchor to check the return value of\n X509_NAME_get_text_by_NID for the emailaddress\n * Fix locking of the shared_ports structure during\n initialisation, and of the anchor structure when a file is set\n during header parsing\n * Fix memory leak in xfer_set_masters() error path in authzone\n * Fix to use tls-port after a referral when tls-upstream is set\n * Fix pthread detection on Solaris 11.4\n * Fix to call OPENSSL_cleanup on exit when it is defined\n * pythonmod: check the return value after ftell()\n","status":"published","published":"2026-10-09T11:52:52Z","modified":"2026-10-15T17:23:11.709343277Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24226-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\n- CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' (bsc#1280403).\n- CVE-2026-77955: Possible ZONEMD verification bypass window (bsc#1280404).\n- CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission (bsc#1280405).\n- CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection (bsc#1280406).\n- CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization (bsc#1280409).\n- CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (bsc#1280411).\n- CVE-2026-82717: CNAME synthesis could lead to heap corruption (bsc#1280412).\n- CVE-2026-82720: Use-after-free in DoH stream cleanup code path (bsc#1280413).\n- CVE-2026-85501: Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC (bsc#1280414).\n\nChanges for unbound:\n\n- Update to 1.26.1:\n * Update icannbundle.pem certificates in unbound-anchor, valid\n for 2009-2029 and 2025-2045\n * Add max-transfer-size and max-transfer-time options to limit\n auth-zone and rpz transfer size and time, default disabled\n * Overload local_data_remove in unbound-control to also remove\n specific records\n * Add local-zone types block_aaaa, block_a_wdata and\n block_aaaa_wdata; fix respip+dns64 to use original A records\n instead of ones already modified by respip\n * ipsecmod hook script now needs to start with '#!/bin/sh', it\n is executed with execv instead of system for security\n * Server now continues to start if a secondary zone fails to\n load from its zonefile, or if a primary zonefile is missing;\n $INCLUDE is no longer allowed in secondary zone zonefiles\n * Auth-zone and RPZ zones now drop out-of-zone content on load\n * Primary hostname for zone transfers can now use CNAME(s)\n * Fix windows 64bit build for libssp dependency\n * Update IANA portlist\n * Fix heap out-of-bounds write via size_t-to-int truncation in\n setup_if()/outside_network_create() for large num_ports values\n * Fix to clean up log ids after a failure to start a worker\n thread\n * Relax assertions after the TTL 0 handling change in cachedb\n and packet_rrset_copy_region\n * Fix val_find_DS to check the result of packet_rrset_copy_region\n before using it\n * Fix that dns64 answers check the AAAA query is DNSSEC\n validated, improving RFC6147 conformance\n * Fix allocation-failure hardening of rrset cache wildcard\n storage and canonical NSEC owner replacement\n * Fix DNSSEC validation and DNSKEY size calculation for\n noncanonical RSA DNSKEYs with leading zeroes\n * Fix mixed class referrals to use the query class\n * Fix serve-expired responses from cachedb to not store bogus\n data\n * Fix lame server detection for selfpointed glue records\n * Fix cleanup of DoH sessions when the same query is on multiple\n streams\n * Fix for signed same-owner CNAME and ordinary RRset responses\n * Fix mesh new client/callback to roll back added address, tcp\n mesh state and callback on initialization failure\n * Fix autotrust state-file line overflow that could give a\n hold-down bypass\n * Fix to limit the DSNS per-label walk in the iterator\n * Fix that the ratelimit is decremented on successful referrals\n * Fix msgencode insert_query assertion for a local_alias\n * Fix to reset the tcp-timeout before applying a load based\n reduction\n * Fix to correctly decrement per-netblock tcp connection limits\n * Fix, in depth, for respip rewrite of dns64 responses\n * Fix that dns64 with subnetcache does not write ECS scoped\n answers to the global cache\n * Fix ipset module name-too-long checks and race conditions on\n the local name buffer and socket close\n * Fix validator to cap the number of ANY RRsets it validates and\n shorten the wait timer\n * Fix race condition causing segfault when starting threads\n * Fix header_seen detection for trust anchor files to detect the\n id line\n * Fix heap use-after-free in class response processing when at\n least two distinct classes are configured\n * Fix negative cache to work with NSEC3 records without salt\n * Fix parse of svcbparam ech, it had an incorrect length\n * Fix that quotation and escaping works the same in auth-zone\n url content as in zonefile reads\n * Fix ipset module to use larger domain name buffers and check\n buffer lengths\n * Fix PROXYv2 header read and consume to check the header size\n * Fix negative cache NSEC3 nodata proof to use the correct\n message size\n * Fix fast_reload for when a ZONEMD lookup is in progress\n * Fix that validation canonicalization of domain names in rdata\n checks buffer bounds\n * Fix dump_cache to use a larger record buffer and check that an\n owner name does not collide with BADRR\n * Fix that dns64 cleans up the allocated message if the adjust\n routines fail, and checks for malformed A/AAAA in auth-zones\n * Fix pythonmod script read for numeric overflow\n * Fix configure to detect the correct QUIC early-data function\n and to check for the ngtcp2_crypto_ossl header\n * Fix compile with OpenSSL 4.0.1, and with OpenSSL 1.0.2 and\n earlier in server cleanup\n * Fix that auth-zone/rpz allow-notify addresses and netblocks\n are available from start, and fix the probe step skip\n * Fix to perform a full transfer periodically to stop increasing\n memory usage for rpz zones\n * Fix assertion failure for a long HTTP header that fills the\n buffer, and buffer overflow with lower than default size and\n http transfer\n * Fix that misconfigured iter-scrub-ns: 0 causes request failures\n * Fix fast_reload handling of in-progress ZONEMD lookups and of\n removing an auth zone while its lookups are in progress\n * Fix integer overflow in infra-cache-max-rtt calculation and for\n very high values of sock-queue-timeout\n * Fix erroneous DNS error report values after a bogus AAAA query\n * Fix fast_reload to not terminate the server on config errors\n for key files\n * Fix log of an aliased qname to not use freed region memory\n * Fix DNAME synthesis from cache to keep using 0TTL entries\n within a sliding window without surpassing RRSIG expiry\n * Fix that dns64 bypasses the rpz-passthru rule during synthesis\n * Fix to disallow $INCLUDE for secondary zones; failed loads now\n clear the zone data so there is no partial zone\n * Fix zone read to allow SVCB records in unknown format that\n cannot be written out\n * Fix that a half-written trust anchor file does not crash the\n server at runtime\n * Fix that auth-zone and RPZ zones drop out-of-zone records\n * Fix that dns64 honors the forward-no-cache and stub-no-cache\n options\n * Fix that a signed wildcard NSEC is checked before use, so it\n does not allow insecure DS proofs inappropriately\n * Fix several crashes after malloc failure: half-built\n local_alias, RPZ list, delegation point cleanup,\n dns64_inform_super, new_local_rrset for RPZ qname trigger, doq\n connection setup, ngtcp2_conn_server_new, TCP accept handling,\n rpz_strip_nsdname, edns subnet addrtree insert, and rpz\n response create\n * Fix that a zonefile-only zone continues server startup with a\n warning if the file is missing on start\n * Fix that dnscrypt configuration does not crash on a\n secret/public key mismatch, and duplicate files are skipped\n * Fix locking in libunbound ub_ctx_set_event\n * Fix that libunbound pipe functions fail with an error after an\n event base is set\n * Fix incorrect cleanup after an allocation failure for a\n delegation point\n * Fix that the server does not crash if shared memory cannot be\n created for shm-enable\n * Fix auth primary host name lookup to allow CNAMEs\n * Fix memory leak on DNAME 0TTL records\n * Fix that fast_reload disown of the auth zone transfer task\n cleans up the chunk list\n * Fix unbound-checkconf to check for auth-zone download filename\n collisions\n * Fix malloc failure in auth-zone insert rr to avoid an empty\n node and infinite loop\n * Fix that unbound-control auth_zone_reload stops answering from\n the zone after a read failure\n * Fix stats pipe draining after a malloc failure so internal\n messaging stays correct, and the server no longer exits on\n stats pipe communication failure\n * Fix that fast_reload does not terminate the server if random\n init for DNS cookies fails\n * Fix thread setname for dnstap and fast_reload thread start\n * Add libunbound/remote.h, a shared header with prototypes for\n remote control connections\n * Fix DEREF_AFTER_NULL on worker_init when stat_timer allocation\n fails with an out of memory error\n * Fix DoH POST requests missing content-length causing :status\n 400 from strict resolvers like Cloudflare and Mullvad\n * Fix randomness generation on macOS/iOS under chroot\n * Fix ipsecmod deref on null in ipsecmod-whitelist after OOM, and\n possible deref on null after reply_find_answer_rrset()\n * Fix that DoQ responses were never padded; pad-responses now\n applies to comm_doq per RFC 9250 section 5.4\n * Fix log printout error in the fix for CVE-2026-50248 when the\n primary name is bogus\n * Fix NSEC3 proofs to check the b32 name matches the signer name;\n RRSIGs are no longer valid when this does not match\n * Fix aggressive negative cache to not insert NSEC records with\n an overreaching next owner name outside the trust anchor's\n bailiwick\n * Fix mesh cycle detection for respip CNAME loop with tagged\n clients\n * Fix unbound-anchor to check the return value of\n X509_NAME_get_text_by_NID for the emailaddress\n * Fix locking of the shared_ports structure during\n initialisation, and of the anchor structure when a file is set\n during header parsing\n * Fix memory leak in xfer_set_masters() error path in authzone\n * Fix to use tls-port after a referral when tls-upstream is set\n * Fix pthread detection on Solaris 11.4\n * Fix to call OPENSSL_cleanup on exit when it is defined\n * pythonmod: check the return value after ftell()\n","status":"published","published":"2026-10-09T15:11:19Z","modified":"2026-10-21T17:23:11.050283658Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24376-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\n- CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' (bsc#1280403).\n- CVE-2026-77955: Possible ZONEMD verification bypass window (bsc#1280404).\n- CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission (bsc#1280405).\n- CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection (bsc#1280406).\n- CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization (bsc#1280409).\n- CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (bsc#1280411).\n- CVE-2026-82717: CNAME synthesis could lead to heap corruption (bsc#1280412).\n- CVE-2026-82720: Use-after-free in DoH stream cleanup code path (bsc#1280413).\n- CVE-2026-85501: Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC (bsc#1280414).\n\nChanges for unbound:\n\n- Update to 1.26.1:\n * Update icannbundle.pem certificates in unbound-anchor, valid\n for 2009-2029 and 2025-2045\n * Add max-transfer-size and max-transfer-time options to limit\n auth-zone and rpz transfer size and time, default disabled\n * Overload local_data_remove in unbound-control to also remove\n specific records\n * Add local-zone types block_aaaa, block_a_wdata and\n block_aaaa_wdata; fix respip+dns64 to use original A records\n instead of ones already modified by respip\n * ipsecmod hook script now needs to start with '#!/bin/sh', it\n is executed with execv instead of system for security\n * Server now continues to start if a secondary zone fails to\n load from its zonefile, or if a primary zonefile is missing;\n $INCLUDE is no longer allowed in secondary zone zonefiles\n * Auth-zone and RPZ zones now drop out-of-zone content on load\n * Primary hostname for zone transfers can now use CNAME(s)\n * Fix windows 64bit build for libssp dependency\n * Update IANA portlist\n * Fix heap out-of-bounds write via size_t-to-int truncation in\n setup_if()/outside_network_create() for large num_ports values\n * Fix to clean up log ids after a failure to start a worker\n thread\n * Relax assertions after the TTL 0 handling change in cachedb\n and packet_rrset_copy_region\n * Fix val_find_DS to check the result of packet_rrset_copy_region\n before using it\n * Fix that dns64 answers check the AAAA query is DNSSEC\n validated, improving RFC6147 conformance\n * Fix allocation-failure hardening of rrset cache wildcard\n storage and canonical NSEC owner replacement\n * Fix DNSSEC validation and DNSKEY size calculation for\n noncanonical RSA DNSKEYs with leading zeroes\n * Fix mixed class referrals to use the query class\n * Fix serve-expired responses from cachedb to not store bogus\n data\n * Fix lame server detection for selfpointed glue records\n * Fix cleanup of DoH sessions when the same query is on multiple\n streams\n * Fix for signed same-owner CNAME and ordinary RRset responses\n * Fix mesh new client/callback to roll back added address, tcp\n mesh state and callback on initialization failure\n * Fix autotrust state-file line overflow that could give a\n hold-down bypass\n * Fix to limit the DSNS per-label walk in the iterator\n * Fix that the ratelimit is decremented on successful referrals\n * Fix msgencode insert_query assertion for a local_alias\n * Fix to reset the tcp-timeout before applying a load based\n reduction\n * Fix to correctly decrement per-netblock tcp connection limits\n * Fix, in depth, for respip rewrite of dns64 responses\n * Fix that dns64 with subnetcache does not write ECS scoped\n answers to the global cache\n * Fix ipset module name-too-long checks and race conditions on\n the local name buffer and socket close\n * Fix validator to cap the number of ANY RRsets it validates and\n shorten the wait timer\n * Fix race condition causing segfault when starting threads\n * Fix header_seen detection for trust anchor files to detect the\n id line\n * Fix heap use-after-free in class response processing when at\n least two distinct classes are configured\n * Fix negative cache to work with NSEC3 records without salt\n * Fix parse of svcbparam ech, it had an incorrect length\n * Fix that quotation and escaping works the same in auth-zone\n url content as in zonefile reads\n * Fix ipset module to use larger domain name buffers and check\n buffer lengths\n * Fix PROXYv2 header read and consume to check the header size\n * Fix negative cache NSEC3 nodata proof to use the correct\n message size\n * Fix fast_reload for when a ZONEMD lookup is in progress\n * Fix that validation canonicalization of domain names in rdata\n checks buffer bounds\n * Fix dump_cache to use a larger record buffer and check that an\n owner name does not collide with BADRR\n * Fix that dns64 cleans up the allocated message if the adjust\n routines fail, and checks for malformed A/AAAA in auth-zones\n * Fix pythonmod script read for numeric overflow\n * Fix configure to detect the correct QUIC early-data function\n and to check for the ngtcp2_crypto_ossl header\n * Fix compile with OpenSSL 4.0.1, and with OpenSSL 1.0.2 and\n earlier in server cleanup\n * Fix that auth-zone/rpz allow-notify addresses and netblocks\n are available from start, and fix the probe step skip\n * Fix to perform a full transfer periodically to stop increasing\n memory usage for rpz zones\n * Fix assertion failure for a long HTTP header that fills the\n buffer, and buffer overflow with lower than default size and\n http transfer\n * Fix that misconfigured iter-scrub-ns: 0 causes request failures\n * Fix fast_reload handling of in-progress ZONEMD lookups and of\n removing an auth zone while its lookups are in progress\n * Fix integer overflow in infra-cache-max-rtt calculation and for\n very high values of sock-queue-timeout\n * Fix erroneous DNS error report values after a bogus AAAA query\n * Fix fast_reload to not terminate the server on config errors\n for key files\n * Fix log of an aliased qname to not use freed region memory\n * Fix DNAME synthesis from cache to keep using 0TTL entries\n within a sliding window without surpassing RRSIG expiry\n * Fix that dns64 bypasses the rpz-passthru rule during synthesis\n * Fix to disallow $INCLUDE for secondary zones; failed loads now\n clear the zone data so there is no partial zone\n * Fix zone read to allow SVCB records in unknown format that\n cannot be written out\n * Fix that a half-written trust anchor file does not crash the\n server at runtime\n * Fix that auth-zone and RPZ zones drop out-of-zone records\n * Fix that dns64 honors the forward-no-cache and stub-no-cache\n options\n * Fix that a signed wildcard NSEC is checked before use, so it\n does not allow insecure DS proofs inappropriately\n * Fix several crashes after malloc failure: half-built\n local_alias, RPZ list, delegation point cleanup,\n dns64_inform_super, new_local_rrset for RPZ qname trigger, doq\n connection setup, ngtcp2_conn_server_new, TCP accept handling,\n rpz_strip_nsdname, edns subnet addrtree insert, and rpz\n response create\n * Fix that a zonefile-only zone continues server startup with a\n warning if the file is missing on start\n * Fix that dnscrypt configuration does not crash on a\n secret/public key mismatch, and duplicate files are skipped\n * Fix locking in libunbound ub_ctx_set_event\n * Fix that libunbound pipe functions fail with an error after an\n event base is set\n * Fix incorrect cleanup after an allocation failure for a\n delegation point\n * Fix that the server does not crash if shared memory cannot be\n created for shm-enable\n * Fix auth primary host name lookup to allow CNAMEs\n * Fix memory leak on DNAME 0TTL records\n * Fix that fast_reload disown of the auth zone transfer task\n cleans up the chunk list\n * Fix unbound-checkconf to check for auth-zone download filename\n collisions\n * Fix malloc failure in auth-zone insert rr to avoid an empty\n node and infinite loop\n * Fix that unbound-control auth_zone_reload stops answering from\n the zone after a read failure\n * Fix stats pipe draining after a malloc failure so internal\n messaging stays correct, and the server no longer exits on\n stats pipe communication failure\n * Fix that fast_reload does not terminate the server if random\n init for DNS cookies fails\n * Fix thread setname for dnstap and fast_reload thread start\n * Add libunbound/remote.h, a shared header with prototypes for\n remote control connections\n * Fix DEREF_AFTER_NULL on worker_init when stat_timer allocation\n fails with an out of memory error\n * Fix DoH POST requests missing content-length causing :status\n 400 from strict resolvers like Cloudflare and Mullvad\n * Fix randomness generation on macOS/iOS under chroot\n * Fix ipsecmod deref on null in ipsecmod-whitelist after OOM, and\n possible deref on null after reply_find_answer_rrset()\n * Fix that DoQ responses were never padded; pad-responses now\n applies to comm_doq per RFC 9250 section 5.4\n * Fix log printout error in the fix for CVE-2026-50248 when the\n primary name is bogus\n * Fix NSEC3 proofs to check the b32 name matches the signer name;\n RRSIGs are no longer valid when this does not match\n * Fix aggressive negative cache to not insert NSEC records with\n an overreaching next owner name outside the trust anchor's\n bailiwick\n * Fix mesh cycle detection for respip CNAME loop with tagged\n clients\n * Fix unbound-anchor to check the return value of\n X509_NAME_get_text_by_NID for the emailaddress\n * Fix locking of the shared_ports structure during\n initialisation, and of the anchor structure when a file is set\n during header parsing\n * Fix memory leak in xfer_set_masters() error path in authzone\n * Fix to use tls-port after a referral when tls-upstream is set\n * Fix pthread detection on Solaris 11.4\n * Fix to call OPENSSL_cleanup on exit when it is defined\n * pythonmod: check the return value after ftell()\n","status":"published","published":"2026-10-20T08:21:41Z","modified":"2026-10-27T17:23:17.402819815Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:4620-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\n- CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' (bsc#1280403).\n- CVE-2026-77955: Possible ZONEMD verification bypass window (bsc#1280404).\n- CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission (bsc#1280405).\n- CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection (bsc#1280406).\n- CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization (bsc#1280409).\n- CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (bsc#1280411).\n- CVE-2026-82717: CNAME synthesis could lead to heap corruption (bsc#1280412).\n- CVE-2026-82720: Use-after-free in DoH stream cleanup code path (bsc#1280413).\n- CVE-2026-85501: Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC (bsc#1280414).\n\nChanges for libunbound-devel-mini:\n\n- Updated to version 1.26.1\n\nChanges for unbound:\n\n- Updated to version 1.26.1\n","status":"published","published":"2026-10-12T07:23:36Z","modified":"2026-10-13T10:30:05.848682848Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4624-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\n- CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' (bsc#1280403).\n- CVE-2026-77955: Possible ZONEMD verification bypass window (bsc#1280404).\n- CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission (bsc#1280405).\n- CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection (bsc#1280406).\n- CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization (bsc#1280409).\n- CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (bsc#1280411).\n- CVE-2026-82717: CNAME synthesis could lead to heap corruption (bsc#1280412).\n- CVE-2026-82720: Use-after-free in DoH stream cleanup code path (bsc#1280413).\n- CVE-2026-85501: Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC (bsc#1280414).\n\nChanges for libunbound-devel-mini:\n\n- Updated to version 1.26.1\n\nChanges for unbound:\n\n- Updated to version 1.26.1\n","status":"published","published":"2026-10-12T07:29:19Z","modified":"2026-10-13T10:30:05.856272931Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"USN-8946-1","title":"unbound vulnerabilities","description":"It was discovered that Unbound incorrectly handled certain TCP connections.\nA remote attacker could possibly use this issue to cause Unbound to consume\nresources, leading to a denial of service. This issue only affected Ubuntu\n26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS and Ubuntu 20.04 LTS.\n(CVE-2026-80225)\n\nIt was discovered that Unbound incorrectly handled certain DNS responses. A\nremote attacker could possibly use this issue to crash Unbound, resulting\nin a denial of service. (CVE-2026-81634)\n\nIt was discovered that Unbound incorrectly handled certain DNS responses\nduring DNSSEC validation. A remote attacker could possibly use this issue\nto cause Unbound to consume resources, leading to a denial of service.\n(CVE-2026-85501)\n\nIt was discovered that Unbound incorrectly handled outgoing network ports.\nA remote attacker could possibly use this issue to crash Unbound, resulting\nin a denial of service. (CVE-2026-50252)\n\nIt was discovered that Unbound incorrectly handled certain DNSCrypt\npackets. A remote attacker could possibly use this issue to crash Unbound,\nresulting in a denial of service. This issue only affected Ubuntu 26.04\nLTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS and Ubuntu 18.04\nLTS. (CVE-2026-40691)\n\nIt was discovered that Unbound incorrectly handled certain cached DNS\nresponses. A remote attacker could possibly use this issue to poison\nUnbound's cache. This issue only affected Ubuntu 26.04 LTS, Ubuntu 24.04\nLTS, Ubuntu 22.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-44690)\n\nIt was discovered that Unbound incorrectly handled certain DNS-over-QUIC\nconnections. A remote attacker could possibly use this issue to cause\nUnbound to consume resources, leading to a denial of service. This issue\nonly affected Ubuntu 26.04 LTS. (CVE-2026-32665)\n\nIt was discovered that Unbound incorrectly handled certain EDNS options. A\nremote attacker could possibly use this issue to crash Unbound, resulting\nin a denial of service. This issue only affected Ubuntu 26.04 LTS.\n(CVE-2026-55973)\n\nElias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered\nthat Unbound incorrectly handled validating DNSSEC messages. A remote\nattacker could possibly use this issue to cause Unbound to consume\nresources, leading to a denial of service. This issue only affected Ubuntu\n18.04 LTS, Ubuntu 16.04 LTS and Ubuntu 14.04 LTS. (CVE-2023-50387)\n\nIt was discovered that Unbound incorrectly handled preparing an NSEC3\nclosest encloser proof. A remote attacker could possibly use this issue to\ncause Unbound to consume resources, leading to a denial of service. This\nissue only affected Ubuntu 18.04 LTS, Ubuntu 16.04 LTS and Ubuntu 14.04\nLTS. (CVE-2023-50868)","status":"published","published":"2026-10-21T09:48:45Z","modified":"2026-10-21T23:13:04.088658103Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}