Skip to contentNlnet Labs Unbound vulnerabilities
- nlnet labs unboundDNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.CVE-2026-97206Public exploitFix available7.5 High
- nlnet labs unboundAggregate DNS name chained pointer decompression work leads to degradation of service.CVE-2026-96405Fix available5.3 Medium
- nlnet labs unboundPossible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent.CVE-2026-50106Fix available6.5 Medium
- nlnet labs unboundBypass of a configured island trust anchor underneath an insecure parent from an atacker-controlled NSEC record.CVE-2026-35501Fix available3.7 Low
- nlnet labs unboundPossible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'CVE-2026-109125Fix available5.3 Medium
- nlnet labs unboundRetrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSECCVE-2026-85501Fix available5.3 Medium
- nlnet labs unboundUse-after-free in DoH stream cleanup code pathCVE-2026-82720Fix available5.9 Medium
- nlnet labs unboundCNAME synthesis could lead to heap corruptionCVE-2026-82717Fix available8.4 High
- nlnet labs unboundHeap buffer overflow and possible Remote Code Execution when digesting DNSKEYCVE-2026-81642Public exploitFix available9.1 Critical
- nlnet labs unboundPossible heap buffer overflow during DNSSEC canonicalizationCVE-2026-81634Fix available7.5 High
- nlnet labs unboundPossible degradation of service from continuous queries on the same TCP/DoT connectionCVE-2026-80225Fix available5.3 Medium
- nlnet labs unboundUse-after-free in DoQ stream output buffer on reset re-transmissionCVE-2026-78227Fix available6.5 Medium
- nlnet labs unboundPossible ZONEMD verification bypass windowCVE-2026-77955Fix available4.4 Medium
- nlnet labs unbound'serve-expired' can bypass Unbound 'wait-limit'CVE-2026-77860Fix available3.7 Low
- nlnet labs unboundDegradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configurationCVE-2026-56444Fix available5.9 Medium
- nlnet labs unboundPossible heap buffer overflow when validator canonicalizes RDATA that contains domain nameCVE-2026-56416Fix available4.8 Medium
- nlnet labs unboundRemote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2CVE-2026-55991Fix available5.9 Medium
- nlnet labs unboundPacket of death for a DNSCrypt misconfigured UnboundCVE-2026-55990Fix available5.9 Medium
- nlnet labs unbound'dns-error-reporting: yes' leads to stack buffer overflowCVE-2026-55973Fix available7.5 High
- nlnet labs unbound'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crashCVE-2026-55717Fix available5.9 Medium
- nlnet labs unboundPrivacy/configuration issue when adding local data in views through 'unbound-control'CVE-2026-55708Fix available3.1 Low
- nlnet labs unboundDNS Cookie bypass when combined with proxy-protocol useCVE-2026-54478Fix available3.7 Low
- nlnet labs unboundMemory corruption could lead to crash and denial of serviceCVE-2026-52863Fix available5.9 Medium
- nlnet labs unboundPossible cache poisoning attack by mapping source port population per threadCVE-2026-50252Fix available5.7 Medium
- nlnet labs unboundAttacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flushCVE-2026-50251Fix available5.3 Medium
- nlnet labs unboundBOGUS configured primary hostname accepted for XFR in auth/rpz zonesCVE-2026-50248Fix available6.5 Medium
- nlnet labs unbound'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAILCVE-2026-50243Fix available6.3 Medium
- nlnet labs unboundPossible heap use-after-free in an error path when a DoT forwarded query is jostled outCVE-2026-50046Fix available5.9 Medium
- nlnet labs unbound'max-global-quota' reset by DNSSEC validation restartsCVE-2026-50045Fix available5.3 Medium
- nlnet labs unboundA wildcard replay, as another piece of data, triggers poisoning in the serve expired reply pathCVE-2026-46582Fix available3.7 Low
- nlnet labs unboundCross-zone wildcard cache poisoning via RRSIG.labels manipulationCVE-2026-44690Fix available7.5 High
- nlnet labs unboundOff-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAINCVE-2026-44687Fix available3.7 Low
- nlnet labs unboundLibunbound applications configured with 'unwanted-reply-threshold' could eventually be abruptly terminatedCVE-2026-44621Fix available5.9 Medium
- nlnet labs unboundExtra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue recordsCVE-2026-42955Fix available3.7 Low
- nlnet labs unboundDegradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queriesCVE-2026-41637Fix available3.7 Low
- nlnet labs unboundPacket of death for DNSCrypt over TCPCVE-2026-40691Fix available7.5 High
- nlnet labs unboundRemote DNS-over-QUIC denial of service due to `quic-size` budget bypassCVE-2026-32665Fix available7.5 High
- nlnet labs unboundAssertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environmentsCVE-2026-14586Fix available5.9 Medium
- nlnet labs unboundUse after free and crash under special conditions in RPZ codeCVE-2026-44608Fix available4.6 Medium
- nlnet labs unbound, red hat enterprise linux 10, enterprise linux 6 +5 more +7 moreUnbounded name compression in certain cases causes degradation of serviceCVE-2026-44390Fix available6.9 Medium
- nlnet labs unboundPossible cache poisoning via promiscuous records for the authority sectionCVE-2026-42960Fix available5.7 Medium
- nlnet labs unbound, red hat enterprise linux 10, enterprise linux 6 +5 more +7 moreCrash during DNSSEC validation of malicious contentCVE-2026-42959Fix available8.7 High
- nlnet labs unbound, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreHeap overflow with multiple NSID, COOKIE, PADDING EDNS optionsCVE-2026-42944Fix available8.7 High
- nlnet labs unboundDegradation of service with unbounded NSEC3 hash calculationsCVE-2026-42923Fix available6.9 Medium
- nlnet labs unbound, red hat enterprise linux 10, enterprise linux 6 +5 more +7 moreJostle logic bypass degrades resolution performanceCVE-2026-42534Fix available6.9 Medium
- nlnet labs unbound, red hat data grid 8, enterprise linux 10 +10 more +12 moreLong list of incoming EDNS options degrades performanceCVE-2026-41292Fix available6.6 Medium
- nlnet labs unboundAnother 'ghost domain names' attack variantCVE-2026-40622Fix available6.6 Medium
- nlnet labs unbound, red hat enterprise linux 10, enterprise linux 6 +5 more +7 morePossible arbitrary code execution during DNSSEC validationCVE-2026-33278Fix available9.1 Critical
- nlnet labs unboundPacket of death with DNSCryptCVE-2026-32792Fix available4.6 Medium
- nlnet labs unboundPossible domain hijacking via promiscuous records in the authority sectionCVE-2025-11411Fix available5.7 Medium
- Show olderLoading…