CVE-2026-80225

In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolize...

CVE-2026-77860

In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb CVE-2024-33655. A malicious actor can...

EUVD-2026-80289

In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolize...

CVE-2026-80225

NLnetLabs Unbound versions up to and including 1.26.0 are affected by a degradation of service vulnerability in the TCP/DoT reading procedure . The root cause is the absence of a limit on consecutive reads : a remote, unauthenticated attacker who can sustain a rate of distinct uncached DNS querie...

CVE-2026-80225 Possible degradation of service from continuous queries on the same TCP/DoT connection

In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolize...

CVE-2026-77860

NLnetLabs Unbound versions 1.20.0 through 1.26.0 are affected by a double-decrement flaw in the serve-expired code path that causes the per-client wait-limit counter to be decremented twice. An attacker controlling an authoritative zone with short TTLs can alternate "slow" queries (never answered...

EUVD-2026-80286

In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb CVE-2024-33655. A malicious actor can...

Fedora 39 : unbound (2024-2ba00c906c)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-2ba00c906c advisory. Fixed builds on F41. Fixes CVE-2024-8508 - https://github.com/NLnetLabs/unbound/releases/tag/release-1.21.1 Tenable has extracted the preceding...