CVE-2026-11331

An attacker who knows or guesses that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of...

EUVD-2026-47706

An attacker who knows or guesses that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of...

CVE-2026-56444

CVE-2026-56444 affects NLnet Labs Unbound 1.20.0 through 1.25.1. When configured with serve-expired: yes and serve-expired-client-timeout > discard-timeout > 0, the discard-timeout branch in the serve-expired logic fails to decrement the counter for aged client replies, unlike other branche...

CVE-2026-55991

CVE-2026-55991 affects NLnet Labs Unbound 1.22.0–1.25.1. A remote unauthenticated DoQ client can trigger a libngtcp2 assertion by passing an erroneous error value when ngtcp2_conn_writev_stream() returns NGTCP2_ERR_STREAM_DATA_BLOCKED and Unbound calls ngtcp2_ccerr_set_application_error() with -1...

CVE-2026-55991 Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion if compiled with assertions on and terminate the entire Unbound process using a single DNS-over-QUIC DoQ connection and one normal DNS query. This is caused by an erroneous...

CVE-2026-50252

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, the UDP source port is used as a secrecy element to increase DNS transaction entropy. When SO_REUSEPORT is enabled (default) and load balancing depends on the source port and IP address, this secrecy can be undermined. On startup Unbound pa...

CVE-2026-50252

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined...

CVE-2026-50243 'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL

In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the 'respip' module in front of the validator together with a 'response-ip' redirect rule or an RPZ file with an RPZ-IP trigger, the rewriting handler does not check the security status of the upstream answer...

EUVD-2026-47670

In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache, before later validation treats it as bogus based on NSEC validation. When the resolvin...

CVE-2026-40691

In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply length against the destination buffer size. The size clamp that protects the UDP path is not applied on the TCP path, so a reply larger th...

CVE-2026-32665

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC DoQ is enabled, the first two bidirectional streams on a new QUIC connection streamid 0 and 4 bypass the per-stream 'quic-size' gate entirely, and large input buffers are allocated later, after only the 2-byte...

PT-2026-63416

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.11.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.24 BIND 9 versions 9.21.0 through 9.21.23 BIND 9 versions 9.11.3-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.24-S1 Description A DNSSEC validating...

PT-2026-63414

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.16.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.24 BIND 9 versions 9.21.0 through 9.21.23 BIND 9 versions 9.16.8-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.24-S1 Description An attacker can craft...

PT-2026-63420

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.11.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.24 BIND 9 versions 9.21.0 through 9.21.23 BIND 9 versions 9.11.3-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.24-S1 Description The BIND resolver accept...

PT-2026-63418

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.18.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.24 BIND 9 versions 9.18.11-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.24-S1 Description Unexpected program termination occurs in named due to the...

SUSE CVE-2026-26032

The PackagerResolver of Apache Ivy is able to download online artifacts and to repackage them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a subdirectory of the configured "buildRoot" directory. This subdirectory is calculated based on...

EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2722)

According to the versions of the packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU...

EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2763)

According to the versions of the packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section...

DEBIAN-CVE-2026-44507

Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, when using a daemon configured with a chroot, the reverse DNS lookup of the connecting client was performed after the chroot had been entered. If the chroot did not...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...