CLSA-2026-1792810562 unbound: Fix of 6 CVEs

CVE-2025-5994: do not cache non-ECS answers to ECS queries in the subnet cache Rebirthday attack - CVE-2026-40622: limit the TTL of a higher-trust NS rrset replacing a cached delegation ghost domain - CVE-2026-50106: treat an unsigned parent denial of an island trust anchor as bogus -...

Medium: unbound

Issue Overview: In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-threshold 0' configurations not a default configuration. If a response-like UDP datagram reaches the upstream source port currently used by a...

SUSE CVE-2026-109125

In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-threshold 0' configurations not a default configuration. If a response-like UDP datagram reaches the upstream source port currently used by a recursive query, but i...

DEBIAN-CVE-2026-109125

In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-threshold 0' configurations not a default configuration. If a response-like UDP datagram reaches the upstream source port currently used by a recursive query, but i...

CVE-2026-109125

In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-threshold 0' configurations not a default configuration. If a response-like UDP datagram reaches the upstream source port currently used by a recursive query, but i...

CVE-2026-109125

NLnet Labs Unbound up to and including version 1.26.1 is vulnerable to a cache-level side-channel when configured with unwanted-reply-threshold > 0 (which is not the default). The vulnerability occurs because Unbound counts response-like UDP datagrams that do not match a pending query's TXID as

CVE-2026-109125 Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'

In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-threshold 0' configurations not a default configuration. If a response-like UDP datagram reaches the upstream source port currently used by a recursive query, but i...

EUVD-2026-107150

In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-threshold 0' configurations not a default configuration. If a response-like UDP datagram reaches the upstream source port currently used by a recursive query, but i...

CVE-2026-109125

In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-threshold 0' configurations not a default configuration. If a response-like UDP datagram reaches the upstream source port currently used by a recursive query, but i...

PT-2026-120504

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions prior to 1.26.2 Description An observable cache-level side-channel exists when the unwanted-reply-threshold is configured to a value greater than 0. This occurs when a response-like UDP datagram reaches the upstream...

Linux Distros Unpatched Vulnerability : CVE-2026-109125

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-threshold 0' configurations...

EulerOS 2.0 SP13 : unbound (EulerOS-SA-2026-4111)

According to the versions of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: unbound (UTSA-2026-104806)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104806 advisory. In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled set to any value greater than zero, glue records of 0.0.0.0/::0...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: unbound (UTSA-2026-104809)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104809 advisory. With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptl...

CVE-2026-44621

A flaw was found in libunbound, a library used by applications for DNS resolution. A remote attacker could exploit this vulnerability by sending specially crafted network traffic. This could cause applications using libunbound to terminate unexpectedly, leading to a denial of service DoS. This...

Important: unbound

Issue Overview: In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records...

Important: unbound

Issue Overview: In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to...

Amazon Linux 2 : unbound, --advisory ALAS2UNBOUND-1.17-2026-009 (ALASUNBOUND-1.17-2026-009)

The version of unbound installed on the remote host is prior to 1.17.0-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2UNBOUND-1.17-2026-009 advisory. In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field...

Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2026-2033)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2033 advisory. In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the...

SUSE CVE-2026-44621

With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and libunbound needs to call 'libworkeralloccleanup' since the function is absent from the...