Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2026-2033)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2033 advisory. In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the...

SUSE CVE-2026-44621

With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and libunbound needs to call 'libworkeralloccleanup' since the function is absent from the...

SUSE CVE-2026-50251

In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled set to any value greater than zero, glue records of 0.0.0.0/::0 can short-circuit Unbound, on systems that can direct such traffic, by issuing DNS queries and receiving seemingly unwanted replies...

Linux Distros Unpatched Vulnerability : CVE-2026-50251

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled set to any value greater than zero, glue records of...

CVE-2026-50251

In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled set to any value greater than zero, glue records of 0.0.0.0/::0 can short-circuit Unbound, on systems that can direct such traffic, by issuing DNS queries and receiving seemingly unwanted replies...

CVE-2026-44621

With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and libunbound needs to call 'libworkeralloccleanup' since the function is absent from the...

CVE-2026-44621

With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and libunbound needs to call 'libworkeralloccleanup' since the function is absent from the...

EUVD-2026-47675

In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled set to any value greater than zero, glue records of 0.0.0.0/::0 can short-circuit Unbound, on systems that can direct such traffic, by issuing DNS queries and receiving seemingly unwanted replies...

CVE-2026-50251

This entry describes a vulnerability in NLnet Labs Unbound (≤ 1.25.1) where enabling unwanted-reply-threshold (>0) allows a malicious delegation returning in-bailiwick glue 0.0.0.0/::0 to cause repeated, seemingly unwanted replies. The mismatch between 0.0.0.0/::0 and the local 127.0.0.1 persp...

CVE-2026-50251

In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled set to any value greater than zero, glue records of 0.0.0.0/::0 can short-circuit Unbound, on systems that can direct such traffic, by issuing DNS queries and receiving seemingly unwanted replies...

CVE-2026-50251 Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush

In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled set to any value greater than zero, glue records of 0.0.0.0/::0 can short-circuit Unbound, on systems that can direct such traffic, by issuing DNS queries and receiving seemingly unwanted replies...

CVE-2026-50251

In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled set to any value greater than zero, glue records of 0.0.0.0/::0 can short-circuit Unbound, on systems that can direct such traffic, by issuing DNS queries and receiving seemingly unwanted replies...

EUVD-2026-47667

With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and libunbound needs to call 'libworkeralloccleanup' since the function is absent from the...

CVE-2026-44621

With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and libunbound needs to call 'libworkeralloccleanup' since the function is absent from the...

CVE-2026-44621 Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abruptly terminated

With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and libunbound needs to call 'libworkeralloccleanup' since the function is absent from the...

CVE-2026-44621

With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and libunbound needs to call 'libworkeralloccleanup' since the function is absent from the...

CVE-2026-44621

The CVE describes a vulnerability in NLnet Labs Unbound up to version 1.25.1 where applications using libunbound and configuring the unwanted-reply-threshold (non-zero) can trigger a fatal exit of libunbound when threshold is exceeded and libworker_alloc_cleanup is not on the function-call allow ...

PT-2026-63383

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions prior to 1.25.2 Description When the unwanted-reply-threshold is enabled and set to a value greater than zero, the software is susceptible to a cache clearing attack. A malicious actor controlling a delegation that...

PT-2026-63375

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions prior to 1.25.2 Description Applications using libunbound configured with the unwanted-reply-threshold parameter may be abruptly terminated. This occurs when the threshold is reached and libunbound attempts to call...