unbound: Unbound: Denial of Service due to 'harden-below-nxdomain' logic bypass

An off-by-one error in Unbound's default harden-below-nxdomain logic can lead to a denial of service. When an intermediate label under a DNSSEC-signed zone is queried, the flaw incorrectly bypasses configured stub or forward zones, disrupting their name resolution...

unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option

A flaw was found in Unbound. When the 'dns-error-reporting: yes' option is enabled, a remote attacker can send a specially crafted DNS response containing a malformed EDNS Report-Channel option from a delegated zone they control. This can lead to a stack variable overwrite, causing the Unbound...

unbound: Unbound: Denial of Service via crafted DNSCrypt query

A flaw was found in Unbound, a domain name system DNS resolver. When Unbound is configured with DNSCrypt support, a remote attacker could send a specially crafted DNSCrypt query over TCP. This malicious query could cause a memory error, leading to a server crash and a Denial of Service DoS. This...

EUVD-2026-47706

An attacker who knows or guesses that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of...

CVE-2026-11331

CVE-2026-11331 affects BIND 9 with RPZ wildcards (CNAME policies). An attacker who can guess/know that a resolver uses RPZ can craft very long query names to cause NAMETOOLONG during RPZ processing, potentially defeating the RPZ rule or causing an unexpected exit in BIND 9. Affected versions incl...

CVE-2026-11331

An attacker who knows or guesses that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of...

CVE-2026-10822 Key Record using PRIVATEDNS algorithm may lead to unexpected exit

If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key KEY, DNSKEY, etc.. That key must specify a PRIVATEDNS algorithm 253, and in the algorithm identifier,...

CVE-2026-10822

If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key KEY, DNSKEY, etc.. That key must specify a PRIVATEDNS algorithm 253, and in the algorithm identifier,...

CLSA-2026-1774874764 squid: Fix of 3 CVEs

CVE-2026-33526: fix heap use-after-free due to double rfc1738escape in ICP error handling - CVE-2026-33515: fix validation of ICP packet sizes and URLs to prevent out-of-bounds reads - CVE-2026-32748: fix HttpRequest use-after-free in ICP v3 query handling...

SUSE-SU-2026:22810-1 Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 bsc1243603. - CVE-2026-31503: udp: Fix wildcard bind...

EUVD-2026-47683

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion if compiled with assertions on and terminate the entire Unbound process using a single DNS-over-QUIC DoQ connection and one normal DNS query. This is caused by an erroneous...

CVE-2026-55991

CVE-2026-55991 affects NLnet Labs Unbound 1.22.0–1.25.1. A remote unauthenticated DoQ client can trigger a libngtcp2 assertion by passing an erroneous error value when ngtcp2_conn_writev_stream() returns NGTCP2_ERR_STREAM_DATA_BLOCKED and Unbound calls ngtcp2_ccerr_set_application_error() with -1...

CVE-2026-55991 Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion if compiled with assertions on and terminate the entire Unbound process using a single DNS-over-QUIC DoQ connection and one normal DNS query. This is caused by an erroneous...

CVE-2026-55973

In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option code 18 from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain...

CVE-2026-55973 'dns-error-reporting: yes' leads to stack buffer overflow

In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option code 18 from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain...

EUVD-2026-47681

In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option code 18 from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain...

CVE-2026-55973 'dns-error-reporting: yes' leads to stack buffer overflow

In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option code 18 from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain...

CVE-2026-55973

CVE-2026-55973 affects NLnet Labs Unbound 1.23.0 through 1.25.1. When dns-error-reporting: yes is enabled, the EDNS Report-Channel option (code 18) length from the last upstream response is treated as the length of the agent domain. If the agent domain contains garbage after the domain, those byt...

CVE-2026-55973

In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option code 18 from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain...

CVE-2026-55973

In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option code 18 from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain...