CVE-2026-109140: NLnet Labs Krill: The vulnerability is that Krill encrypts every login-session token with a nonce built from a counter that is reset to 0…

The vulnerability is that Krill encrypts every login-session token with a nonce built from a counter that is reset to 0 on every Krill restart, so the same key, nonce pair is used again after each restart...

CVE-2026-109141: NLnet Labs Krill: The vulnerability gives a role that is restricted to a list of CAs (cas = [...]) its full permission set for every…

The vulnerability gives a role that is restricted to a list of CAs cas = ... its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA under any existing CA, gives the child any of that CA's resource...

CVE-2026-109142: NLnet Labs Krill: When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the…

When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity childhandle that the caller put in the parent contact. Nothing checks that this child identity actually...

nsd

NSD The NLnet Labs Name Server Daemon NSD is an authoritative DNS name server. It has been developed for operations in environments where speed, reliability, stability and security are of high importance. If you have any feedback, we would love to hear from you. Don’t hesitate to create an issue ...

CLEANSTART-2024-WF41202 NLnet Labs Unbound, up to and including version 1

Security vulnerability affects the nsd package. NLnet Labs Unbound, up to and including version 1...

CLEANSTART-2026-ZL28860 NLnet Labs Unbound, up to and including version 1

Security vulnerability affects the unbound package. NLnet Labs Unbound, up to and including version 1...

CentOS Linux 7 [TuxCare] Security Update: unbound / unbound-devel / unbound-libs / unbound-python Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792811393)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792811393 advisory. - In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Heap-based Buffer Overflow in NLnet Labs Unbound (CVE-2026-81642, CVE-2026-81634, CVE-2026-82717)

Summary IBM Watson Speech Services Cartridge is vulnerable to a Heap-based Buffer Overflow in NLnet Labs Unbound that could result in remote code execution and DOS conditions. NLnet Labs Unbound is used as part of our Speech microservices. These vulnerabilities have been addressed. Please read th...

AZL-109824 CVE-2026-97206 affecting package unbound 1.26.1-1

NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC DoQ lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the Do...

DEBIAN-CVE-2026-109125

In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-threshold 0' configurations not a default configuration. If a response-like UDP datagram reaches the upstream source port currently used by a recursive query, but i...

UBUNTU-CVE-2026-35501

When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor with a forged NSEC reply with the SOA bit cleared...

CVE-2026-109125

In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-threshold 0' configurations not a default configuration. If a response-like UDP datagram reaches the upstream source port currently used by a recursive query, but i...

CVE-2026-50106

When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name...

PT-2026-120516

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.22.0 through 1.26.1 Description A lifetime bug exists in DNS-over-QUIC DoQ when operating in multi-threaded mode. A remote DoQ client can trigger a QUIC path migration, causing the system to enter stream or...

Linux Distros Unpatched Vulnerability : CVE-2026-97206

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC DoQ lifetime bug reachable by a remote DoQ client under multi-threaded...

Linux Distros Unpatched Vulnerability : CVE-2026-109125

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-threshold 0' configurations...

NLnet Labs Unbound Resource Management Vulnerability

NLnet Labs’ Unbound versions from 1.22.0 to 1.26.1 have a resource management vulnerability. This vulnerability stems from a DNS-over-QUIC DoQ lifecycle flaw. In a multi-threaded environment, remote DoQ clients can trigger QUIC path migration. This allows stream or connection cleanup to occur whi...

AlmaLinux 9.6 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-dracut / etc (ALMALINUX9.6:CLSA-2026:1780479714)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1780479714 advisory. - NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could...

CentOS Linux 7 [TuxCare] Security Update: unbound / unbound-devel / unbound-libs / unbound-python (CENTOS7:CLSA-2025:1765997462)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1765997462 advisory. - NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to...

SUSE CVE-2026-81634

In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a...