CentOS Linux 7 [TuxCare] Security Update: unbound / unbound-devel / unbound-libs / unbound-python (CENTOS7:CLSA-2025:1765997462)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1765997462 advisory. - NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to...

AlmaLinux 9.6 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-dracut / etc (ALMALINUX9.6:CLSA-2026:1780312843)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1780312843 advisory. - NLnet Labs Unbound up to and including version 1.24.1 is vulnerable to possible domain hijack attacks. Promiscuous NS RRSets that complemen...

AlmaLinux 9.2 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-libs (ALMALINUX9.2:CLSA-2025:1736503760)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1736503760 advisory. - NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs t...

Rocky Linux 9.6 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-dracut / etc (ALMALINUX9.6:CLSA-2026:1780312843)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1780312843 advisory. - NLnet Labs Unbound up to and including version 1.24.1 is vulnerable to possible domain hijack attacks. Promiscuous NS RRSets that...

CentOS Linux 8 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-libs (CENTOS-STREAM8:CLSA-2026:1769424072)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1769424072 advisory. - NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it nee...

EulerOS Virtualization 2.11.1 : unbound (EulerOS-SA-2026-3478)

According to the versions of the unbound packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : DISPUTE NOTE: this issue does not pose a security risk as it according to analysis by the original software developer, NLnet Labs...

CVE-2026-77119 NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets

A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through...

CVE-2026-77119

BIND 9 (ISC) has a DNSSEC NSEC3 insecure-referral proof flaw: a validly signed NSEC3 RRset from an unrelated sibling zone may be accepted as proof of non-existence, downgrading a secure delegation and allowing a forged unsigned answer through. Affected versions are 9.11.0–9.18.50, 9.20.0–9.20.27,...

EulerOS 2.0 SP12 : unbound (EulerOS-SA-2026-3391)

According to the versions of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets that Unbound needs to...

CLSA-2026-1787734642 bind: Fix of 6 CVEs

CVE-2026-11331: return from RPZ wildcard CNAME expansion when the resulting name is too long instead of continuing with an invalid name - CVE-2026-11721: reject RRSIG records whose Labels field is smaller than the signer's label count, and skip out-of-zone nodes in dnssec-signzone -...

EulerOS 2.0 SP13 : unbound (EulerOS-SA-2026-3004)

According to the versions of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets that Unbound needs to...

Oracle Linux 10 : unbound (ELSA-2026-23231)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-23231 advisory. - Fix CVE-2026-42534: Jostle logic bypass degrades resolution performance - Fix CVE-2026-41292: DoS via excessive EDNS options - Add upstream unit te...

unbound security update

1.24.2-15 - Fix CVE-2026-42534: Jostle logic bypass degrades resolution performance 1.24.2-14 - Fix CVE-2026-41292: DoS via excessive EDNS options 1.24.2-13 - Add upstream unit test for CVE-2026-40622 1.24.2-12 - Fix CVE-2026-44390: DoS with large RRsets 1.24.2-11 - Fix CVE-2026-40622: cache...

unbound security update

1.24.2-15 - Fix CVE-2026-42534: Jostle logic bypass degrades resolution performance 1.24.2-14 - Fix CVE-2026-41292: DoS via excessive EDNS options 1.24.2-13 - Add upstream unit test for CVE-2026-40622 1.24.2-12 - Fix CVE-2026-44390: DoS with large RRsets 1.24.2-11 - Fix CVE-2026-40622: cache...

CLSA-2026-1781169600 bind: Fix of CVE-2025-40778

CVE-2025-40778: Tighten restrictions on caching NS RRsets in the authority section require the NS owner name to be an ancestor of the queried name to prevent cache poisoning via spoofed records...

CLSA-2026-1780509244 unbound: Fix of 4 CVEs

CVE-2025-11411: scrub promiscuous NS RRsets from positive answers to prevent a possible domain hijacking attack; add the iter-scrub-promiscuous option default yes and extend the mitigation to YXDOMAIN and non-referral nodata answers...

SUSE CVE-2026-44390

NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets that Unbound needs to perform name compression for. Malicious upstream responses with very large RRsets with records that don't share a suffix above the root can cause Unbound to...

CLSA-2026-1779960466 unbound: Fix of CVE-2026-42960

CVE-2026-42960: fix cache poisoning attack where promiscuous non-NS RRSets with companion glue in the authority section could cause unrelated address records to be cached as a side effect of the query...

CLSA-2026-1779535502 unbound: Fix of CVE-2026-33278

CVE-2026-33278: possible remote code execution during DNSSEC validation via a dangling rrsets pointer in dnsmsgdeepcopyregion exposed by the backported KeyTrap mitigation...

CLSA-2026-1779534149 unbound: Fix of CVE-2026-33278

CVE-2026-33278: use-after-free in DNSSEC validator dnsmsgdeepcopyregion during NSEC3 sub-query suspend/resume; buggy struct-assignment overwrote the destination's freshly-allocated rrsets pointer with the source's pointer, leaving a dangling pointer dereferenced after the source region was freed...