CVE-2026-56444 Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration

In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with 'serve-expired: yes' and 'serve-expired-client-timeout discard-timeout 0' contrary to the suggested values, the discard-timeout branch during the serve expired logic drops an aged client reply without...

CVE-2026-56444

In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with 'serve-expired: yes' and 'serve-expired-client-timeout discard-timeout 0' contrary to the suggested values, the discard-timeout branch during the serve expired logic drops an aged client reply without...

CVE-2026-55717 'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash

In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: redirect' /'response-ip-data: CNAME ' rule or the RPZ 'rpz-cname-override' equivalent, a remote client who controls any delegated domain can crash the daemon. The...

CVE-2026-55717 'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash

In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: redirect' /'response-ip-data: CNAME ' rule or the RPZ 'rpz-cname-override' equivalent, a remote client who controls any delegated domain can crash the daemon. The...

CVE-2026-55717

Vulnerability CVE-2026-55717 affects NLnet Labs Unbound 1.10.0 through 1.25.1. When serve-expired is yes and a response-ip/ RPZ CNAME-based redirect is configured, a remote attacker controlling any delegated zone can crash the daemon. The serve-expired-client-timeout routine chase loop on the res...

CVE-2026-55717

In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: redirect' /'response-ip-data: CNAME ' rule or the RPZ 'rpz-cname-override' equivalent, a remote client who controls any delegated domain can crash the daemon. The...

CVE-2026-55717

In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: redirect' /'response-ip-data: CNAME ' rule or the RPZ 'rpz-cname-override' equivalent, a remote client who controls any delegated domain can crash the daemon. The...

CVE-2026-55717

In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: redirect' /'response-ip-data: CNAME ' rule or the RPZ 'rpz-cname-override' equivalent, a remote client who controls any delegated domain can crash the daemon. The...

EUVD-2026-47680

In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: redirect' /'response-ip-data: CNAME ' rule or the RPZ 'rpz-cname-override' equivalent, a remote client who controls any delegated domain can crash the daemon. The...

CVE-2026-46582 A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path

In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache, before later validation treats it as bogus based on NSEC validation. When the resolvin...

CVE-2026-46582

Affected software/versions: NLnet Labs Unbound 1.6.0 up to and including 1.25.1. Issue: a replay of a wildcard RRset as another piece of data can be momentarily treated as DNSSEC secure based on RRSIG validation and cached, then misvalidated on the serve-expired path due to later NSEC validation,...

EUVD-2026-47670

In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache, before later validation treats it as bogus based on NSEC validation. When the resolvin...

CVE-2026-46582 A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path

In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache, before later validation treats it as bogus based on NSEC validation. When the resolvin...

CVE-2026-46582

In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache, before later validation treats it as bogus based on NSEC validation. When the resolvin...

PT-2026-63388

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.10.0 through 1.25.1 Description A remote client controlling a delegated domain can cause the daemon to crash, leading to a denial of service. This occurs when the serve-expired: yes setting is enabled alongside a...

PT-2026-63393

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.20.0 through 1.25.1 Description An issue exists when the software is configured with serve-expired: yes and serve-expired-client-timeout is greater than discard-timeout where discard-timeout is greater than 0. In...

GHSA-3JXR-9VMJ-R5CP vulnerabilities

Vulnerabilities for packages: sqlpad, pulumi, saf, prism, opensearch-dashboards, serve, langfuse, nextcloud-server, rancher-api-ui, thingsboard, ts-patch, lerna, jupyter-base-notebook, renovate...

CVE-2026-13149 vulnerabilities

Vulnerabilities for packages: sqlpad, pulumi, saf, prism, opensearch-dashboards, serve, langfuse, nextcloud-server, rancher-api-ui, thingsboard, ts-patch, lerna, jupyter-base-notebook, renovate...

Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)

The same as the hono core Path traversal in serve-static on Windows via encoded backslash %5C. Summary On Windows hosts, an encoded backslash %5C in the request path decodes to , which the Windows path resolver treats as a separator. serve-static then resolves a single URL segment such as...

GHSA-FRVP-7C67-39W9 Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)

The same as the hono core Path traversal in serve-static on Windows via encoded backslash %5C. Summary On Windows hosts, an encoded backslash %5C in the request path decodes to , which the Windows path resolver treats as a separator. serve-static then resolves a single URL segment such as...