OESA-2026-3437 unbound security update

Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most...

OESA-2026-3434 unbound security update

Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most...

CVE-2026-44687

An off-by-one error in Unbound's default harden-below-nxdomain logic can lead to a denial of service. When an intermediate label under a DNSSEC-signed zone is queried, the flaw incorrectly bypasses configured stub or forward zones, disrupting their name resolution. Mitigation Disable the...

Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN

...

unbound: Unbound: Denial of Service due to 'harden-below-nxdomain' logic bypass

An off-by-one error in Unbound's default harden-below-nxdomain logic can lead to a denial of service. When an intermediate label under a DNSSEC-signed zone is queried, the flaw incorrectly bypasses configured stub or forward zones, disrupting their name resolution...

CVE-2026-50046 Possible heap use-after-free in an error path when a DoT forwarded query is jostled out

In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS DoT forwarded queries is tied to a struct's 'servicedquery' lifetime but also referenced by another struct 'waitingtcp'. When the owning struct is jostled out of the mesh while the DoT TCP stream is...

EUVD-2026-47672

In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS DoT forwarded queries is tied to a struct's 'servicedquery' lifetime but also referenced by another struct 'waitingtcp'. When the owning struct is jostled out of the mesh while the DoT TCP stream is...

CVE-2026-44687 Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN

In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed zone could be shadowed by the intermediate label's secure NXDOMAIN answer from the parent. This is caused by an off-by-one error in...

CVE-2026-44687

In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed zone could be shadowed by the intermediate label's secure NXDOMAIN answer from the parent. This is caused by an off-by-one error in...

CVE-2026-44687

CVE-2026-44687 affects NLnet Labs Unbound releases 1.13.2 through 1.25.1. A bug in the default tallied logic for hardened-below-nxdomain can cause a stub or forward zone to be shadowed by a DNSSEC-secure NXDOMAIN answer at the parent when the query name is an intermediate label below a signed zon...