wirehole

What is this? WireHole is a docker-compose project that combines WireGuard, PiHole, and Unbound to create a full or split-tunnel VPN that is easy to deploy and manage. This setup allows for a VPN with ad-blocking via PiHole and enhanced DNS privacy and caching through Unbound. Author 👤 Devin Stok...

pfsense-ovpn-learn-cn

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-ovpn-learn-cn pfsense-ovpn-learn-cn Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org openvpn.learn-address.sh interpolates CN into su -m unbound -c "... localdata $CN.$DOMAIN ..."...

CVE-2023-50387

Repository based on https://github.com/knqyf263/CVE-2023-50387 with several modifications: Added resolver-fixed, which has an implementation of Unbound where the vulnerability we discussed is fixed. Created scripts for automating the generation of RRSIG keys. To auto-generate configuration files:...

DNS-Poisoning-Triage-Lab

DNS and ARP Traffic Triage Lab An educational packet-analysis and resolver-hardening exercise completed on an Arch Linux workstation. Scope: This repository is a learning project. The included capture is useful for practicing DNS and ARP inspection, but it does not by itself prove a live...

CVE-2026-35501 affecting package unbound for versions less than 1.26.2-1

CVE-2026-35501 affecting package unbound for versions less than 1.26.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-96405 affecting package unbound for versions less than 1.26.2-1

CVE-2026-96405 affecting package unbound for versions less than 1.26.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-50106 affecting package unbound for versions less than 1.26.2-1

CVE-2026-50106 affecting package unbound for versions less than 1.26.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-97206 affecting package unbound for versions less than 1.26.2-1

CVE-2026-97206 affecting package unbound for versions less than 1.26.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-109125 affecting package unbound for versions less than 1.26.2-1

CVE-2026-109125 affecting package unbound for versions less than 1.26.2-1. An upgraded version of the package is available that resolves this issue...

CLSA-2026-1792810562 unbound: Fix of 6 CVEs

CVE-2025-5994: do not cache non-ECS answers to ECS queries in the subnet cache Rebirthday attack - CVE-2026-40622: limit the TTL of a higher-trust NS rrset replacing a cached delegation ghost domain - CVE-2026-50106: treat an unsigned parent denial of an island trust anchor as bogus -...

SUSE CVE-2026-35501

When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor with a forged NSEC reply with the SOA bit cleared...

SUSE CVE-2026-50106

When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name...

Medium: unbound

Issue Overview: In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-threshold 0' configurations not a default configuration. If a response-like UDP datagram reaches the upstream source port currently used by a...

SUSE CVE-2026-96405

NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious act...

SUSE CVE-2026-97206

NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC DoQ lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the Do...

SUSE CVE-2026-109125

In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-threshold 0' configurations not a default configuration. If a response-like UDP datagram reaches the upstream source port currently used by a recursive query, but i...

CVE-2026-93640

A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite ZCS allows the Unix zimbra account to access files with root privileges. The passwordless sudo policy permits arbitrary arguments to zmunbound, whose wrapper forwards them to Unbound without...

[SECURITY] [DSA 6581-1] unbound security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6581-1 [email protected] https://www.debian.org/security/ Yves-Alexis Perez October 23, 2026 https://www.debian.org/security/faq -...

CVE-2026-81642

CVE-2026-81642 — Unbound DNSKEY digest heap overflow tracking site Source for the CVE-2026-81642 patch-status tracker: a single-page site recording which distributions have shipped a fix for the Unbound DNSSEC validator heap overflows and the ReTrap complexity attacks disclosed alongside them...

Security Bulletin: Vulnerabilities exists in IBM Cloud Pak for Data System (Yosemite 2.0)

Summary Vulnerabilities identified in IBM Cloud Pak for Data System Yosemite 2.0 have been addressed in version 11.3.1.3-IF7 Vulnerability Details CVEID:CVE-2026-59999 DESCRIPTION: In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did...