CVE-2026-81642

CVE-2026-81642 — Unbound DNSKEY digest heap overflow tracking site Source for the CVE-2026-81642 patch-status tracker: a single-page site recording which distributions have shipped a fix for the Unbound DNSSEC validator heap overflows and the ReTrap complexity attacks disclosed alongside them...

wirehole

What is this? WireHole is a docker-compose project that combines WireGuard, PiHole, and Unbound to create a full or split-tunnel VPN that is easy to deploy and manage. This setup allows for a VPN with ad-blocking via PiHole and enhanced DNS privacy and caching through Unbound. Author 👤 Devin Stok...

DNS-Poisoning-Triage-Lab

DNS and ARP Traffic Triage Lab An educational packet-analysis and resolver-hardening exercise completed on an Arch Linux workstation. Scope: This repository is a learning project. The included capture is useful for practicing DNS and ARP inspection, but it does not by itself prove a live...

CVE-2026-97206

CVE-2026-97206 — Unbound 1.26.2 security release tracking site Source for the CVE-2026-97206 patch-status tracker: a single-page site recording which distributions have shipped a fix for the five Unbound vulnerabilities closed by the 1.26.2 release, headed by the DNS-over-QUIC use-after-free. Whe...

CVE-2023-50387

Repository based on https://github.com/knqyf263/CVE-2023-50387 with several modifications: Added resolver-fixed, which has an implementation of Unbound where the vulnerability we discussed is fixed. Created scripts for automating the generation of RRSIG keys. To auto-generate configuration files:...

RLSA-2026:97121 Moderate: unbound security, bug fix, and enhancement update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound DNS Cache Poisoning via Promiscuous Additional Section RRSet Acceptance CVE-2026-42960 unbound: Unbound DNSSEC Validator NSEC3 Hash Calculation Limit Bypass via Negative Cach...

unbound security, bug fix, and enhancement update

An update is available for unbound. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The unbound packages provide a validating, recursive, and caching DNS or...

unbound security, bug fix, and enhancement update

An update is available for unbound. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The unbound packages provide a validating, recursive, and caching DNS or DNSS...

RLSA-2026:97497 Moderate: unbound security, bug fix, and enhancement update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound DNS Cache Poisoning via Promiscuous Additional Section RRSet Acceptance CVE-2026-42960 unbound: Unbound DNSSEC Validator NSEC3 Hash Calculation Limit Bypass via Negative Cach...

pfsense-ovpn-learn-cn

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-ovpn-learn-cn pfsense-ovpn-learn-cn Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org openvpn.learn-address.sh interpolates CN into su -m unbound -c "... localdata $CN.$DOMAIN ..."...

Fedora 43 : unbound (2026-ab4f7ff50a)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ab4f7ff50a advisory. Update to 1.26.2 rhbz2558169 Security fixes from the upstream changelog: - Fix CVE-2026-97206, DoQ path-migration can lead to use-after-free on...

dns-honeypot

My First 24 Hours Running a DNS Honeypot As an engineer who spends most of my days knee-deep in observability tooling, I get the occasional idea that I just have to run with. This was one of those experiments: spin up a DNS resolver on a clean IP that nobody advertises, then let the internet talk...

unbound: Unbound: Denial of Service via crafted DNS responses with expired records

A flaw in Unbound allows a remote attacker controlling a delegated domain to trigger a NULL pointer dereference and crash the daemon. Exploitation occurs when serve-expired: yes and specific response-ip or RPZ rules are configured, resulting in a denial of service...

unbound: Unbound DNS Cache Poisoning via Promiscuous Additional Section RRSet Acceptance

A flaw was found in Unbound's handling of DNS reply messages, complementing the earlier CVE-2025-11411 fix. Unbound accepts and caches address records from the additional section of DNS replies when they accompany authority section RRSets other than NS such as MX records. A malicious actor who ca...

unbound: Unbound: Information disclosure via DNSSEC wildcard replay

A flaw was found in Unbound, a Domain Name System DNS resolver. A remote attacker can exploit a vulnerability in how Unbound handles expired DNSSEC DNS Security Extensions records. By injecting a replayed wildcard record set, an attacker can cause Unbound to temporarily consider it secure, leadin...

unbound: Unbound: Denial of Service due to incorrect client reply accounting with specific serve-expired configuration

A Denial of Service DoS flaw exists in Unbound under specific serve-expired and discard-timeout configurations. By sending crafted queries, a remote attacker can exhaust an internal counter, causing the server to drop new legitimate client queries and degrade resolution services...

unbound: NLnet Labs Unbound: Denial of Service via crafted DNS glue records

A flaw was found in Unbound. A remote malicious actor can exploit a vulnerability by controlling a DNS delegation that returns specific glue records. This can cause Unbound to repeatedly clear its DNS caches, leading to a continuous Denial of Service DoS for DNS resolution...

unbound: Unbound: Denial of Service due to 'harden-below-nxdomain' logic bypass

An off-by-one error in Unbound's default harden-below-nxdomain logic can lead to a denial of service. When an intermediate label under a DNSSEC-signed zone is queried, the flaw incorrectly bypasses configured stub or forward zones, disrupting their name resolution...

unbound: Unbound: DNS cache integrity issue

A "ghost domain names" flaw in Unbound allows a remote attacker controlling a domain to manipulate cached DNS records. By extending the lifetime of outdated DNS information, an attacker can cause clients to receive stale or misleading DNS responses...

unbound: Unbound: Denial of Service due to locking inconsistency during RPZ XFR reload

A flaw was found in Unbound. When operating in a multi-threaded configuration with specific Response Policy Zones RPZ using 'rpz-nsip' or 'rpz-nsdname' triggers, a locking inconsistency during an RPZ zone transfer XFR reload can occur. This timing issue may allow an adversary to trigger a heap...