CVE-2026-55973

CVE-2026-55973 affects NLnet Labs Unbound 1.23.0 through 1.25.1. When dns-error-reporting: yes is enabled, the EDNS Report-Channel option (code 18) length from the last upstream response is treated as the length of the agent domain. If the agent domain contains garbage after the domain, those byt...

CVE-2026-55717

Vulnerability CVE-2026-55717 affects NLnet Labs Unbound 1.10.0 through 1.25.1. When serve-expired is yes and a response-ip/ RPZ CNAME-based redirect is configured, a remote attacker controlling any delegated zone can crash the daemon. The serve-expired-client-timeout routine chase loop on the res...

CVE-2026-55708

NLnet Labs Unbound v1.6.0–1.25.1 is affected. The vulnerability stems from the view_local_data and view_local_datas commands in unbound-control, which can create a bare local zones tree for an already configured named view when the view starts without local data. The created tree omits default-pr...

CVE-2026-54478

CVE-2026-54478 affects NLnet Labs Unbound 1.18.0–1.25.1 when listening on a proxy-protocol-port with answer-cookie enabled. The RFC 9018 server-cookie (SipHash) is computed over the proxy’s wire address rather than the PROXYv2-declared client, causing a server cookie to validate for every PROXYv2...

CVE-2026-52863

The CVE concerns NLnet Labs Unbound 1.25.0–1.25.1. A fix that enables coexistence of the respip and dns64 modules creates a shallow copy of the view name, which, under pressure when a configured access-control-view is active and subqueries (respip CNAME redirection, dns64, subnetcache) are attach...

CVE-2026-50252

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, the UDP source port is used as a secrecy element to increase DNS transaction entropy. When SO_REUSEPORT is enabled (default) and load balancing depends on the source port and IP address, this secrecy can be undermined. On startup Unbound pa...

CVE-2026-50251

This entry describes a vulnerability in NLnet Labs Unbound (≤ 1.25.1) where enabling unwanted-reply-threshold (>0) allows a malicious delegation returning in-bailiwick glue 0.0.0.0/::0 to cause repeated, seemingly unwanted replies. The mismatch between 0.0.0.0/::0 and the local 127.0.0.1 persp...

CVE-2026-50248

CVE-2026-50248 affects NLnet Labs Unbound 1.7.0 through 1.25.1. When an auth/rpz zone has a configured primary hostname that resolves to a bogus A/AAAA, it can still be treated as a possible XFR endpoint. A malicious actor who can spoof the hostname’s A/AAAA (no valid RRSIG required) may become t...

CVE-2026-50243

CVE-2026-50243 affects NLnet Labs Unbound 1.6.2 up to 1.25.1. When the respip module is placed in front of the validator and used with a response-ip redirect or RPZ-IP trigger, the rewriting handler does not check the upstream answer’s security status and can rewrite a BOGUS A/AAAA reply to an op...

CVE-2026-50046

NLnet Labs Unbound 1.15.0–1.25.1 contains a heap use-after-free in the DoT path. The TLS server name for DoT forwarded queries is tied to a serviced_query object that is also referenced by waiting_tcp. If the owning struct is jostled out of the mesh while DoT TCP handshake is in progress, freeing...

CVE-2026-50045

CVE-2026-50045 affects NLnet Labs Unbound, versions 1.22.0 through 1.25.1. A single client query for a deeply nested name under a DNSSEC-signed parent can cause Unbound to exceed the configured ‘max-global-quota’, effectively bypassing the upstream-traffic amplification limiter. The vulnerability...

CVE-2026-46582

Affected software/versions: NLnet Labs Unbound 1.6.0 up to and including 1.25.1. Issue: a replay of a wildcard RRset as another piece of data can be momentarily treated as DNSSEC secure based on RRSIG validation and cached, then misvalidated on the serve-expired path due to later NSEC validation,...

CVE-2026-44690

The CVE-2026-44690 entry concerns NLnet Labs Unbound versions 1.7.0 through 1.25.1 where insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing enables cache poisoning. A malicious actor controlling a single delegated zone...

CVE-2026-44687

CVE-2026-44687 affects NLnet Labs Unbound releases 1.13.2 through 1.25.1. A bug in the default tallied logic for hardened-below-nxdomain can cause a stub or forward zone to be shadowed by a DNSSEC-secure NXDOMAIN answer at the parent when the query name is an intermediate label below a signed zon...

CVE-2026-44621

The CVE describes a vulnerability in NLnet Labs Unbound up to version 1.25.1 where applications using libunbound and configuring the unwanted-reply-threshold (non-zero) can trigger a fatal exit of libunbound when threshold is exceeded and libworker_alloc_cleanup is not on the function-call allow ...

CVE-2026-42955

NLnet Labs Unbound versions 1.16.2–1.25.1 are affected by CVE-2026-42955, a variant of CVE-2026-40622. An adversary controlling a ghost zone and able to query Unbound can cause the cache to overwrite expired parent-side glue A/AAAA records, extending the ghost domain window by up to one cached TT...

CVE-2026-41637

CVE-2026-41637 affects NLnet Labs Unbound (versions 1.22.0 to 1.25.1). The vulnerability arises when client-terminated DNS-over-QUIC (DoQ) queries are not counted properly, allowing a low-cost inflation of the waiting queue for in-flight queries and causing degradation of resolution service for n...

CVE-2026-40691

In Unbound, versions 1.9.0 through 1.25.1 are affected when handling DNSCrypt queries over TCP. The routine that encrypts the reply in place does not bound the reply length to the destination buffer, because the UDP path’s size clamp is not applied on the TCP path. As a result, a reply larger tha...

CVE-2026-32665

Unbound 1.22.0–1.25.1 with downstream DNS-over-QUIC enabled is vulnerable. The first two QUIC streams on a new connection (streams 0 and 4) bypass the per-stream quic-size gate, causing large input buffers to be allocated after only the 2-byte length prefix. A remote attacker can force Unbound to...

CVE-2026-14586

CVE-2026-14586 affects NLnet Labs Unbound 1.22.0–1.25.1 in DNS-over-QUIC (DoQ) environments under high concurrency. The root cause is an assertion in libngtcp2 related to monotonic timestamps; Unbound used realtime, which can trigger an assertion in libngtcp2 for the QUIC timestamp, potentially t...