Summary
[1.24.2-20]
- Backport additional fix of locks during initialization
[1.24.2-19]
- Fix CVE-2026-50252: prevent cache poisoning via shared ports
[1.24.2-18]
- Add unit tests for CVE-2026-{44690,55973}
[1.24.2-17]
- Fix CVE-2026-55973: dns-error-reporting stack buffer overflow
[1.24.2-16]
- Fix CVE-2026-44690 - Cross-zone wildcard cache poisoning
[1.24.2-15]
- Fix CVE-2026-42534: Jostle logic bypass degrades resolution performance
[1.24.2-14]
- Fix CVE-2026-41292: DoS via excessive EDNS options
[1.24.2-13]
- Add upstream unit test for CVE-2026-40622
[1.24.2-12]
- Fix CVE-2026-44390: DoS with large RRsets
[1.24.2-11]
- Fix CVE-2026-40622: cache manipulation via 'ghost domain names' attack
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | python3-unbound | 0:1.24.2-7.el10_2.5 |
| Oracle Linux · 10 | unbound | 0:1.24.2-7.el10_2.5 |
| Oracle Linux · 10 | unbound-anchor | 0:1.24.2-7.el10_2.5 |
| Oracle Linux · 10 | unbound-devel | 0:1.24.2-7.el10_2.5 |
| Oracle Linux · 10 | unbound-dracut | 0:1.24.2-7.el10_2.5 |
| Oracle Linux · 10 | unbound-libs | 0:1.24.2-7.el10_2.5 |
| Oracle Linux · 10 | unbound-utils | 0:1.24.2-7.el10_2.5 |
Vulnerabilities 1
-
Medium 5.7
Possible cache poisoning attack by mapping source port population per thread
In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome …