Skip to content
OpenAdvisories
High USN-8946-1 10 CVEs

unbound vulnerabilities

Published Oct 21, 2026 · Updated Oct 21, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Unbound incorrectly handled certain TCP connections.
A remote attacker could possibly use this issue to cause Unbound to consume
resources, leading to a denial of service. This issue only affected Ubuntu
26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS and Ubuntu 20.04 LTS.
(CVE-2026-80225)

It was discovered that Unbound incorrectly handled certain DNS responses. A
remote attacker could possibly use this issue to crash Unbound, resulting
in a denial of service. (CVE-2026-81634)

It was discovered that Unbound incorrectly handled certain DNS responses
during DNSSEC validation. A remote attacker could possibly use this issue
to cause Unbound to consume resources, leading to a denial of service.
(CVE-2026-85501)

It was discovered that Unbound incorrectly handled outgoing network ports.
A remote attacker could possibly use this issue to crash Unbound, resulting
in a denial of service. (CVE-2026-50252)

It was discovered that Unbound incorrectly handled certain DNSCrypt
packets. A remote attacker could possibly use this issue to crash Unbound,
resulting in a denial of service. This issue only affected Ubuntu 26.04
LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS and Ubuntu 18.04
LTS. (CVE-2026-40691)

It was discovered that Unbound incorrectly handled certain cached DNS
responses. A remote attacker could possibly use this issue to poison
Unbound's cache. This issue only affected Ubuntu 26.04 LTS, Ubuntu 24.04
LTS, Ubuntu 22.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-44690)

It was discovered that Unbound incorrectly handled certain DNS-over-QUIC
connections. A remote attacker could possibly use this issue to cause
Unbound to consume resources, leading to a denial of service. This issue
only affected Ubuntu 26.04 LTS. (CVE-2026-32665)

It was discovered that Unbound incorrectly handled certain EDNS options. A
remote attacker could possibly use this issue to crash Unbound, resulting
in a denial of service. This issue only affected Ubuntu 26.04 LTS.
(CVE-2026-55973)

Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered
that Unbound incorrectly handled validating DNSSEC messages. A remote
attacker could possibly use this issue to cause Unbound to consume
resources, leading to a denial of service. This issue only affected Ubuntu
18.04 LTS, Ubuntu 16.04 LTS and Ubuntu 14.04 LTS. (CVE-2023-50387)

It was discovered that Unbound incorrectly handled preparing an NSEC3
closest encloser proof. A remote attacker could possibly use this issue to
cause Unbound to consume resources, leading to a denial of service. This
issue only affected Ubuntu 18.04 LTS, Ubuntu 16.04 LTS and Ubuntu 14.04
LTS. (CVE-2023-50868)

Fixed packages 7

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS unbound 1.13.1-1ubuntu5.17
Ubuntu · 24.04 LTS 24.04:LTS unbound 1.19.2-1ubuntu3.12
Ubuntu · 26.04 LTS 26.04:LTS unbound 1.24.2-1ubuntu2.4
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS unbound 1.4.22-1ubuntu4.14.04.3+esm5
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS unbound 1.5.8-1ubuntu1.1+esm5
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS unbound 1.6.7-1ubuntu2.6+esm6
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS unbound 1.9.4-2ubuntu1.11+esm3

Vulnerabilities 10

  • High 7.5
    CVE-2023-50387 Public exploit EPSS 100%

    Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to …

    bind9 bind9 bind unbound Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2023-50868 Public exploit EPSS 74%

    The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote att…

    bind9 bind9 bind unbound Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-32665

    Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass

    In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streams on a new QUIC connection (stream_id 0 and 4) bypass the per-stream 'quic-size' gate entirely, and large input buffers …

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-40691

    Packet of death for DNSCrypt over TCP

    In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply length against the destination buffer size. The size clamp that protects the UDP path is not applied…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-44690

    Cross-zone wildcard cache poisoning via RRSIG.labels manipulation

    In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a sin…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-55973

    'dns-error-reporting: yes' leads to stack buffer overflow

    In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain nam…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-81634

    Possible heap buffer overflow during DNSSEC canonicalization

    In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length chec…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux
  • Medium 5.7
    CVE-2026-50252

    Possible cache poisoning attack by mapping source port population per thread

    In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome …

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • Medium 5.3
    CVE-2026-80225

    Possible degradation of service from continuous queries on the same TCP/DoT connection

    In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names o…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux
  • Medium 5.3
    CVE-2026-85501

    Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC

    Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux

References

  • report
    https://ubuntu.com/security/CVE-2023-50387
  • report
    https://ubuntu.com/security/CVE-2023-50868
  • report
    https://ubuntu.com/security/CVE-2026-32665
  • report
    https://ubuntu.com/security/CVE-2026-40691
  • report
    https://ubuntu.com/security/CVE-2026-44690
  • report
    https://ubuntu.com/security/CVE-2026-50252
  • report
    https://ubuntu.com/security/CVE-2026-55973
  • report
    https://ubuntu.com/security/CVE-2026-80225
  • report
    https://ubuntu.com/security/CVE-2026-81634
  • report
    https://ubuntu.com/security/CVE-2026-85501