Summary
USN-8946-1 fixed vulnerabilities in Unbound in Ubuntu 26.04 LTS, Ubuntu
24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 LTS, Ubuntu
16.04 LTS, and Ubuntu 14.04 LTS. This update provides the corresponding
update for Ubuntu 26.10.
Original advisory details:
It was discovered that Unbound incorrectly handled certain TCP
connections. A remote attacker could possibly use this issue to cause
Unbound to consume resources, leading to a denial of service. This issue
only affected Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS and
Ubuntu 20.04 LTS. (CVE-2026-80225)
It was discovered that Unbound incorrectly handled certain DNS responses.
A remote attacker could possibly use this issue to crash Unbound,
resulting in a denial of service. (CVE-2026-81634)
It was discovered that Unbound incorrectly handled certain DNS responses
during DNSSEC validation. A remote attacker could possibly use this issue
to cause Unbound to consume resources, leading to a denial of service.
(CVE-2026-85501)
It was discovered that Unbound incorrectly handled outgoing network ports.
A remote attacker could possibly use this issue to crash Unbound, resulting
in a denial of service. (CVE-2026-50252)
It was discovered that Unbound incorrectly handled certain DNSCrypt
packets. A remote attacker could possibly use this issue to crash Unbound,
resulting in a denial of service. This issue only affected Ubuntu 26.04
LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS and Ubuntu 18.04
LTS. (CVE-2026-40691)
It was discovered that Unbound incorrectly handled certain cached DNS
responses. A remote attacker could possibly use this issue to poison
Unbound's cache. This issue only affected Ubuntu 26.04 LTS, Ubuntu 24.04
LTS, Ubuntu 22.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-44690)
It was discovered that Unbound incorrectly handled certain DNS-over-QUIC
connections. A remote attacker could possibly use this issue to cause
Unbound to consume resources, leading to a denial of service. This issue
only affected Ubuntu 26.04 LTS. (CVE-2026-32665)
It was discovered that Unbound incorrectly handled certain EDNS options. A
remote attacker could possibly use this issue to crash Unbound, resulting
in a denial of service. This issue only affected Ubuntu 26.04 LTS.
(CVE-2026-55973)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 26.10 | unbound | 1.25.1-1ubuntu3.1 |
Vulnerabilities 8
-
High 7.5
Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streams on a new QUIC connection (stream_id 0 and 4) bypass the per-stream 'quic-size' gate entirely, and large input buffers …
-
High 7.5
Packet of death for DNSCrypt over TCP
In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply length against the destination buffer size. The size clamp that protects the UDP path is not applied…
-
High 7.5
Cross-zone wildcard cache poisoning via RRSIG.labels manipulation
In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a sin…
-
High 7.5
'dns-error-reporting: yes' leads to stack buffer overflow
In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain nam…
-
High 7.5
Possible heap buffer overflow during DNSSEC canonicalization
In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length chec…
-
Medium 5.7
Possible cache poisoning attack by mapping source port population per thread
In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome …
-
Medium 5.3
Possible degradation of service from continuous queries on the same TCP/DoT connection
In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names o…
-
Medium 5.3
Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC
Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound…
References
-
report
https://ubuntu.com/security/CVE-2026-32665
-
report
https://ubuntu.com/security/CVE-2026-40691
-
report
https://ubuntu.com/security/CVE-2026-44690
-
report
https://ubuntu.com/security/CVE-2026-50252
-
report
https://ubuntu.com/security/CVE-2026-55973
-
report
https://ubuntu.com/security/CVE-2026-80225
-
report
https://ubuntu.com/security/CVE-2026-81634
-
report
https://ubuntu.com/security/CVE-2026-85501