Skip to content
OpenAdvisories
High WID-SEC-2026-3392 9 CVEs

Unbound: Mehrere Schwachstellen

Published Sep 15, 2026 · Updated Nov 10, 2026 · Revision 17 · de

Vendor: amazon Vendor: cPanel Vendor: Debian Vendor: Fedora Vendor: IBM Vendor: Oracle Vendor: Red Hat Vendor: RESF Vendor: Securepoint Vendor: SUSE Vendor: Ubuntu Product: cPanel/WHM Product: Enterprise Linux Product: Linux Product: Linux Product: Linux Product: Linux Product: Linux Product: Linux 2 Product: openSUSE Product: QRadar SIEM Product: Rocky Linux Product: UTM Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Unbound ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Speicher zu korrumpieren, einen Denial of Service zu verursachen oder Code auszuführen.

Product

Unbound ist ein validierender, rekursiver DNS-Resolver.

Vulnerabilities 9

  • Critical 9.1
    CVE-2026-81642 Public exploit

    Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY

    In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • High 8.4
    CVE-2026-82717

    CNAME synthesis could lead to heap corruption

    In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis duri…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-81634

    Possible heap buffer overflow during DNSSEC canonicalization

    In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length chec…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux
  • Medium 6.5
    CVE-2026-78227

    Use-after-free in DoQ stream output buffer on reset re-transmission

    NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that holds the DNS response. ngtcp2's retransmission buffer keeps a…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux
  • Medium 5.9
    CVE-2026-82720

    Use-after-free in DoH stream cleanup code path

    NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. During failure code paths (i.e., RPZ drop query, jostle due to heavy traffic), a dropped DoH stream brin…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux
  • Medium 5.3
    CVE-2026-80225

    Possible degradation of service from continuous queries on the same TCP/DoT connection

    In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names o…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux
  • Medium 5.3
    CVE-2026-85501

    Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC

    Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux
  • Medium 4.4
    CVE-2026-77955

    Possible ZONEMD verification bypass window

    In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux
  • Low 3.7
    CVE-2026-77860

    'serve-expired' can bypass Unbound 'wait-limit'

    In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb (…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux

Revision history

  1. #17

    Neue Updates von Ubuntu aufgenommen

  2. #16

    Neue Updates von IBM aufgenommen

  3. #15

    Neue Updates von SUSE aufgenommen

  4. #14

    Neue Updates von Oracle Linux aufgenommen

  5. #13

    Neue Updates von Ubuntu aufgenommen

  6. #12

    Neue Updates von SUSE aufgenommen

  7. #11

    Neue Updates von openSUSE aufgenommen

  8. #10

    Neue Updates von SUSE aufgenommen

  9. #9

    Neue Updates von SUSE aufgenommen

  10. #8

    Neue Updates von Amazon aufgenommen

  11. #7

    Neue Updates von Rocky Enterprise Software Foundation, Oracle Linux und Red Hat aufgenommen

  12. #6

    Neue Updates von Red Hat und Oracle Linux aufgenommen

  13. #5

    Neue Updates von Red Hat und Rocky Enterprise Software Foundation aufgenommen

  14. #4

    Neue Updates von Debian aufgenommen

  15. #3

    Neue Updates von Amazon aufgenommen

  16. #2

    Neue Updates von Fedora aufgenommen

  17. #1

    Initiale Fassung

References