https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T04:30:40.717788+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:23231 ALSA-2026:23231 — Important: unbound security update 2026-10-04T04:30:41.080615+00:00

Affected: AlmaLinux:10: python3-unbound, AlmaLinux:10: unbound, AlmaLinux:10: unbound-anchor, AlmaLinux:10: unbound-devel, AlmaLinux:10: unbound-dracut, AlmaLinux:10: unbound-libs, AlmaLinux:10: unbound-utils

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

* unbound: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (CVE-2026-42944) * unbound: Unbound DNSSEC Validator Denial of Service via Incorrect Write Offset Counter in Chase-Reply Messages (CVE-2026-42959) * unbound: Unbound DNSSEC Validator Use-After-Free via Deep Copy Pointer Overwrite Leading to DoS and Possible Remote Code Execution (CVE-2026-33278)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2026-11016 bdu:2026-11016 2026-10-04T04:30:41.080699+00:00 bdu:2026-11016 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1111 certfr-2026-avi-1111 — De multiples vulnérabilités ont été découvertes dans les produits F5. Certaines d'entre elles permettent à un attaquant… 2026-10-04T04:30:41.080718+00:00 certfr-2026-avi-1111 https://cve.radiocsirt.org/vuln/euvd-2026-362288 EUVD-2026-362288 2026-10-04T04:30:41.080735+00:00 EUVD-2026-362288 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33278 fkie_cve-2026-33278 2026-10-04T04:30:41.080747+00:00

NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code execution as a result of deep copying a data structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-copies response messages to preserve them across memory region teardown. A struct-assignment bug overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep copying the data structure.

 https://cve.radiocsirt.org/vuln/ghsa-m234-r435-cxjw GHSA-m234-r435-cxjw 2026-10-04T04:30:41.080777+00:00

NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code execution as a result of deep copying a data structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-copies response messages to preserve them across memory region teardown. A struct-assignment bug overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep copying the data structure.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-33278 msrc_CVE-2026-33278 — Possible arbitrary code execution during DNSSEC validation 2026-10-04T04:30:41.080798+00:00 msrc_CVE-2026-33278 https://cve.radiocsirt.org/vuln/oesa-2026-2522 OESA-2026-2522 — unbound security update 2026-10-04T04:30:41.080814+00:00

Affected: openEuler:24.03-LTS-SP1: unbound

Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn't make custom builds or provide specific features to paying customers only. Security Fix(es):

NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code execution as a result of deep copying a data structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-copies response messages to preserve them across memory region teardown. A struct-assignment bug overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10903-1 openSUSE-SU-2026:10903-1 — libunbound8-1.25.1-1.1 on GA media 2026-10-04T04:30:41.080864+00:00

libunbound8-1.25.1-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:19752 RHSA-2026:19752 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update 2026-10-04T04:30:41.080890+00:00

unbound: Unbound DNSSEC Validator Use-After-Free via Deep Copy Pointer Overwrite Leading to DoS and Possible Remote Code Execution unbound: Heap overflow and crash with multiple nsid, cookie, padding EDNS options unbound: Unbound DNSSEC Validator Denial of Service via Incorrect Write Offset Counter in Chase-Reply Messages unbound: Unbound: Denial of Service due to locking inconsistency during RPZ XFR reload

 https://cve.radiocsirt.org/vuln/rlsa-2026:23231 RLSA-2026:23231 — Important: unbound security update 2026-10-04T04:30:41.080913+00:00

Affected: Rocky Linux:10: unbound

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

* unbound: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (CVE-2026-42944)

* unbound: Unbound DNSSEC Validator Denial of Service via Incorrect Write Offset Counter in Chase-Reply Messages (CVE-2026-42959)

* unbound: Unbound DNSSEC Validator Use-After-Free via Deep Copy Pointer Overwrite Leading to DoS and Possible Remote Code Execution (CVE-2026-33278)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/suse-su-2026:21874-1 SUSE-SU-2026:21874-1 — Security update for unbound 2026-10-04T04:30:41.080939+00:00

Security update for unbound

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-33278 UBUNTU-CVE-2026-33278 2026-10-04T04:30:41.080961+00:00

Affected: Ubuntu:24.04:LTS: unbound, Ubuntu:25.10: unbound, Ubuntu:26.04:LTS: unbound

NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code execution as a result of deep copying a data structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-copies response messages to preserve them across memory region teardown. A struct-assignment bug overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep copying the data structure.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1599 WID-SEC-W-2026-1599 — Unbound: Mehrere Schwachstellen 2026-10-04T04:30:41.080989+00:00

Ein Angreifer kann mehrere Schwachstellen in Unbound ausnutzen, um einen Denial of Service Zustand herbeizuführen, um möglicherweise Code auszuführen und um nicht näher spezifizierte Auswirkungen zu verursachen.