https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T18:42:55.886342+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:55841 ALSA-2026:55841 — Important: unbound security update 2026-10-02T18:42:56.078552+00:00

Affected: AlmaLinux:9: python3-unbound, AlmaLinux:9: unbound, AlmaLinux:9: unbound-devel, AlmaLinux:9: unbound-dracut, AlmaLinux:9: unbound-libs

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

* unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes (CVE-2026-44690) * unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option (CVE-2026-55973)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/euvd-2026-339353 EUVD-2026-339353 2026-10-02T18:42:56.078623+00:00 EUVD-2026-339353 https://cve.radiocsirt.org/vuln/fkie_cve-2026-55973 fkie_cve-2026-55973 2026-10-02T18:42:56.078639+00:00

In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain, the returned lenght is not used and if the agent domain is followed by garbage, those bytes are moved onto the tail of the synthetic '_er.' report query name. That query name is later used in the iterator via a subquery to send out the DNS Error Report and when Unbound tries to walk that query name during 'find_closest_of_type()', it strips labels using the query name length rather than stopping at the embedded root, walks one byte past it, and feeds the first garbage byte to 'dname_query_hash()' as a label length writing over the stack variable 'labuf'. One ordinary upstream response from a delegated zone the attacker controls is sufficient to terminate the daemon.

 https://cve.radiocsirt.org/vuln/ghsa-g479-fg97-pf5w GHSA-g479-fg97-pf5w 2026-10-02T18:42:56.078669+00:00

In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain, the returned lenght is not used and if the agent domain is followed by garbage, those bytes are moved onto the tail of the synthetic '_er.' report query name. That query name is later used in the iterator via a subquery to send out the DNS Error Report and when Unbound tries to walk that query name during 'find_closest_of_type()', it strips labels using the query name length rather than stopping at the embedded root, walks one byte past it, and feeds the first garbage byte to 'dname_query_hash()' as a label length writing over the stack variable 'labuf'. One ordinary upstream response from a delegated zone the attacker controls is sufficient to terminate the daemon.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-55973 msrc_CVE-2026-55973 — 'dns-error-reporting: yes' leads to stack buffer overflow 2026-10-02T18:42:56.078704+00:00 msrc_CVE-2026-55973 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11380-1 openSUSE-SU-2026:11380-1 — libunbound8-1.25.2-1.1 on GA media 2026-10-02T18:42:56.078722+00:00

libunbound8-1.25.2-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:43588 RHSA-2026:43588 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update 2026-10-02T18:42:56.078750+00:00

unbound: Unbound: Denial of Service via assertion failure in DNS-over-QUIC environments unbound: Unbound: Denial of Service via improper validation of DNS-over-QUIC client length unbound: Unbound: Denial of Service via crafted DNSCrypt query unbound: Unbound: Denial of Service via terminated DNS-over-QUIC queries unbound: Unbound: DNS cache integrity issue unbound: Unbound: Denial of Service due to 'harden-below-nxdomain' logic bypass unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes unbound: Unbound: Information disclosure via DNSSEC wildcard replay unbound: Unbound: Denial of Service via DNSSEC query amplification bypass unbound: Unbound: Denial of Service due to freed pointer dereference in DNS-over-TLS handling unbound: Unbound: Insecure DNS redirection via spoofed DNS answers unbound: Unbound: DNS response policy replacement via hostname spoofing unbound: NLnet Labs Unbound: Denial of Service via crafted DNS glue records unbound: Unbound: DNS cache poisoning via UDP source port predictability unbound: Unbound: Denial of service due to memory corruption under specific configurations. unbound: Unbound: DNS Cookie security bypass via incorrect server cookie calculation unbound: Unbound: Information disclosure due to local policy bypass via unbound-control unbound: Unbound: Denial of Service via crafted DNS responses with expired records unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option unbound:…

 https://cve.radiocsirt.org/vuln/rlsa-2026:55841 RLSA-2026:55841 — Important: unbound security update 2026-10-02T18:42:56.078805+00:00

Affected: Rocky Linux:9: unbound

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

* unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes (CVE-2026-44690)

* unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option (CVE-2026-55973)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/suse-su-2026:23050-1 SUSE-SU-2026:23050-1 — Security update for unbound 2026-10-02T18:42:56.078830+00:00

Security update for unbound

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-55973 UBUNTU-CVE-2026-55973 2026-10-02T18:42:56.078853+00:00

Affected: Ubuntu:Pro:14.04:LTS: unbound, Ubuntu:Pro:16.04:LTS: unbound, Ubuntu:Pro:18.04:LTS: unbound, Ubuntu:Pro:20.04:LTS: unbound, Ubuntu:22.04:LTS: unbound, Ubuntu:24.04:LTS: unbound, Ubuntu:26.04:LTS: unbound

In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain, the returned lenght is not used and if the agent domain is followed by garbage, those bytes are moved onto the tail of the synthetic '_er.' report query name. That query name is later used in the iterator via a subquery to send out the DNS Error Report and when Unbound tries to walk that query name during 'find_closest_of_type()', it strips labels using the query name length rather than stopping at the embedded root, walks one byte past it, and feeds the first garbage byte to 'dname_query_hash()' as a label length writing over the stack variable 'labuf'. One ordinary upstream response from a delegated zone the attacker controls is sufficient to terminate the daemon.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2492 WID-SEC-W-2026-2492 — Unbound: Mehrere Schwachstellen 2026-10-02T18:42:56.078886+00:00

Ein Angreifer kann mehrere Schwachstellen in Unbound ausnutzen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Daten zu manipulieren, und um Sicherheitsvorkehrungen zu umgehen.