https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 02:48:13 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:55841 <p><strong>Affected:</strong> AlmaLinux:9: python3-unbound, AlmaLinux:9: unbound, AlmaLinux:9: unbound-devel, AlmaLinux:9: unbound-dracut, AlmaLinux:9: unbound-libs</p> <p>The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.</p> <p>Security Fix(es):</p> <p>* unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes (CVE-2026-44690) * unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option (CVE-2026-55973)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:9: python3-unbound, AlmaLinux:9: unbound, AlmaLinux:9: unbound-devel, AlmaLinux:9: unbound-dracut, AlmaLinux:9: unbound-libs</p> <p>The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.</p> <p>Security Fix(es):</p> <p>* unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes (CVE-2026-44690) * unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option (CVE-2026-55973)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2026:55841 https://cve.radiocsirt.org/vuln/euvd-2026-339353 EUVD-2026-339353 https://cve.radiocsirt.org/vuln/euvd-2026-339353 https://cve.radiocsirt.org/vuln/fkie_cve-2026-55973 <p>In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when &#39;dns-error-reporting: yes&#39; is set, the EDNS Report-Channel option (code 18) from the last upstream response is read and uses the option&#39;s length as the length of the agent domain. When a domain name check is performed on the agent domain, the returned lenght is not used and if the agent domain is followed by garbage, those bytes are moved onto the tail of the synthetic &#39;_er.&#39; report query name. That query name is later used in the iterator via a subquery to send out the DNS Error Report and when Unbound tries to walk that query name during &#39;find_closest_of_type()&#39;, it strips labels using the query name length rather than stopping at the embedded root, walks one byte past it, and feeds the first garbage byte to &#39;dname_query_hash()&#39; as a label length writing over the stack variable &#39;labuf&#39;. One ordinary upstream response from a delegated zone the attacker controls is sufficient to terminate the daemon.</p> <p>In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when &#39;dns-error-reporting: yes&#39; is set, the EDNS Report-Channel option (code 18) from the last upstream response is read and uses the option&#39;s length as the length of the agent domain. When a domain name check is performed on the agent domain, the returned lenght is not used and if the agent domain is followed by garbage, those bytes are moved onto the tail of the synthetic &#39;_er.&#39; report query name. That query name is later used in the iterator via a subquery to send out the DNS Error Report and when Unbound tries to walk that query name during &#39;find_closest_of_type()&#39;, it strips labels using the query name length rather than stopping at the embedded root, walks one byte past it, and feeds the first garbage byte to &#39;dname_query_hash()&#39; as a label length writing over the stack variable &#39;labuf&#39;. One ordinary upstream response from a delegated zone the attacker controls is sufficient to terminate the daemon.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-55973 https://cve.radiocsirt.org/vuln/ghsa-g479-fg97-pf5w <p>In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when &#39;dns-error-reporting: yes&#39; is set, the EDNS Report-Channel option (code 18) from the last upstream response is read and uses the option&#39;s length as the length of the agent domain. When a domain name check is performed on the agent domain, the returned lenght is not used and if the agent domain is followed by garbage, those bytes are moved onto the tail of the synthetic &#39;_er.&#39; report query name. That query name is later used in the iterator via a subquery to send out the DNS Error Report and when Unbound tries to walk that query name during &#39;find_closest_of_type()&#39;, it strips labels using the query name length rather than stopping at the embedded root, walks one byte past it, and feeds the first garbage byte to &#39;dname_query_hash()&#39; as a label length writing over the stack variable &#39;labuf&#39;. One ordinary upstream response from a delegated zone the attacker controls is sufficient to terminate the daemon.</p> <p>In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when &#39;dns-error-reporting: yes&#39; is set, the EDNS Report-Channel option (code 18) from the last upstream response is read and uses the option&#39;s length as the length of the agent domain. When a domain name check is performed on the agent domain, the returned lenght is not used and if the agent domain is followed by garbage, those bytes are moved onto the tail of the synthetic &#39;_er.&#39; report query name. That query name is later used in the iterator via a subquery to send out the DNS Error Report and when Unbound tries to walk that query name during &#39;find_closest_of_type()&#39;, it strips labels using the query name length rather than stopping at the embedded root, walks one byte past it, and feeds the first garbage byte to &#39;dname_query_hash()&#39; as a label length writing over the stack variable &#39;labuf&#39;. One ordinary upstream response from a delegated zone the attacker controls is sufficient to terminate the daemon.</p> https://cve.radiocsirt.org/vuln/ghsa-g479-fg97-pf5w https://cve.radiocsirt.org/vuln/msrc_cve-2026-55973 msrc_CVE-2026-55973 https://cve.radiocsirt.org/vuln/msrc_cve-2026-55973 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11380-1 <p>libunbound8-1.25.2-1.1 on GA media</p> <p>libunbound8-1.25.2-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11380-1 https://cve.radiocsirt.org/vuln/rhsa-2026:43588 <p>unbound: Unbound: Denial of Service via assertion failure in DNS-over-QUIC environments unbound: Unbound: Denial of Service via improper validation of DNS-over-QUIC client length unbound: Unbound: Denial of Service via crafted DNSCrypt query unbound: Unbound: Denial of Service via terminated DNS-over-QUIC queries unbound: Unbound: DNS cache integrity issue unbound: Unbound: Denial of Service due to &#39;harden-below-nxdomain&#39; logic bypass unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes unbound: Unbound: Information disclosure via DNSSEC wildcard replay unbound: Unbound: Denial of Service via DNSSEC query amplification bypass unbound: Unbound: Denial of Service due to freed pointer dereference in DNS-over-TLS handling unbound: Unbound: Insecure DNS redirection via spoofed DNS answers unbound: Unbound: DNS response policy replacement via hostname spoofing unbound: NLnet Labs Unbound: Denial of Service via crafted DNS glue records unbound: Unbound: DNS cache poisoning via UDP source port predictability unbound: Unbound: Denial of service due to memory corruption under specific configurations. unbound: Unbound: DNS Cookie security bypass via incorrect server cookie calculation unbound: Unbound: Information disclosure due to local policy bypass via unbound-control unbound: Unbound: Denial of Service via crafted DNS responses with expired records unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option unbound:…</p> <p>unbound: Unbound: Denial of Service via assertion failure in DNS-over-QUIC environments unbound: Unbound: Denial of Service via improper validation of DNS-over-QUIC client length unbound: Unbound: Denial of Service via crafted DNSCrypt query unbound: Unbound: Denial of Service via terminated DNS-over-QUIC queries unbound: Unbound: DNS cache integrity issue unbound: Unbound: Denial of Service due to &#39;harden-below-nxdomain&#39; logic bypass unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes unbound: Unbound: Information disclosure via DNSSEC wildcard replay unbound: Unbound: Denial of Service via DNSSEC query amplification bypass unbound: Unbound: Denial of Service due to freed pointer dereference in DNS-over-TLS handling unbound: Unbound: Insecure DNS redirection via spoofed DNS answers unbound: Unbound: DNS response policy replacement via hostname spoofing unbound: NLnet Labs Unbound: Denial of Service via crafted DNS glue records unbound: Unbound: DNS cache poisoning via UDP source port predictability unbound: Unbound: Denial of service due to memory corruption under specific configurations. unbound: Unbound: DNS Cookie security bypass via incorrect server cookie calculation unbound: Unbound: Information disclosure due to local policy bypass via unbound-control unbound: Unbound: Denial of Service via crafted DNS responses with expired records unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option unbound:…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:43588 https://cve.radiocsirt.org/vuln/rlsa-2026:55841 <p><strong>Affected:</strong> Rocky Linux:9: unbound</p> <p>The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.</p> <p>Security Fix(es):</p> <p>* unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes (CVE-2026-44690)</p> <p>* unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option (CVE-2026-55973)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> Rocky Linux:9: unbound</p> <p>The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.</p> <p>Security Fix(es):</p> <p>* unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes (CVE-2026-44690)</p> <p>* unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option (CVE-2026-55973)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/rlsa-2026:55841 https://cve.radiocsirt.org/vuln/suse-su-2026:23050-1 <p>Security update for unbound</p> <p>Security update for unbound</p> https://cve.radiocsirt.org/vuln/suse-su-2026:23050-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-55973 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: unbound, Ubuntu:Pro:16.04:LTS: unbound, Ubuntu:Pro:18.04:LTS: unbound, Ubuntu:Pro:20.04:LTS: unbound, Ubuntu:22.04:LTS: unbound, Ubuntu:24.04:LTS: unbound, Ubuntu:26.04:LTS: unbound</p> <p>In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when &#39;dns-error-reporting: yes&#39; is set, the EDNS Report-Channel option (code 18) from the last upstream response is read and uses the option&#39;s length as the length of the agent domain. When a domain name check is performed on the agent domain, the returned lenght is not used and if the agent domain is followed by garbage, those bytes are moved onto the tail of the synthetic &#39;_er.&#39; report query name. That query name is later used in the iterator via a subquery to send out the DNS Error Report and when Unbound tries to walk that query name during &#39;find_closest_of_type()&#39;, it strips labels using the query name length rather than stopping at the embedded root, walks one byte past it, and feeds the first garbage byte to &#39;dname_query_hash()&#39; as a label length writing over the stack variable &#39;labuf&#39;. One ordinary upstream response from a delegated zone the attacker controls is sufficient to terminate the daemon.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: unbound, Ubuntu:Pro:16.04:LTS: unbound, Ubuntu:Pro:18.04:LTS: unbound, Ubuntu:Pro:20.04:LTS: unbound, Ubuntu:22.04:LTS: unbound, Ubuntu:24.04:LTS: unbound, Ubuntu:26.04:LTS: unbound</p> <p>In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when &#39;dns-error-reporting: yes&#39; is set, the EDNS Report-Channel option (code 18) from the last upstream response is read and uses the option&#39;s length as the length of the agent domain. When a domain name check is performed on the agent domain, the returned lenght is not used and if the agent domain is followed by garbage, those bytes are moved onto the tail of the synthetic &#39;_er.&#39; report query name. That query name is later used in the iterator via a subquery to send out the DNS Error Report and when Unbound tries to walk that query name during &#39;find_closest_of_type()&#39;, it strips labels using the query name length rather than stopping at the embedded root, walks one byte past it, and feeds the first garbage byte to &#39;dname_query_hash()&#39; as a label length writing over the stack variable &#39;labuf&#39;. One ordinary upstream response from a delegated zone the attacker controls is sufficient to terminate the daemon.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-55973 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2492 <p>Ein Angreifer kann mehrere Schwachstellen in Unbound ausnutzen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Daten zu manipulieren, und um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Unbound ausnutzen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Daten zu manipulieren, und um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2492