https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 19:51:39 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-339344 EUVD-2026-339344 https://cve.radiocsirt.org/vuln/euvd-2026-339344 https://cve.radiocsirt.org/vuln/fkie_cve-2026-56444 <p>In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with &#39;serve-expired: yes&#39; and &#39;serve-expired-client-timeout &gt; discard-timeout &gt; 0&#39; (contrary to the suggested values), the discard-timeout branch during the serve expired logic drops an aged client reply without performing the correct accounting for the number of reply addresses for the query. Other identical branches outside of serve expired perform the correct decrement. Since the counter is never decremented in such scenario, it can reach the maximum limit and new clients for duplicate in-flight queries are silently dropped resulting in degradation of resolution service. A malicious actor can exploit the vulnerability by querying the resolver for a client-controlled slow-on-demand authoritative zone that can drive the counter past the threshold. Shipped defaults for &#39;serve-expired-client-timeout: 1800&#39; and &#39;discard-timeout: 1900&#39; make the branch unreachable.</p> <p>In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with &#39;serve-expired: yes&#39; and &#39;serve-expired-client-timeout &gt; discard-timeout &gt; 0&#39; (contrary to the suggested values), the discard-timeout branch during the serve expired logic drops an aged client reply without performing the correct accounting for the number of reply addresses for the query. Other identical branches outside of serve expired perform the correct decrement. Since the counter is never decremented in such scenario, it can reach the maximum limit and new clients for duplicate in-flight queries are silently dropped resulting in degradation of resolution service. A malicious actor can exploit the vulnerability by querying the resolver for a client-controlled slow-on-demand authoritative zone that can drive the counter past the threshold. Shipped defaults for &#39;serve-expired-client-timeout: 1800&#39; and &#39;discard-timeout: 1900&#39; make the branch unreachable.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-56444 https://cve.radiocsirt.org/vuln/ghsa-x9gf-4mqv-47hw <p>In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with &#39;serve-expired: yes&#39; and &#39;serve-expired-client-timeout &gt; discard-timeout &gt; 0&#39; (contrary to the suggested values), the discard-timeout branch during the serve expired logic drops an aged client reply without performing the correct accounting for the number of reply addresses for the query. Other identical branches outside of serve expired perform the correct decrement. Since the counter is never decremented in such scenario, it can reach the maximum limit and new clients for duplicate in-flight queries are silently dropped resulting in degradation of resolution service. A malicious actor can exploit the vulnerability by querying the resolver for a client-controlled slow-on-demand authoritative zone that can drive the counter past the threshold. Shipped defaults for &#39;serve-expired-client-timeout: 1800&#39; and &#39;discard-timeout: 1900&#39; make the branch unreachable.</p> <p>In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with &#39;serve-expired: yes&#39; and &#39;serve-expired-client-timeout &gt; discard-timeout &gt; 0&#39; (contrary to the suggested values), the discard-timeout branch during the serve expired logic drops an aged client reply without performing the correct accounting for the number of reply addresses for the query. Other identical branches outside of serve expired perform the correct decrement. Since the counter is never decremented in such scenario, it can reach the maximum limit and new clients for duplicate in-flight queries are silently dropped resulting in degradation of resolution service. A malicious actor can exploit the vulnerability by querying the resolver for a client-controlled slow-on-demand authoritative zone that can drive the counter past the threshold. Shipped defaults for &#39;serve-expired-client-timeout: 1800&#39; and &#39;discard-timeout: 1900&#39; make the branch unreachable.</p> https://cve.radiocsirt.org/vuln/ghsa-x9gf-4mqv-47hw https://cve.radiocsirt.org/vuln/msrc_cve-2026-56444 msrc_CVE-2026-56444 https://cve.radiocsirt.org/vuln/msrc_cve-2026-56444 https://cve.radiocsirt.org/vuln/oesa-2026-3434 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: unbound</p> <p>Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn&amp;amp;apos;t make custom builds or provide specific features to paying customers only. Security Fix(es):</p> <p>In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the &amp;apos;ghost domain names&amp;apos; family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other &amp;apos;ghost domain names&amp;apos; attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client A/AAAA query can cause Unbound to overwrite the cached expired parent-side glue rrset and essentially extend the ghost domain window by up to one cached TTL configured value (&amp;apos;cache-max-ttl&amp;apos;). In configurations where &amp;apos;harden-referral-path: yes&amp;apos; is used (non-default configuration), no client query is required since Unbound implicitly performs that query. This is a variant of CVE-2026-40622 which only addressed the NS query.(CVE-2026-42955)</p> <p>In NLnet Labs Unbound…</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: unbound</p> <p>Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn&amp;amp;apos;t make custom builds or provide specific features to paying customers only. Security Fix(es):</p> <p>In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the &amp;apos;ghost domain names&amp;apos; family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other &amp;apos;ghost domain names&amp;apos; attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client A/AAAA query can cause Unbound to overwrite the cached expired parent-side glue rrset and essentially extend the ghost domain window by up to one cached TTL configured value (&amp;apos;cache-max-ttl&amp;apos;). In configurations where &amp;apos;harden-referral-path: yes&amp;apos; is used (non-default configuration), no client query is required since Unbound implicitly performs that query. This is a variant of CVE-2026-40622 which only addressed the NS query.(CVE-2026-42955)</p> <p>In NLnet Labs Unbound…</p> https://cve.radiocsirt.org/vuln/oesa-2026-3434 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11380-1 <p>libunbound8-1.25.2-1.1 on GA media</p> <p>libunbound8-1.25.2-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11380-1 https://cve.radiocsirt.org/vuln/rhsa-2026:43588 <p>unbound: Unbound: Denial of Service via assertion failure in DNS-over-QUIC environments unbound: Unbound: Denial of Service via improper validation of DNS-over-QUIC client length unbound: Unbound: Denial of Service via crafted DNSCrypt query unbound: Unbound: Denial of Service via terminated DNS-over-QUIC queries unbound: Unbound: DNS cache integrity issue unbound: Unbound: Denial of Service due to &#39;harden-below-nxdomain&#39; logic bypass unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes unbound: Unbound: Information disclosure via DNSSEC wildcard replay unbound: Unbound: Denial of Service via DNSSEC query amplification bypass unbound: Unbound: Denial of Service due to freed pointer dereference in DNS-over-TLS handling unbound: Unbound: Insecure DNS redirection via spoofed DNS answers unbound: Unbound: DNS response policy replacement via hostname spoofing unbound: NLnet Labs Unbound: Denial of Service via crafted DNS glue records unbound: Unbound: DNS cache poisoning via UDP source port predictability unbound: Unbound: Denial of service due to memory corruption under specific configurations. unbound: Unbound: DNS Cookie security bypass via incorrect server cookie calculation unbound: Unbound: Information disclosure due to local policy bypass via unbound-control unbound: Unbound: Denial of Service via crafted DNS responses with expired records unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option unbound:…</p> <p>unbound: Unbound: Denial of Service via assertion failure in DNS-over-QUIC environments unbound: Unbound: Denial of Service via improper validation of DNS-over-QUIC client length unbound: Unbound: Denial of Service via crafted DNSCrypt query unbound: Unbound: Denial of Service via terminated DNS-over-QUIC queries unbound: Unbound: DNS cache integrity issue unbound: Unbound: Denial of Service due to &#39;harden-below-nxdomain&#39; logic bypass unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes unbound: Unbound: Information disclosure via DNSSEC wildcard replay unbound: Unbound: Denial of Service via DNSSEC query amplification bypass unbound: Unbound: Denial of Service due to freed pointer dereference in DNS-over-TLS handling unbound: Unbound: Insecure DNS redirection via spoofed DNS answers unbound: Unbound: DNS response policy replacement via hostname spoofing unbound: NLnet Labs Unbound: Denial of Service via crafted DNS glue records unbound: Unbound: DNS cache poisoning via UDP source port predictability unbound: Unbound: Denial of service due to memory corruption under specific configurations. unbound: Unbound: DNS Cookie security bypass via incorrect server cookie calculation unbound: Unbound: Information disclosure due to local policy bypass via unbound-control unbound: Unbound: Denial of Service via crafted DNS responses with expired records unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option unbound:…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:43588 https://cve.radiocsirt.org/vuln/suse-su-2026:23050-1 <p>Security update for unbound</p> <p>Security update for unbound</p> https://cve.radiocsirt.org/vuln/suse-su-2026:23050-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-56444 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: unbound, Ubuntu:Pro:16.04:LTS: unbound, Ubuntu:Pro:18.04:LTS: unbound, Ubuntu:Pro:20.04:LTS: unbound, Ubuntu:22.04:LTS: unbound, Ubuntu:24.04:LTS: unbound, Ubuntu:26.04:LTS: unbound</p> <p>In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with &#39;serve-expired: yes&#39; and &#39;serve-expired-client-timeout &gt; discard-timeout &gt; 0&#39; (contrary to the suggested values), the discard-timeout branch during the serve expired logic drops an aged client reply without performing the correct accounting for the number of reply addresses for the query. Other identical branches outside of serve expired perform the correct decrement. Since the counter is never decremented in such scenario, it can reach the maximum limit and new clients for duplicate in-flight queries are silently dropped resulting in degradation of resolution service. A malicious actor can exploit the vulnerability by querying the resolver for a client-controlled slow-on-demand authoritative zone that can drive the counter past the threshold. Shipped defaults for &#39;serve-expired-client-timeout: 1800&#39; and &#39;discard-timeout: 1900&#39; make the branch unreachable.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: unbound, Ubuntu:Pro:16.04:LTS: unbound, Ubuntu:Pro:18.04:LTS: unbound, Ubuntu:Pro:20.04:LTS: unbound, Ubuntu:22.04:LTS: unbound, Ubuntu:24.04:LTS: unbound, Ubuntu:26.04:LTS: unbound</p> <p>In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with &#39;serve-expired: yes&#39; and &#39;serve-expired-client-timeout &gt; discard-timeout &gt; 0&#39; (contrary to the suggested values), the discard-timeout branch during the serve expired logic drops an aged client reply without performing the correct accounting for the number of reply addresses for the query. Other identical branches outside of serve expired perform the correct decrement. Since the counter is never decremented in such scenario, it can reach the maximum limit and new clients for duplicate in-flight queries are silently dropped resulting in degradation of resolution service. A malicious actor can exploit the vulnerability by querying the resolver for a client-controlled slow-on-demand authoritative zone that can drive the counter past the threshold. Shipped defaults for &#39;serve-expired-client-timeout: 1800&#39; and &#39;discard-timeout: 1900&#39; make the branch unreachable.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-56444 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2492 <p>Ein Angreifer kann mehrere Schwachstellen in Unbound ausnutzen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Daten zu manipulieren, und um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Unbound ausnutzen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Daten zu manipulieren, und um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2492