{"kind": "product", "path": "vulns/alpine-v3.23/unbound", "name": "unbound", "product": "unbound", "ecosystem": "Alpine:v3.23", "items": [{"id": "ALPINE-CVE-2026-82717", "noindex": false, "published": "2026-09-16T09:17:06.550Z", "modified": "2026-10-01T02:17:49.415987271Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2026-82717", "title": "ALPINE-CVE-2026-82717", "description": "In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption ", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-82717", "https://osv.dev/vulnerability/ALPINE-CVE-2026-82717"], "fixes": ["1.25.2-r0"], "products": [{"name": "unbound", "path": "vulns/alpine-v3.23/unbound", "ecosystem": "Alpine:v3.23"}]}, {"id": "ALPINE-CVE-2026-81642", "noindex": false, "published": "2026-09-16T09:17:06.320Z", "modified": "2026-10-01T02:17:49.415236165Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2026-81642", "title": "ALPINE-CVE-2026-81642", "description": "In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA can overflow the digest buffer. Remote code execution is possible through attacker controlled data. An adversary can exploit the vulnerability by controlling a malicious zone and querying a vulnerable Unbound.", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-81642", "https://osv.dev/vulnerability/ALPINE-CVE-2026-81642"], "fixes": ["1.25.2-r0"], "products": [{"name": "unbound", "path": "vulns/alpine-v3.23/unbound", "ecosystem": "Alpine:v3.23"}]}, {"id": "ALPINE-CVE-2026-56444", "noindex": false, "published": "2026-07-22T14:17:22.203Z", "modified": "2026-10-01T02:17:49.358610868Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2026-56444", "title": "ALPINE-CVE-2026-56444", "description": "In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with 'serve-expired: yes' and 'serve-expired-client-timeout > discard-timeout > 0' (contrary to the suggested values), the discard-timeout branch during the serve expired logic drops an aged client reply without performing the correct accounting for the number of reply addresses for the query. Other identical branches outside of serve expired perform the correct decrement. Since the counter is never decremented in such scenario, it can reach the maximum limit and new clients for duplicate in-flight queries are silently dropped resulting in degradation of resol", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-56444", "https://osv.dev/vulnerability/ALPINE-CVE-2026-56444"], "fixes": ["1.25.2-r0"], "products": [{"name": "unbound", "path": "vulns/alpine-v3.23/unbound", "ecosystem": "Alpine:v3.23"}]}, {"id": "ALPINE-CVE-2026-56416", "noindex": false, "published": "2026-07-22T14:17:22.090Z", "modified": "2026-10-01T02:17:49.358217252Z", "cvss": 4.8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2026-56416", "title": "ALPINE-CVE-2026-56416", "description": "In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain name as 'datstart + dname_valid(datstart, ...)' and passes it straight to 'query_dname_tolower()' without checking that a second name is actually present in the RDATA. The wire-format parser accepts multi-dname RRs whose RDATA ends after the first name, so an attacker who runs a DNSSEC-signed authoritative server can deliver a record with an absent second domain name (e.g. SOA record) and cause 'query_dname_tolower()' to walk label-by-labe", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-56416", "https://osv.dev/vulnerability/ALPINE-CVE-2026-56416"], "fixes": ["1.25.2-r0"], "products": [{"name": "unbound", "path": "vulns/alpine-v3.23/unbound", "ecosystem": "Alpine:v3.23"}]}, {"id": "ALPINE-CVE-2026-55973", "noindex": false, "published": "2026-07-22T14:17:21.663Z", "modified": "2026-10-01T02:17:49.349430178Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2026-55973", "title": "ALPINE-CVE-2026-55973", "description": "In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain, the returned lenght is not used and if the agent domain is followed by garbage, those bytes are moved onto the tail of the synthetic '_er.' report query name. That query name is later used in the iterator via a subquery to send out the DNS Error Report and when Unbound tries to walk that query name during 'find_closest_of_type()', it strips labels", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-55973", "https://osv.dev/vulnerability/ALPINE-CVE-2026-55973"], "fixes": ["1.25.2-r0"], "products": [{"name": "unbound", "path": "vulns/alpine-v3.23/unbound", "ecosystem": "Alpine:v3.23"}]}, {"id": "ALPINE-CVE-2026-55717", "noindex": false, "published": "2026-07-22T14:17:21.537Z", "modified": "2026-10-01T02:17:49.348071535Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2026-55717", "title": "ALPINE-CVE-2026-55717", "description": "In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: <net> redirect' /'response-ip-data: <net> CNAME <target>' rule (or the RPZ 'rpz-cname-override' equivalent), a remote client who controls any delegated domain can crash the daemon. The serve-expired-client-timeout callback runs a two-pass loop to chase the respip-generated CNAME alias; on the second pass it resets 'alias_rrset' but not 'partial_rep'. Later, this inconsistency leads to a NULL pointer dereference and an eventual crash. A malicious actor can exploit the vulnerability by controlling any zone that replies with an", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-55717", "https://osv.dev/vulnerability/ALPINE-CVE-2026-55717"], "fixes": ["1.25.2-r0"], "products": [{"name": "unbound", "path": "vulns/alpine-v3.23/unbound", "ecosystem": "Alpine:v3.23"}]}, {"id": "ALPINE-CVE-2026-55708", "noindex": false, "published": "2026-07-22T14:17:21.403Z", "modified": "2026-10-01T02:17:49.348060281Z", "cvss": 3.1, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "severity": "low", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2026-55708", "title": "ALPINE-CVE-2026-55708", "description": "In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'view_local_data' and 'view_local_datas' commands of 'unbound-control' create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with. However, the creation through the control interface omits adding the default-protected zones (e.g., RFC 1918 reverse, AS112 zones, .onion, .localhost). Once the local zone tree exists without the defaults, every query for a default-protected name from a client mapped to that view escapes to the public DNS via the iterator instead of being answered locally, bypassing local policy expecta", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-55708", "https://osv.dev/vulnerability/ALPINE-CVE-2026-55708"], "fixes": ["1.25.2-r0"], "products": [{"name": "unbound", "path": "vulns/alpine-v3.23/unbound", "ecosystem": "Alpine:v3.23"}]}, {"id": "ALPINE-CVE-2026-54478", "noindex": false, "published": "2026-07-22T14:17:21.177Z", "modified": "2026-10-01T02:17:49.345396042Z", "cvss": 3.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "low", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2026-54478", "title": "ALPINE-CVE-2026-54478", "description": "In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the RFC 9018 server-cookie SipHash is computed over the proxy's wire address instead of the PROXYv2-declared client. One server cookie obtained through a given proxy node therefore validates for every PROXYv2-declared source behind that node. On a UDP+proxy-protocol front, an off-path attacker can harvest one cookie with a single legitimate query, then replay it under any spoofed source and pass DNS Cookie checks that were deployed to defeat this in the first place.", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-54478", "https://osv.dev/vulnerability/ALPINE-CVE-2026-54478"], "fixes": ["1.25.2-r0"], "products": [{"name": "unbound", "path": "vulns/alpine-v3.23/unbound", "ecosystem": "Alpine:v3.23"}]}, {"id": "ALPINE-CVE-2026-52863", "noindex": false, "published": "2026-07-22T14:17:20.757Z", "modified": "2026-10-01T02:17:49.335989582Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2026-52863", "title": "ALPINE-CVE-2026-52863", "description": "In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of the view name in effect that could lead to memory corruption if the owner of the original view name is jostled out when Unbound is under pressure. Unbound needs to be configured with one of 'respip'/'rpz' modules, together with a module that can attach subqueries (respip CNAME redirection, dns64, subnetcache) and a configured 'access-control-view' while Unbound is under pressure so that joslte logic kicks in and starts dropping slow queries. The subquery is getting a shallow copy of the view name ", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-52863", "https://osv.dev/vulnerability/ALPINE-CVE-2026-52863"], "fixes": ["1.25.2-r0"], "products": [{"name": "unbound", "path": "vulns/alpine-v3.23/unbound", "ecosystem": "Alpine:v3.23"}]}, {"id": "ALPINE-CVE-2026-50252", "noindex": false, "published": "2026-07-22T14:17:20.627Z", "modified": "2026-10-01T02:17:49.333376583Z", "cvss": 9.3, "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H", "severity": "critical", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2026-50252", "title": "ALPINE-CVE-2026-50252", "description": "In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined. The vulnerability arises when the load balancing policy is consistent with respect to the incoming source UDP port and IP address while heavily depending on the incoming source UDP port as a randomization source. When the SO_REUSEPORT configuration option is enabled ('so-reuseport: yes') in Unbound (by default), it meets these conditions, making it ", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-50252", "https://osv.dev/vulnerability/ALPINE-CVE-2026-50252"], "fixes": ["1.25.2-r0"], "products": [{"name": "unbound", "path": "vulns/alpine-v3.23/unbound", "ecosystem": "Alpine:v3.23"}]}, {"id": "ALPINE-CVE-2026-50251", "noindex": false, "published": "2026-07-22T14:17:20.503Z", "modified": "2026-10-01T02:17:49.333241163Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2026-50251", "title": "ALPINE-CVE-2026-50251", "description": "In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled (set to any value greater than zero), glue records of 0.0.0.0/::0 can short-circuit Unbound, on systems that can direct such traffic, by issuing DNS queries and receiving seemingly unwanted replies since the remote IP does not match the original source IP of 0.0.0.0/::0. This behavior keeps on looping for the glue records and pushing the counter to the configured 'unwanted-reply-threshold' that triggers a defensive cache clear. A malicious actor who controls a delegation that returns in-bailiwick glue of 0.0.0.0/::0 can drive the counter to th", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-50251", "https://osv.dev/vulnerability/ALPINE-CVE-2026-50251"], "fixes": ["1.25.2-r0"], "products": [{"name": "unbound", "path": "vulns/alpine-v3.23/unbound", "ecosystem": "Alpine:v3.23"}]}, {"id": "ALPINE-CVE-2026-50248", "noindex": false, "published": "2026-07-22T14:17:20.370Z", "modified": "2026-10-01T02:17:49.332224443Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2026-50248", "title": "ALPINE-CVE-2026-50248", "description": "In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname's A/AAAA record (no valid RRSIG required) becomes the zone's XFR primary and can replaces the entire zone/the resolver's entire response policy.", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-50248", "https://osv.dev/vulnerability/ALPINE-CVE-2026-50248"], "fixes": ["1.25.2-r0"], "products": [{"name": "unbound", "path": "vulns/alpine-v3.23/unbound", "ecosystem": "Alpine:v3.23"}]}, {"id": "ALPINE-CVE-2026-50243", "noindex": false, "published": "2026-07-22T14:17:20.240Z", "modified": "2026-10-01T02:17:49.331564799Z", "cvss": 3.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "low", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2026-50243", "title": "ALPINE-CVE-2026-50243", "description": "In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the 'respip' module in front of the validator together with a 'response-ip' redirect rule or an RPZ file with an RPZ-IP trigger, the rewriting handler does not check the security status of the upstream answer and can instead rewrite a BOGUS A/AAAA answer to point to an operator's configured IP. If the validator finds an expired or otherwise invalid RRSIG on an answer whose A record falls within a 'response-ip'/RPZ configuration, the answer is still rewritten and given a hard coded security level of INSECURE. This results in the client receiving an INSECURE", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-50243", "https://osv.dev/vulnerability/ALPINE-CVE-2026-50243"], "fixes": ["1.25.2-r0"], "products": [{"name": "unbound", "path": "vulns/alpine-v3.23/unbound", "ecosystem": "Alpine:v3.23"}]}, {"id": "ALPINE-CVE-2026-50046", "noindex": false, "published": "2026-07-22T14:17:20.117Z", "modified": "2026-10-01T02:17:49.330651860Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2026-50046", "title": "ALPINE-CVE-2026-50046", "description": "In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS (DoT) forwarded queries is tied to a struct's ('serviced_query') lifetime but also referenced by another struct ('waiting_tcp'). When the owning struct is jostled out of the mesh while the DoT TCP stream is still handshaking it frees the storage behind the referenced string and if the TLS stream then errors out, it dereferences the freed pointer. The dereference is read-only and the practical impact is a daemon crash resulting in denial of service. A malicious actor that knows a DoT forwarding/stub Unbound's configuration could exploit the vulne", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-50046", "https://osv.dev/vulnerability/ALPINE-CVE-2026-50046"], "fixes": ["1.25.2-r0"], "products": [{"name": "unbound", "path": "vulns/alpine-v3.23/unbound", "ecosystem": "Alpine:v3.23"}]}, {"id": "ALPINE-CVE-2026-50045", "noindex": false, "published": "2026-07-22T14:17:19.987Z", "modified": "2026-10-01T02:17:49.329869710Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2026-50045", "title": "ALPINE-CVE-2026-50045", "description": "In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a single client query for a deeply nested name under a DNSSEC-signed parent can cause Unbound to send more upstream packets per client query than the configured 'max-global-quota'. This effectively bypasses a security configuration that limits upstream amplification traffic.", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-50045", "https://osv.dev/vulnerability/ALPINE-CVE-2026-50045"], "fixes": ["1.25.2-r0"], "products": [{"name": "unbound", "path": "vulns/alpine-v3.23/unbound", "ecosystem": "Alpine:v3.23"}]}, {"id": "ALPINE-CVE-2026-46582", "noindex": false, "published": "2026-07-22T14:17:19.397Z", "modified": "2026-10-01T02:17:49.314782135Z", "cvss": 3.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "low", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2026-46582", "title": "ALPINE-CVE-2026-46582", "description": "In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache, before later validation treats it as bogus based on NSEC validation. When the resolving thread puts secure on the rrset, and another thread that is on the serve expired path then picks up the updated rrset contents with the secure status for a reply, it can be used to change a specific record, next to a wildcard that could be covered by the wildcard, into the wildcard. A malicious actor can exploit the possible poisonous effect by havi", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-46582", "https://osv.dev/vulnerability/ALPINE-CVE-2026-46582"], "fixes": ["1.25.2-r0"], "products": [{"name": "unbound", "path": "vulns/alpine-v3.23/unbound", "ecosystem": "Alpine:v3.23"}]}, {"id": "ALPINE-CVE-2026-44690", "noindex": false, "published": "2026-07-22T14:17:19.153Z", "modified": "2026-10-01T02:17:49.309035882Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2026-44690", "title": "ALPINE-CVE-2026-44690", "description": "In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone). Arbitrary delegations that do not exist under the parent domain and are covered by the parent's NSEC chain can be brought into in", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-44690", "https://osv.dev/vulnerability/ALPINE-CVE-2026-44690"], "fixes": ["1.25.2-r0"], "products": [{"name": "unbound", "path": "vulns/alpine-v3.23/unbound", "ecosystem": "Alpine:v3.23"}]}, {"id": "ALPINE-CVE-2026-44687", "noindex": false, "published": "2026-07-22T14:17:19.040Z", "modified": "2026-10-01T02:17:49.308398277Z", "cvss": 3.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "low", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2026-44687", "title": "ALPINE-CVE-2026-44687", "description": "In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed zone could be shadowed by the intermediate label's secure NXDOMAIN answer from the parent. This is caused by an off-by-one error in 'harden-below-nxdomain' logic; enabled by default. It effectively bypasses the configuration and the configured stub/forward zone is never contacted. 'harden-below-nxdomain' does an upward DNS cache walk together with a delegation point guard that does not allow NXDOMAIN synthesis above stub/forward zones. The guard tests the domain name but before stripping a label. T", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-44687", "https://osv.dev/vulnerability/ALPINE-CVE-2026-44687"], "fixes": ["1.25.2-r0"], "products": [{"name": "unbound", "path": "vulns/alpine-v3.23/unbound", "ecosystem": "Alpine:v3.23"}]}, {"id": "ALPINE-CVE-2026-44621", "noindex": false, "published": "2026-07-22T14:17:18.913Z", "modified": "2026-10-01T02:17:49.307834444Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2026-44621", "title": "ALPINE-CVE-2026-44621", "description": "With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and libunbound needs to call 'libworker_alloc_cleanup' since the function is absent from the function call allow list. When an application using libunbound sets 'unwanted-reply-threshold' to any non-zero value and the iterator queries an authoritative that replies with enough wrong-transaction-ID UDP datagrams to cross the threshold, the 'libworker_alloc_cleanup' will eventually be called. Since the function is absent from the function call", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-44621", "https://osv.dev/vulnerability/ALPINE-CVE-2026-44621"], "fixes": ["1.25.2-r0"], "products": [{"name": "unbound", "path": "vulns/alpine-v3.23/unbound", "ecosystem": "Alpine:v3.23"}]}, {"id": "ALPINE-CVE-2026-42955", "noindex": false, "published": "2026-07-22T14:17:18.680Z", "modified": "2026-10-01T02:17:49.299780565Z", "cvss": 3.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "low", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2026-42955", "title": "ALPINE-CVE-2026-42955", "description": "In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client A/AAAA query can cause Unbound to overwrite the cached expired parent-side glue rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'ha", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-42955", "https://osv.dev/vulnerability/ALPINE-CVE-2026-42955"], "fixes": ["1.25.2-r0"], "products": [{"name": "unbound", "path": "vulns/alpine-v3.23/unbound", "ecosystem": "Alpine:v3.23"}]}], "total": 44, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 3, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "unbound", "path": "vulns/alpine-v3.23/unbound", "ecosystem": "Alpine:v3.23"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-10-01T02:17:49.415987271Z", "early_advisories": [], "license": "Sie dürfen die Auswahl von PatchFirst und unsere Ergänzungen (Prioritäten, Frühwarnungen, Texte, Zusammenfassungen und Aggregate) für eigene Zwecke einschließlich interner geschäftlicher Aufgaben frei nutzen. Weiterverkauf, kommerzielle Verbreitung und massenhafte Spiegelung dieser Auswahl oder Ergänzungen erfordern eine schriftliche Vereinbarung mit dem Betreiber. Nennen Sie bei jeder Nutzung oder Veröffentlichung der Auswahl oder unserer Ergänzungen PatchFirst (https://patchfirst.dev/vulns/) mit diesem Link zur Feedseite Ihrer Region als Quelle. Originaleinträge aus offenen Quellen unterliegen weiterhin ihren jeweiligen Lizenzen und Bedingungen. Diese Bedingungen beschränken Ihre Rechte an den Originaldaten nicht, die Sie direkt bei den Quellen beziehen können.", "terms_url": "https://patchfirst.dev/de/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst wählt Einträge aus, normalisiert und kombiniert sie; Zusammenfassungen und Übersetzungen können hinzukommen. Nachrichten werden im jeweiligen Eintrag mit einem Link zur Originalquelle belegt.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Die Lizenzen der Ursprungsdatenbanken unterscheiden sich; siehe Quellenkatalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Frei zugängliche Bewertungen; Quellenangabe erbeten (FIRST EPSS, Bewertungen von Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}