{"kind": "product", "path": "vulns/debian-12/unbound", "name": "unbound", "product": "unbound", "ecosystem": "Debian:12", "items": [{"id": "CVE-2026-97206", "noindex": false, "published": "2026-10-21T08:57:41.106Z", "modified": "2026-10-21T08:57:41.106Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00263, "kev": false, "exploits": ["github-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-97206", "title": "DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.", "description": "NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.", "references": ["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-97206.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-97206"], "fixes": [], "products": [{"name": "unbound", "path": "vulns/debian-12/unbound", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-96405", "noindex": false, "published": "2026-10-21T08:57:26.986Z", "modified": "2026-10-21T08:57:26.986Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00238, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-96405", "title": "Aggregate DNS name chained pointer decompression work leads to degradation of service.", "description": "NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious actor with recursive-query access and control of an ordinarily delegated authority that serves specially crafted replies can exploit the vulnerability and degrade Unbound's general performance.", "references": ["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-96405.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-96405"], "fixes": [], "products": [{"name": "unbound", "path": "vulns/debian-12/unbound", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-50106", "noindex": false, "published": "2026-10-21T08:57:11.040Z", "modified": "2026-10-21T08:57:11.040Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "severity": "medium", "epss": 0.00194, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-50106", "title": "Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent.", "description": "When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name inside the island, with the NSEC/SOA RRSIG 'SignerName' set to the insecure parent, tricks Unbound's validator to use the root trust anchor instead, and consecutively the insecure parent, thus causing that record to be treated as insecure and denying existence for records in the trust island.", "references": ["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50106.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-50106"], "fixes": [], "products": [{"name": "unbound", "path": "vulns/debian-12/unbound", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-35501", "noindex": false, "published": "2026-10-21T08:56:55.811Z", "modified": "2026-10-21T08:56:55.811Z", "cvss": 3.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "low", "epss": 0.0011, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-35501", "title": "Bypass of a configured island trust anchor underneath an insecure parent from an atacker-controlled NSEC record.", "description": "When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor with a forged NSEC reply with the SOA bit cleared can trick Unbound to treat the configured trust island as insecure. This happens because the DNSSEC validator in Unbound accepts and caches the NSEC insecure response bypassing the RRSIG validation that the validator was supposed to do. The acceptance of the NSEC record at the trust anchor apex was allowed due to and old fix for type DS and NSEC quer", "references": ["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-35501.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-35501"], "fixes": [], "products": [{"name": "unbound", "path": "vulns/debian-12/unbound", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-109125", "noindex": false, "published": "2026-10-21T08:56:35.696Z", "modified": "2026-10-21T08:56:35.696Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "severity": "medium", "epss": 0.00134, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-109125", "title": "Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'", "description": "In NLnet Labs Unbound up to and including version 1.26.1, an observable  cache-level side-channel can be exposed with 'unwanted-reply-threshold > 0' configurations (not a default configuration). If a response-like UDP datagram reaches the upstream source port currently used by a recursive query, but its TXID does not match any pending query, Unbound counts the packet as an unwanted reply. When the accumulated count reaches the configured threshold, Unbound clears the worker's RRset cache and message cache. This cache clear action does not destroy the current upstream UDP pending query. Therefore, an external observer can distinguish whether a", "references": ["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-109125.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-109125"], "fixes": [], "products": [{"name": "unbound", "path": "vulns/debian-12/unbound", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-85501", "noindex": false, "published": "2026-09-16T08:32:25.398Z", "modified": "2026-09-16T14:12:18.996Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00482, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-85501", "title": "Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC", "description": "Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where  the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root z", "references": ["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-85501.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-85501"], "fixes": [], "products": [{"name": "unbound", "path": "vulns/debian-12/unbound", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-82720", "noindex": false, "published": "2026-09-16T08:32:10.359Z", "modified": "2026-09-16T14:14:25.720Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00382, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-82720", "title": "Use-after-free in DoH stream cleanup code path", "description": "NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. During failure code paths (i.e., RPZ drop query, jostle due to heavy traffic), a dropped DoH stream brings down the whole DoH session and does not account properly for other DoH streams in the same session. This leads to use-after-free in those code paths. If the prerequisites are satisfied (possible RPZ drop or heavy client traffic), a malicious actor can trigger the vulnerability with a single DoH connection and the appropriate traffic. Impact is limited as the reads are not user controll", "references": ["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-82720.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-82720"], "fixes": [], "products": [{"name": "unbound", "path": "vulns/debian-12/unbound", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-82717", "noindex": false, "published": "2026-09-16T08:31:59.417Z", "modified": "2026-09-16T14:15:55.295Z", "cvss": 8.4, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U", "severity": "high", "epss": 0.00782, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-82717", "title": "CNAME synthesis could lead to heap corruption", "description": "In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption ", "references": ["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-82717.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-82717"], "fixes": [], "products": [{"name": "unbound", "path": "vulns/debian-12/unbound", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-81642", "noindex": false, "published": "2026-09-16T08:30:58.604Z", "modified": "2026-09-16T14:32:16.825Z", "cvss": 9.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/U:Red", "severity": "critical", "epss": 0.00962, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-81642", "title": "Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY", "description": "In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA can overflow the digest buffer. Remote code execution is possible through attacker controlled data. An adversary can exploit the vulnerability by controlling a malicious zone and querying a vulnerable Unbound.", "references": ["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81642.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-81642"], "fixes": [], "products": [{"name": "unbound", "path": "vulns/debian-12/unbound", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-81634", "noindex": false, "published": "2026-09-16T08:30:15.428Z", "modified": "2026-09-16T14:32:38.842Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.0048, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-81634", "title": "Possible heap buffer overflow during DNSSEC canonicalization", "description": "In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNSSEC validation), can trigger the vulnerability.", "references": ["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81634.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-81634"], "fixes": [], "products": [{"name": "unbound", "path": "vulns/debian-12/unbound", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-80225", "noindex": false, "published": "2026-09-16T08:30:04.246Z", "modified": "2026-09-16T14:33:08.344Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00482, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-80225", "title": "Possible degradation of service from continuous queries on the same TCP/DoT connection", "description": "In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.", "references": ["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-80225.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-80225"], "fixes": [], "products": [{"name": "unbound", "path": "vulns/debian-12/unbound", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-78227", "noindex": false, "published": "2026-09-16T08:29:52.342Z", "modified": "2026-09-16T15:33:54.267Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L", "severity": "medium", "epss": 0.0034, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-78227", "title": "Use-after-free in DoQ stream output buffer on reset re-transmission", "description": "NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that holds the DNS response. ngtcp2's retransmission buffer keeps a shallow pointer into the output buffer for as long as a STREAM frame may be resent. On a client RESET_STREAM, the output buffer is freed but ngtcp2 still holds the matching retransmission entries. The next PTO timeout makes ngtcp2 re-encode the STREAM frame and copy from the freed buffer. A malicious actor that can query Unbound over DoQ and that withholds ACKs, sends RESET_STREAM, and w", "references": ["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-78227.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-78227"], "fixes": [], "products": [{"name": "unbound", "path": "vulns/debian-12/unbound", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-77955", "noindex": false, "published": "2026-09-16T08:29:39.955Z", "modified": "2026-09-16T14:33:24.961Z", "cvss": 4.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N", "severity": "medium", "epss": 0.00172, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-77955", "title": "Possible ZONEMD verification bypass window", "description": "In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check failed, the tampered data are reloaded on startup and available until ZONEMD verification concludes again. If verification fails, the data is not served ", "references": ["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-77955.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-77955"], "fixes": [], "products": [{"name": "unbound", "path": "vulns/debian-12/unbound", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-77860", "noindex": false, "published": "2026-09-16T08:29:23.501Z", "modified": "2026-09-16T14:45:35.788Z", "cvss": 3.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "low", "epss": 0.00301, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-77860", "title": "'serve-expired' can bypass Unbound 'wait-limit'", "description": "In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb (CVE-2024-33655). A malicious actor can exploit this by controlling an authoritative zone with short TTL, so cached entries expire quickly. Each 'slow' query, one the attacker's authoritative never answers, is followed by one query for an expired cached name, which is answered immediately via the 'serve-expired' path and decrements the counter twice. This second query was named 'pump'. By ", "references": ["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-77860.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-77860"], "fixes": [], "products": [{"name": "unbound", "path": "vulns/debian-12/unbound", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-56444", "noindex": false, "published": "2026-07-22T13:10:34.229Z", "modified": "2026-07-22T13:58:09.702Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00365, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-56444", "title": "Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration", "description": "In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with 'serve-expired: yes' and 'serve-expired-client-timeout > discard-timeout > 0' (contrary to the suggested values), the discard-timeout branch during the serve expired logic drops an aged client reply without performing the correct accounting for the number of reply addresses for the query. Other identical branches outside of serve expired perform the correct decrement. Since the counter is never decremented in such scenario, it can reach the maximum limit and new clients for duplicate in-flight queries are silently dropped resulting in degradation of resol", "references": ["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-56444.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-56444"], "fixes": [], "products": [{"name": "unbound", "path": "vulns/debian-12/unbound", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-56416", "noindex": false, "published": "2026-07-22T13:10:24.023Z", "modified": "2026-07-22T14:00:45.744Z", "cvss": 4.8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "severity": "medium", "epss": 0.00124, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-56416", "title": "Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name", "description": "In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain name as 'datstart + dname_valid(datstart, ...)' and passes it straight to 'query_dname_tolower()' without checking that a second name is actually present in the RDATA. The wire-format parser accepts multi-dname RRs whose RDATA ends after the first name, so an attacker who runs a DNSSEC-signed authoritative server can deliver a record with an absent second domain name (e.g. SOA record) and cause 'query_dname_tolower()' to walk label-by-labe", "references": ["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-56416.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-56416"], "fixes": [], "products": [{"name": "unbound", "path": "vulns/debian-12/unbound", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-55991", "noindex": false, "published": "2026-07-22T13:10:13.235Z", "modified": "2026-09-16T14:24:57.805Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00365, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-55991", "title": "Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2", "description": "In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion (if compiled with assertions on) and terminate the entire Unbound process using a single DNS-over-QUIC (DoQ) connection and one normal DNS query. This is caused by an erroneous error value passed to libngtcp2. When 'ngtcp2_conn_writev_stream()' returns 'NGTCP2_ERR_STREAM_DATA_BLOCKED', Unbound continues to call 'ngtcp2_ccerr_set_application_error()' with a '-1' error value. The 'int' literal '-1' is implicitly converted to the function's 'uint64_t error_code' parameter as '0xFFFFFFFFFFFFFFFF'. The follow-on 'ngtcp2_conn_w", "references": ["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-55991.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-55991"], "fixes": [], "products": [{"name": "unbound", "path": "vulns/debian-12/unbound", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-55990", "noindex": false, "published": "2026-07-22T13:10:01.635Z", "modified": "2026-07-22T14:04:28.690Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00247, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-55990", "title": "Packet of death for a DNSCrypt misconfigured Unbound", "description": "In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt-provider-cert:' files than there are matching 'dnscrypt-secret-key:' files, Unbound fills only the matched prefix and leaves the tail slots at the '0xdb' fill that libsodium's allocator writes into every allocation. Unbound would then iterate over the number of cert files, not the actual slots, so it walks into a slot with garbage data filled with '0xdb' bytes. Any unauthenticated client that sends one UDP datagram of ≥ 68 bytes whose first 8 bytes are '0xdb' to 'dnscrypt-port' will use that garbage entry which leads to a garbage dereferen", "references": ["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-55990.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-55990"], "fixes": [], "products": [{"name": "unbound", "path": "vulns/debian-12/unbound", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-55973", "noindex": false, "published": "2026-07-22T13:09:50.942Z", "modified": "2026-07-22T14:06:00.025Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00281, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-55973", "title": "'dns-error-reporting: yes' leads to stack buffer overflow", "description": "In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain, the returned lenght is not used and if the agent domain is followed by garbage, those bytes are moved onto the tail of the synthetic '_er.' report query name. That query name is later used in the iterator via a subquery to send out the DNS Error Report and when Unbound tries to walk that query name during 'find_closest_of_type()', it strips labels", "references": ["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-55973.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-55973"], "fixes": [], "products": [{"name": "unbound", "path": "vulns/debian-12/unbound", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-55717", "noindex": false, "published": "2026-07-22T13:09:40.927Z", "modified": "2026-07-22T14:07:31.075Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00237, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-55717", "title": "'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash", "description": "In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: <net> redirect' /'response-ip-data: <net> CNAME <target>' rule (or the RPZ 'rpz-cname-override' equivalent), a remote client who controls any delegated domain can crash the daemon. The serve-expired-client-timeout callback runs a two-pass loop to chase the respip-generated CNAME alias; on the second pass it resets 'alias_rrset' but not 'partial_rep'. Later, this inconsistency leads to a NULL pointer dereference and an eventual crash. A malicious actor can exploit the vulnerability by controlling any zone that replies with an", "references": ["https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-55717.txt", "https://nvd.nist.gov/vuln/detail/CVE-2026-55717"], "fixes": [], "products": [{"name": "unbound", "path": "vulns/debian-12/unbound", "ecosystem": "Debian:12"}]}], "total": 87, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 5, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "unbound", "path": "vulns/debian-12/unbound", "ecosystem": "Debian:12"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 5, "kev": 0}, "lastmod": "2026-10-21T08:57:41.106Z", "early_advisories": [], "license": "Sie dürfen die Auswahl von PatchFirst und unsere Ergänzungen (Prioritäten, Frühwarnungen, Texte, Zusammenfassungen und Aggregate) für eigene Zwecke einschließlich interner geschäftlicher Aufgaben frei nutzen. Weiterverkauf, kommerzielle Verbreitung und massenhafte Spiegelung dieser Auswahl oder Ergänzungen erfordern eine schriftliche Vereinbarung mit dem Betreiber. Nennen Sie bei jeder Nutzung oder Veröffentlichung der Auswahl oder unserer Ergänzungen PatchFirst (https://patchfirst.dev/vulns/) mit diesem Link zur Feedseite Ihrer Region als Quelle. Originaleinträge aus offenen Quellen unterliegen weiterhin ihren jeweiligen Lizenzen und Bedingungen. Diese Bedingungen beschränken Ihre Rechte an den Originaldaten nicht, die Sie direkt bei den Quellen beziehen können.", "terms_url": "https://patchfirst.dev/de/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst wählt Einträge aus, normalisiert und kombiniert sie; Zusammenfassungen und Übersetzungen können hinzukommen. Nachrichten werden im jeweiligen Eintrag mit einem Link zur Originalquelle belegt.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Die Lizenzen der Ursprungsdatenbanken unterscheiden sich; siehe Quellenkatalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Frei zugängliche Bewertungen; Quellenangabe erbeten (FIRST EPSS, Bewertungen von Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}