SUSE-SU-2026:3885-1

SUSE-SU-2026:3885-1 · Security update for unbound

Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.

Diese Seite zeigt ausgewählte Angaben aus den Quellen. Die vollständige Beschreibung und betroffene Versionen finden Sie in den verlinkten Sicherheitshinweisen.

This update for unbound fixes the following issues: Update to version 1.25.2. Security issues fixed: - CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875). - CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records (bsc#1271892). - CVE-2026-44621: Libunbound applications configured with `unwanted-reply-threshold` could eventually be abruptly terminated (bsc#1271876). - CVE-2026-44687: Off-by-one error in `harden-below-nxdomain` logic can shadow a stub/forward zone by a legitimate parent's `NXDOMAIN` (bsc#1271893). - CVE-2026-44690: Cross-zone wildcard cache poisoning via `RRSIG.labels` manipulation (bsc#1271877). - CVE-2026-46582: Replay of a wildcard `rrset` as another piece of data triggers poisoning in the server expired reply path (bsc#1271894). - CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882). - CVE-2026-50243: `response-ip`/`rpz` can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880). - CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881). - CVE-2026-50251: Attacker supplied `0.0.0.0`/`::` glue triggers defensive full-cache flush (bsc#1271883). - CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884). - CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with `answer-cookie:yes` is used (bsc#1271895). - CVE-2026-55708: Privacy/configuration issue when adding local data in views through `unbound-control` (bsc#1271896). - CVE-2026-55717: `serve-expired-client-timeout` and `response-ip` CNAME redirect could lead to a crash (bsc#1271886). - CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887). - CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name (bsc#1271889). - CVE-2026-56444: Degradation of resolution service when `discard-timeout` and `serve-expired-client-timeout` are combined in unusual configuration (bsc#1271890). Other updates and bugfixes: - Version 1.25.2: * For a complete list of additional changes see the changelog at https://nlnetlabs.nl/projects/unbound/download/ - Update `unbound.keyring`.

Korrektur verfügbar

Veröffentlicht

2026-08-31T14:34:37Z

Aktualisiert

2026-09-10T18:23:45.222190322Z

Technologie-Stack: system

Prüfen Sie Ihren Server →