p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de unbound

Vulnerabilidades publicadas para unbound en los últimos 30 días: 5. Incluidas en el catálogo KEV: 0.

RSS ↗
Filtrar vulnerabilidades
Borrar filtros

Vulnerabilidades: 87

  1. CVE-2026-97206

    Alta · CVSS 7.5EPSS 0,26%Código de explotación públicoSin corrección publicada

    DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.

    NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.

    unboundSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  2. CVE-2026-96405

    Media · CVSS 5.3EPSS 0,24%Sin corrección publicada

    Aggregate DNS name chained pointer decompression work leads to degradation of service.

    NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious actor with recursive-query access and control of an ordinarily delegated authority that serves specially crafted replies can exploit the vulnerability and degrade Unbound's general performance.

    unboundSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  3. CVE-2026-50106

    Media · CVSS 6.5EPSS 0,19%Sin corrección publicada

    Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent.

    When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name inside the island, with the NSEC/SOA RRSIG 'SignerName' set to the insecure parent, tricks Unbound's validator to use the root trust anchor instead, and consecutively the insecure parent, thus causing that record to be treated as insecure and denying existence for records in the trust island.

    unboundSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  4. CVE-2026-35501

    Baja · CVSS 3.7EPSS 0,11%Sin corrección publicada

    Bypass of a configured island trust anchor underneath an insecure parent from an atacker-controlled NSEC record.

    When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor with a forged NSEC reply with the SOA bit cleared can trick Unbound to treat the configured trust island as insecure. This happens because the DNSSEC validator in Unbound accepts and caches the NSEC insecure response bypassing the RRSIG validation that the validator was supposed to do. The acceptance of the NSEC record at the trust anchor apex was allowed due to and old fix for type DS and NSEC quer

    unboundSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  5. CVE-2026-109125

    Media · CVSS 5.3EPSS 0,13%Sin corrección publicada

    Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'

    In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-threshold > 0' configurations (not a default configuration). If a response-like UDP datagram reaches the upstream source port currently used by a recursive query, but its TXID does not match any pending query, Unbound counts the packet as an unwanted reply. When the accumulated count reaches the configured threshold, Unbound clears the worker's RRset cache and message cache. This cache clear action does not destroy the current upstream UDP pending query. Therefore, an external observer can distinguish whether a

    unboundSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  6. CVE-2026-85501

    Media · CVSS 5.3EPSS 0,48%Sin corrección publicada

    Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC

    Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root z

    unboundSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  7. CVE-2026-82720

    Media · CVSS 5.9EPSS 0,38%Sin corrección publicada

    Use-after-free in DoH stream cleanup code path

    NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. During failure code paths (i.e., RPZ drop query, jostle due to heavy traffic), a dropped DoH stream brings down the whole DoH session and does not account properly for other DoH streams in the same session. This leads to use-after-free in those code paths. If the prerequisites are satisfied (possible RPZ drop or heavy client traffic), a malicious actor can trigger the vulnerability with a single DoH connection and the appropriate traffic. Impact is limited as the reads are not user controll

    unboundSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  8. CVE-2026-82717

    Alta · CVSS 8.4EPSS 0,78%Sin corrección publicada

    CNAME synthesis could lead to heap corruption

    In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption

    unboundSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  9. CVE-2026-81642

    Crítica · CVSS 9.1EPSS 0,96%Sin corrección publicada

    Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY

    In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA can overflow the digest buffer. Remote code execution is possible through attacker controlled data. An adversary can exploit the vulnerability by controlling a malicious zone and querying a vulnerable Unbound.

    unboundSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  10. CVE-2026-81634

    Alta · CVSS 7.5EPSS 0,48%Sin corrección publicada

    Possible heap buffer overflow during DNSSEC canonicalization

    In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNSSEC validation), can trigger the vulnerability.

    unboundSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  11. CVE-2026-80225

    Media · CVSS 5.3EPSS 0,48%Sin corrección publicada

    Possible degradation of service from continuous queries on the same TCP/DoT connection

    In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.

    unboundSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  12. CVE-2026-78227

    Media · CVSS 6.5EPSS 0,34%Sin corrección publicada

    Use-after-free in DoQ stream output buffer on reset re-transmission

    NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that holds the DNS response. ngtcp2's retransmission buffer keeps a shallow pointer into the output buffer for as long as a STREAM frame may be resent. On a client RESET_STREAM, the output buffer is freed but ngtcp2 still holds the matching retransmission entries. The next PTO timeout makes ngtcp2 re-encode the STREAM frame and copy from the freed buffer. A malicious actor that can query Unbound over DoQ and that withholds ACKs, sends RESET_STREAM, and w

    unboundSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  13. CVE-2026-77955

    Media · CVSS 4.4EPSS 0,17%Sin corrección publicada

    Possible ZONEMD verification bypass window

    In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check failed, the tampered data are reloaded on startup and available until ZONEMD verification concludes again. If verification fails, the data is not served

    unboundSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  14. CVE-2026-77860

    Baja · CVSS 3.7EPSS 0,3%Sin corrección publicada

    'serve-expired' can bypass Unbound 'wait-limit'

    In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb (CVE-2024-33655). A malicious actor can exploit this by controlling an authoritative zone with short TTL, so cached entries expire quickly. Each 'slow' query, one the attacker's authoritative never answers, is followed by one query for an expired cached name, which is answered immediately via the 'serve-expired' path and decrements the counter twice. This second query was named 'pump'. By

    unboundSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  15. CVE-2026-56444

    Media · CVSS 5.9EPSS 0,36%Sin corrección publicada

    Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration

    In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with 'serve-expired: yes' and 'serve-expired-client-timeout > discard-timeout > 0' (contrary to the suggested values), the discard-timeout branch during the serve expired logic drops an aged client reply without performing the correct accounting for the number of reply addresses for the query. Other identical branches outside of serve expired perform the correct decrement. Since the counter is never decremented in such scenario, it can reach the maximum limit and new clients for duplicate in-flight queries are silently dropped resulting in degradation of resol

    unboundSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  16. CVE-2026-56416

    Media · CVSS 4.8EPSS 0,12%Sin corrección publicada

    Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name

    In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain name as 'datstart + dname_valid(datstart, ...)' and passes it straight to 'query_dname_tolower()' without checking that a second name is actually present in the RDATA. The wire-format parser accepts multi-dname RRs whose RDATA ends after the first name, so an attacker who runs a DNSSEC-signed authoritative server can deliver a record with an absent second domain name (e.g. SOA record) and cause 'query_dname_tolower()' to walk label-by-labe

    unboundSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  17. CVE-2026-55991

    Media · CVSS 5.9EPSS 0,36%Sin corrección publicada

    Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2

    In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion (if compiled with assertions on) and terminate the entire Unbound process using a single DNS-over-QUIC (DoQ) connection and one normal DNS query. This is caused by an erroneous error value passed to libngtcp2. When 'ngtcp2_conn_writev_stream()' returns 'NGTCP2_ERR_STREAM_DATA_BLOCKED', Unbound continues to call 'ngtcp2_ccerr_set_application_error()' with a '-1' error value. The 'int' literal '-1' is implicitly converted to the function's 'uint64_t error_code' parameter as '0xFFFFFFFFFFFFFFFF'. The follow-on 'ngtcp2_conn_w

    unboundSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  18. CVE-2026-55990

    Media · CVSS 5.9EPSS 0,25%Sin corrección publicada

    Packet of death for a DNSCrypt misconfigured Unbound

    In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt-provider-cert:' files than there are matching 'dnscrypt-secret-key:' files, Unbound fills only the matched prefix and leaves the tail slots at the '0xdb' fill that libsodium's allocator writes into every allocation. Unbound would then iterate over the number of cert files, not the actual slots, so it walks into a slot with garbage data filled with '0xdb' bytes. Any unauthenticated client that sends one UDP datagram of ≥ 68 bytes whose first 8 bytes are '0xdb' to 'dnscrypt-port' will use that garbage entry which leads to a garbage dereferen

    unboundSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  19. CVE-2026-55973

    Alta · CVSS 7.5EPSS 0,28%Sin corrección publicada

    'dns-error-reporting: yes' leads to stack buffer overflow

    In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain, the returned lenght is not used and if the agent domain is followed by garbage, those bytes are moved onto the tail of the synthetic '_er.' report query name. That query name is later used in the iterator via a subquery to send out the DNS Error Report and when Unbound tries to walk that query name during 'find_closest_of_type()', it strips labels

    unboundSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  20. CVE-2026-55717

    Media · CVSS 5.9EPSS 0,24%Sin corrección publicada

    'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash

    In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: <net> redirect' /'response-ip-data: <net> CNAME <target>' rule (or the RPZ 'rpz-cname-override' equivalent), a remote client who controls any delegated domain can crash the daemon. The serve-expired-client-timeout callback runs a two-pass loop to chase the respip-generated CNAME alias; on the second pass it resets 'alias_rrset' but not 'partial_rep'. Later, this inconsistency leads to a NULL pointer dereference and an eventual crash. A malicious actor can exploit the vulnerability by controlling any zone that replies with an

    unboundSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →