This update for unbound fixes the following issues:
- CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' (bsc#1280403).
- CVE-2026-77955: Possible ZONEMD verification bypass window (bsc#1280404).
- CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission (bsc#1280405).
- CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection (bsc#1280406).
- CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization (bsc#1280409).
- CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (bsc#1280411).
- CVE-2026-827
This update for libsodium fixes the following issues:
Update to 1.0.22 (jsc#PED-16890):
* Post-quantum key encapsulation is now available. ML-KEM768, the
NIST-standardized lattice-based KEM, is accessible through the
crypto_kem_mlkem768_*() functions.
* X-Wing, a hybrid KEM combining ML-KEM768 with X25519 for protection
against both classical and quantum adversaries, is available through the
crypto_kem_*() functions. X-Wing is the recommended KEM for most
applications.
* SHA-3 hash functions are now available as crypto_hash_sha3256_*()
and crypto_hash_sha3512_*(), with both one-shot and streaming APIs.
* Perf
This update for unbound fixes the following issues:
Update to version 1.25.2.
Security issues fixed:
- CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).
- CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records
(bsc#1271892).
- CVE-2026-44621: Libunbound applications configured with `unwanted-reply-threshold` could eventually be abruptly
terminated (bsc#1271876).
- CVE-2026-44687: Off-by-one error in `harden-below-nxdomain` logic can shadow a stub/forward zone by a legitimate
parent's `NXDOMAIN` (bsc#1271893).
- CVE-2026-44690: C