This update for unbound fixes the following issues:
- CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' (bsc#1280403).
- CVE-2026-77955: Possible ZONEMD verification bypass window (bsc#1280404).
- CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission (bsc#1280405).
- CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection (bsc#1280406).
- CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization (bsc#1280409).
- CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (bsc#1280411).
- CVE-2026-827
This update for unbound fixes the following issues:
Update to version 1.25.2.
Security issues fixed:
- CVE-2026-14586: DoS via assertion in `libngtcp2` for DNS-over-QUIC environments with high concurrency (bsc#1271879).
- CVE-2026-32665: Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass (bsc#1271873).
- CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).
- CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries
(bsc#1271891).
- CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured
This update for unbound fixes the following issues:
Update to 1.22.0:
- CVE-2024-8508: Fixed unbounded name compression that could have led to a denial of service (bsc#1231284).