SB2026062632 - Anolis OS update for unbound
Published: June 26, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 vulnerabilities.
1) Heap-based buffer overflow (CVE-ID: CVE-2026-32792)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a heap-based buffer overflow in Unbound's DNSCrypt packet reading procedure when processing a crafted DNSCrypt query. A remote attacker can send a specially crafted DNSCrypt query to cause a denial of service.
Only installations compiled with DNSCrypt support are vulnerable. The crafted query's decrypted plaintext consists entirely of 0x00 bytes and lacks the expected 0x80 marker. A crash depends on the underlying memory allocator and memory layout.
2) Use-after-free (CVE-ID: CVE-2026-33278)
CWE-ID: CWE-416 - Use After Free
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.
The vulnerability exists due to use-after-free in Unbound DNSSEC validator when processing validation state for DS sub-queries after deep-copying response messages during NSEC3 computational budget exhaustion. A remote attacker can control a malicious signed zone and query a vulnerable resolver to cause a denial of service and potentially execute arbitrary code.
Exploitation requires control of a malicious signed zone.
3) Resource exhaustion (CVE-ID: CVE-2026-42923)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper resource management in Unbound's DNSSEC validator negative cache handling for DS records when processing DNSSEC-signed zones with NSEC3 records using high iteration counts for child delegations. A remote attacker can control a DNSSEC-signed zone and query a vulnerable Unbound resolver to cause a denial of service.
A global lock for the negative cache may be held for the duration of the hashing, blocking other threads that need to consult the negative cache.
4) Heap-based buffer overflow (CVE-ID: CVE-2026-42944)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a heap-based buffer overflow in the EDNS option encoder when processing queries containing multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options. A remote attacker can send a specially crafted query to cause a denial of service.
Only instances with the relevant EDNS options enabled are vulnerable.
5) Access of Uninitialized Pointer (CVE-ID: CVE-2026-42959)
CWE-ID: CWE-824 - Access of Uninitialized Pointer
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use of an uninitialized pointer in the DNSSEC validator when constructing chase-reply messages for validation. A remote attacker can provide a malicious upstream reply to cause a denial of service.
Exploitation requires control of a DNSSEC-signed domain and can be triggered with a single query using a DNAME chain with unsigned CNAMEs and a response containing unsigned AUTHORITY records alongside signed ADDITIONAL glue records.
6) Insufficient verification of data authenticity (CVE-ID: CVE-2026-42960)
CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to poison Unbound's DNS cache.
The vulnerability exists due to improper cache validation in processing authority and additional section RRSets when handling spoofed DNS replies or fragmented responses. A remote attacker can inject non-NS RRSets accompanied by related address records to poison Unbound's DNS cache.
Exploitation requires the ability to attach malicious records to a reply, such as through packet spoofing or fragmentation attacks.
7) Insufficient verification of data authenticity (CVE-ID: CVE-2025-11411)
CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to poison DNS cache.
The vulnerability exists due to incorrect processing of DNS responses contain NS RRSets records. A remote attacker can poison DNS cache of the affected server.8) Use-after-free (CVE-ID: CVE-2026-44608)
CWE-ID: CWE-416 - Use After Free
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in RPZ zone handling when processing an RPZ XFR reload concurrently with reads of an RPZ zone using 'rpz-nsip' or 'rpz-nsdname' triggers. A remote attacker can trigger a crafted zone transfer timing condition to cause a denial of service.
Only multi-threaded deployments are affected, and local RPZ files do not trigger the vulnerability.
Remediation
Install update from vendor's website.