SB2026072350 - Multiple vulnerabilities in Unbound

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026072350

SB2026072350 - Multiple vulnerabilities in Unbound

Published: July 23, 2026

Security Bulletin ID SB2026072350
CSH Severity
High
Patch available
YES
Number of vulnerabilities 24
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 4% Medium 83% Low 13%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 24 vulnerabilities.


1) Incorrect calculation (CVE-ID: CVE-2026-14586)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper time source selection in the DNS-over-QUIC interface with libngtcp2 when handling high-concurrency DNS-over-QUIC traffic under pressure. A remote attacker can send concurrent DNS-over-QUIC traffic to trigger an assertion and terminate the server to cause a denial of service.

Only instances compiled with DNS-over-QUIC support and configured to listen on a QUIC port are vulnerable.


2) Input validation error (CVE-ID: CVE-2026-32665)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service for new DoQ clients.

The vulnerability exists due to improper input validation in the downstream DNS-over-QUIC implementation when processing client-provided stream length values on new QUIC connections. A remote attacker can send specially crafted QUIC streams with large declared lengths to cause a denial of service for new DoQ clients.

The issue affects the first two bidirectional streams on a new QUIC connection and requires Unbound to be built with DoQ support and configured to listen on a quic-port.


3) Heap-based buffer overflow (CVE-ID: CVE-2026-40691)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to heap-based buffer overflow in the DNSCrypt packet reading and reply encryption procedure when processing a crafted DNSCrypt query over TCP. A remote attacker can send a specially crafted DNSCrypt query to cause a denial of service.

Only installations compiled with DNSCrypt support and configured with the dnscrypt feature enabled for listening interfaces are vulnerable.


4) Resource exhaustion (CVE-ID: CVE-2026-41637)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource accounting in the DNS-over-QUIC query handling component when processing queries that are terminated by QUIC control frames. A remote attacker can send DNS-over-QUIC queries for names that require resolution and immediately terminate them to cause a denial of service.

Only deployments built with DNS-over-QUIC support and configured to listen on a QUIC port are vulnerable. Exploitation additionally requires access to multiple source IP addresses to bypass the default wait-limit setting.


5) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-42955)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to extend the ghost domain window.

The vulnerability exists due to improper cache handling in the handling of cached parent-side A/AAAA glue rrsets when processing A/AAAA queries for a ghost zone. A remote user can trigger a client A/AAAA query to extend the ghost domain window.

Exploitation requires control of a ghost zone and the ability to query a vulnerable resolver. In configurations with 'harden-referral-path: yes' enabled, no client query is required because the resolver performs the query implicitly.


6) Improper access control (CVE-ID: CVE-2026-44621)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper access control in the libworker_alloc_cleanup function call allow list in libunbound when processing enough wrong-transaction-ID UDP replies to cross the unwanted-reply-threshold. A remote attacker can send crafted UDP replies to cause a denial of service.

Only applications using libunbound with 'unwanted-reply-threshold' set to a non-zero value are vulnerable. Unbound itself is not affected.


7) Off-by-one (CVE-ID: CVE-2026-44687)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an off-by-one error in harden-below-nxdomain logic when processing queries for the intermediate label between a configured stub or forward zone apex and its DNSSEC parent zone. A remote attacker can send a specially crafted query to cause a denial of service.

The issue can prevent the configured stub or forward upstream from being contacted by causing a DNSSEC-secure NXDOMAIN answer from the public parent to shadow the zone.


8) Input validation error (CVE-ID: CVE-2026-44690)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to poison the DNS cache and cause DNS responses for arbitrary sibling zones to be treated as insecure.

The vulnerability exists due to improper input validation in aggressive NSEC processing when processing malicious DNS responses containing fraudulent wildcard DS records and invalid RRSIG labels. A remote attacker can control a single delegated zone and serve crafted DNS responses to poison the DNS cache and cause DNS responses for arbitrary sibling zones to be treated as insecure.

Exploitation requires Unbound to be configured with aggressive-nsec and the attacker to control one registered domain under an NSEC-signed parent domain.


9) Insufficient verification of data authenticity (CVE-ID: CVE-2026-46582)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to poison the DNS cache and cause incorrect DNS resolution.

The vulnerability exists due to improper cache state management in the rrset cache and DNSSEC validation logic when processing injected wildcard rrsets on the serve expired path. A remote attacker can inject a signed wildcard rrset without the accompanying NSEC rrset to poison the DNS cache and cause incorrect DNS resolution.

Exploitation requires a DNSSEC-signed domain controlled by the attacker and a CNAME wrapper record pointing to a record adjacent to a wildcard that could cover it.


10) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-50045)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to bypass upstream amplification traffic limits.

The vulnerability exists due to improper resource management in the DNSSEC validator when processing a single client query for a deeply nested name under a DNSSEC-signed parent. A remote attacker can send a specially crafted query to bypass upstream amplification traffic limits.


11) Use-after-free (CVE-ID: CVE-2026-50046)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in the DNS-over-TLS forwarding logic when handling forwarded queries during TLS handshake error paths. A remote attacker can query records in the appropriate zone while keeping the daemon under pressure to trigger the vulnerable error path and cause a denial of service.

Exploitation requires a stub or forward zone configured for DNS-over-TLS together with a configured authname suffix on the server identification, and transient connectivity failure at a precise time during the handshake.


12) Input validation error (CVE-ID: CVE-2026-50243)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to redirect DNSSEC-protected responses to an operator-configured IP.

The vulnerability exists due to improper input validation in the response-ip/RPZ-IP rewriting handler when processing rewritten upstream A/AAAA answers with invalid DNSSEC signatures. A remote attacker can spoof a BOGUS A/AAAA answer to redirect DNSSEC-protected responses to an operator-configured IP.

Exploitation requires Unbound to be configured with the respip module in front of the validator together with a response-ip redirect rule or an RPZ file with an RPZ-IP trigger.


13) Insufficient verification of data authenticity (CVE-ID: CVE-2026-50248)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to replace the entire zone data or the resolver's entire response policy.

The vulnerability exists due to improper validation of configured primary hostnames in auth/rpz zone XFR endpoint selection when resolving a configured primary hostname to BOGUS A/AAAA records. A remote attacker can spoof the hostname's A/AAAA record to replace the entire zone data or the resolver's entire response policy.

No valid RRSIG is required for exploitation.


14) Improper handling of exceptional conditions (CVE-ID: CVE-2026-50251)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of unwanted replies in the iterator when processing in-bailiwick glue records of 0.0.0.0/::0 with 'unwanted-reply-threshold' enabled. A remote attacker can control a delegation that returns crafted glue records to cause a denial of service.

The issue can repeatedly trigger defensive clearing of the message and rrset caches, and does not require sending spoofed packets.


15) Use of insufficiently random values (CVE-ID: CVE-2026-50252)

CWE-ID: CWE-330 - Use of Insufficiently Random Values

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to conduct DNS cache poisoning attacks.

The vulnerability exists due to improper randomness management in UDP source port selection when handling DNS queries with the SO_REUSEPORT configuration option enabled. A remote attacker can send queries and observe outgoing source ports to conduct DNS cache poisoning attacks.

The issue occurs because worker threads use disjoint UDP source port subsets, allowing observed outgoing source ports to reveal which thread processed the original query.


16) Use-after-free (CVE-ID: CVE-2026-52863)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to memory corruption in the view name handling for subqueries when processing queries that combine respip or rpz with a module that can attach subqueries under pressure. A remote attacker can send queries that trigger subquery processing and query jostling to cause memory corruption.

Exploitation requires Unbound to be configured with access-control-view together with respip or rpz and a module such as dns64, subnetcache, or respip CNAME redirection, and the issue occurs when slow queries are dropped under pressure.


17) Input validation error (CVE-ID: CVE-2026-54478)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to bypass DNS Cookie source validation.

The vulnerability exists due to improper input validation in DNS server cookie hash calculations on proxy-protocol-port interfaces when handling PROXYv2-declared client addresses with answer-cookie enabled. A remote attacker can obtain a valid server cookie through a proxy and replay it using a spoofed source to bypass DNS Cookie source validation.

Exploitation requires a UDP deployment using proxy protocol on the front end with answer-cookie enabled.


18) Improper access control (CVE-ID: CVE-2026-55708)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to bypass local DNS policy protections.

The vulnerability exists due to improper access control in the unbound-control view_local_data and view_local_datas command handling when creating local zones for an already configured named view with no local data. A remote user can invoke the control interface to bypass local DNS policy protections.

Queries for default-protected names from clients mapped to the affected view may be forwarded to the public DNS instead of being answered locally.


19) NULL pointer dereference (CVE-ID: CVE-2026-55717)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the serve-expired-client-timeout callback when processing delayed responses involving a respip-generated CNAME alias. A remote attacker can control a delegated domain and delay an answer so the vulnerable code path is reached to cause a denial of service.

The issue occurs when 'serve-expired: yes' is used together with a 'response-ip: redirect' and 'response-ip-data: CNAME' rule, or the equivalent RPZ cname override configuration.


20) Stack-based buffer overflow (CVE-ID: CVE-2026-55973)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in find_closest_of_type() when processing a crafted upstream DNS response containing an EDNS Report-Channel option. A remote attacker can send a specially crafted upstream response from a delegated zone they control to cause a denial of service.

The issue is reachable only when 'dns-error-reporting: yes' is enabled.


21) Improper Initialization (CVE-ID: CVE-2026-55990)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper initialization in the DNSCrypt certificate array handling in Unbound when processing a UDP datagram sent to dnscrypt-port under a faulty DNSCrypt configuration with more certificate files than matching secret key files. A remote attacker can send a specially crafted UDP datagram whose first 8 bytes are 0xdb to cause a denial of service.

Only installations compiled with DNSCrypt support are affected, and exploitation requires a silent faulty configuration in which the number of dnscrypt-provider-cert files exceeds the number of matching dnscrypt-secret-key files.


22) Type conversion (CVE-ID: CVE-2026-55991)

CWE-ID: CWE-704 - Type conversion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper type conversion in libngtcp2 error handling in the DNS-over-QUIC handling path when processing a DNS-over-QUIC connection and query. A remote attacker can send a specially crafted DNS-over-QUIC connection and query to cause a denial of service.

Exploitation requires assertions to be enabled and can be triggered by advertising an initial_max_stream_data_bidi_local value of 1 and sending a query without reading the stream.


23) Heap-based buffer overflow (CVE-ID: CVE-2026-56416)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in query_dname_tolower() when validating DNSSEC-signed PX, RP, MINFO, or SOA RRsets with truncated multi-dname RDATA. A remote attacker can serve a specially crafted DNS record with an absent second domain name to cause a denial of service.

Exploitation requires control of a DNSSEC-signed authoritative server, and the outcome depends on heap memory layout and buffer contents.


24) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-56444)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in the serve-expired logic when handling duplicate in-flight queries for a client-controlled slow-on-demand authoritative zone. A remote attacker can issue crafted queries to cause a denial of service.

Only configurations with 'serve-expired: yes' and 'serve-expired-client-timeout > discard-timeout > 0' are vulnerable, while the shipped default values make the affected branch unreachable.


Remediation

Install update from vendor's website.

References