SB2026081218 - Anolis OS update for unbound
Published: August 12, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 vulnerabilities.
1) Input validation error (CVE-ID: CVE-2026-44690)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to poison the DNS cache and cause DNS responses for arbitrary sibling zones to be treated as insecure.
The vulnerability exists due to improper input validation in aggressive NSEC processing when processing malicious DNS responses containing fraudulent wildcard DS records and invalid RRSIG labels. A remote attacker can control a single delegated zone and serve crafted DNS responses to poison the DNS cache and cause DNS responses for arbitrary sibling zones to be treated as insecure.
Exploitation requires Unbound to be configured with aggressive-nsec and the attacker to control one registered domain under an NSEC-signed parent domain.
2) Use-after-free (CVE-ID: CVE-2026-50046)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a use-after-free in the DNS-over-TLS forwarding logic when handling forwarded queries during TLS handshake error paths. A remote attacker can query records in the appropriate zone while keeping the daemon under pressure to trigger the vulnerable error path and cause a denial of service.
Exploitation requires a stub or forward zone configured for DNS-over-TLS together with a configured authname suffix on the server identification, and transient connectivity failure at a precise time during the handshake.
3) Improper handling of exceptional conditions (CVE-ID: CVE-2026-50251)
CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of unwanted replies in the iterator when processing in-bailiwick glue records of 0.0.0.0/::0 with 'unwanted-reply-threshold' enabled. A remote attacker can control a delegation that returns crafted glue records to cause a denial of service.
The issue can repeatedly trigger defensive clearing of the message and rrset caches, and does not require sending spoofed packets.
4) Improper Initialization (CVE-ID: CVE-2026-55990)
CWE-ID: CWE-665 - Improper Initialization
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper initialization in the DNSCrypt certificate array handling in Unbound when processing a UDP datagram sent to dnscrypt-port under a faulty DNSCrypt configuration with more certificate files than matching secret key files. A remote attacker can send a specially crafted UDP datagram whose first 8 bytes are 0xdb to cause a denial of service.
Only installations compiled with DNSCrypt support are affected, and exploitation requires a silent faulty configuration in which the number of dnscrypt-provider-cert files exceeds the number of matching dnscrypt-secret-key files.
5) Heap-based buffer overflow (CVE-ID: CVE-2026-56416)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a heap-based buffer overflow in query_dname_tolower() when validating DNSSEC-signed PX, RP, MINFO, or SOA RRsets with truncated multi-dname RDATA. A remote attacker can serve a specially crafted DNS record with an absent second domain name to cause a denial of service.
Exploitation requires control of a DNSSEC-signed authoritative server, and the outcome depends on heap memory layout and buffer contents.
Remediation
Install update from vendor's website.