SB2026081456 - openEuler 24.03 LTS SP3 update for unbound
Published: August 14, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 11 vulnerabilities.
1) Heap-based buffer overflow (CVE-ID: CVE-2026-40691)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to heap-based buffer overflow in the DNSCrypt packet reading and reply encryption procedure when processing a crafted DNSCrypt query over TCP. A remote attacker can send a specially crafted DNSCrypt query to cause a denial of service.
Only installations compiled with DNSCrypt support and configured with the dnscrypt feature enabled for listening interfaces are vulnerable.
2) Improper access control (CVE-ID: CVE-2026-44621)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper access control in the libworker_alloc_cleanup function call allow list in libunbound when processing enough wrong-transaction-ID UDP replies to cross the unwanted-reply-threshold. A remote attacker can send crafted UDP replies to cause a denial of service.
Only applications using libunbound with 'unwanted-reply-threshold' set to a non-zero value are vulnerable. Unbound itself is not affected.
3) Input validation error (CVE-ID: CVE-2026-44690)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to poison the DNS cache and cause DNS responses for arbitrary sibling zones to be treated as insecure.
The vulnerability exists due to improper input validation in aggressive NSEC processing when processing malicious DNS responses containing fraudulent wildcard DS records and invalid RRSIG labels. A remote attacker can control a single delegated zone and serve crafted DNS responses to poison the DNS cache and cause DNS responses for arbitrary sibling zones to be treated as insecure.
Exploitation requires Unbound to be configured with aggressive-nsec and the attacker to control one registered domain under an NSEC-signed parent domain.
4) Insufficient verification of data authenticity (CVE-ID: CVE-2026-46582)
CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to poison the DNS cache and cause incorrect DNS resolution.
The vulnerability exists due to improper cache state management in the rrset cache and DNSSEC validation logic when processing injected wildcard rrsets on the serve expired path. A remote attacker can inject a signed wildcard rrset without the accompanying NSEC rrset to poison the DNS cache and cause incorrect DNS resolution.
Exploitation requires a DNSSEC-signed domain controlled by the attacker and a CNAME wrapper record pointing to a record adjacent to a wildcard that could cover it.
5) Input validation error (CVE-ID: CVE-2026-50243)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to redirect DNSSEC-protected responses to an operator-configured IP.
The vulnerability exists due to improper input validation in the response-ip/RPZ-IP rewriting handler when processing rewritten upstream A/AAAA answers with invalid DNSSEC signatures. A remote attacker can spoof a BOGUS A/AAAA answer to redirect DNSSEC-protected responses to an operator-configured IP.
Exploitation requires Unbound to be configured with the respip module in front of the validator together with a response-ip redirect rule or an RPZ file with an RPZ-IP trigger.
6) Insufficient verification of data authenticity (CVE-ID: CVE-2026-50248)
CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to replace the entire zone data or the resolver's entire response policy.
The vulnerability exists due to improper validation of configured primary hostnames in auth/rpz zone XFR endpoint selection when resolving a configured primary hostname to BOGUS A/AAAA records. A remote attacker can spoof the hostname's A/AAAA record to replace the entire zone data or the resolver's entire response policy.
No valid RRSIG is required for exploitation.
7) Improper handling of exceptional conditions (CVE-ID: CVE-2026-50251)
CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of unwanted replies in the iterator when processing in-bailiwick glue records of 0.0.0.0/::0 with 'unwanted-reply-threshold' enabled. A remote attacker can control a delegation that returns crafted glue records to cause a denial of service.
The issue can repeatedly trigger defensive clearing of the message and rrset caches, and does not require sending spoofed packets.
8) Improper access control (CVE-ID: CVE-2026-55708)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass local DNS policy protections.
The vulnerability exists due to improper access control in the unbound-control view_local_data and view_local_datas command handling when creating local zones for an already configured named view with no local data. A remote user can invoke the control interface to bypass local DNS policy protections.
Queries for default-protected names from clients mapped to the affected view may be forwarded to the public DNS instead of being answered locally.
9) NULL pointer dereference (CVE-ID: CVE-2026-55717)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a NULL pointer dereference in the serve-expired-client-timeout callback when processing delayed responses involving a respip-generated CNAME alias. A remote attacker can control a delegated domain and delay an answer so the vulnerable code path is reached to cause a denial of service.
The issue occurs when 'serve-expired: yes' is used together with a 'response-ip: redirect' and 'response-ip-data: CNAME' rule, or the equivalent RPZ cname override configuration.
10) Improper Initialization (CVE-ID: CVE-2026-55990)
CWE-ID: CWE-665 - Improper Initialization
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper initialization in the DNSCrypt certificate array handling in Unbound when processing a UDP datagram sent to dnscrypt-port under a faulty DNSCrypt configuration with more certificate files than matching secret key files. A remote attacker can send a specially crafted UDP datagram whose first 8 bytes are 0xdb to cause a denial of service.
Only installations compiled with DNSCrypt support are affected, and exploitation requires a silent faulty configuration in which the number of dnscrypt-provider-cert files exceeds the number of matching dnscrypt-secret-key files.
11) Heap-based buffer overflow (CVE-ID: CVE-2026-56416)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a heap-based buffer overflow in query_dname_tolower() when validating DNSSEC-signed PX, RP, MINFO, or SOA RRsets with truncated multi-dname RDATA. A remote attacker can serve a specially crafted DNS record with an absent second domain name to cause a denial of service.
Exploitation requires control of a DNSSEC-signed authoritative server, and the outcome depends on heap memory layout and buffer contents.
Remediation
Install update from vendor's website.