SB2026082051 - openEuler 20.03 LTS SP4 update for unbound

Description

This security bulletin contains information about 4 vulnerabilities.

1) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-42955)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to extend the ghost domain window.

The vulnerability exists due to improper cache handling in the handling of cached parent-side A/AAAA glue rrsets when processing A/AAAA queries for a ghost zone. A remote user can trigger a client A/AAAA query to extend the ghost domain window.

Exploitation requires control of a ghost zone and the ability to query a vulnerable resolver. In configurations with 'harden-referral-path: yes' enabled, no client query is required because the resolver performs the query implicitly.

2) Off-by-one (CVE-ID: CVE-2026-44687)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an off-by-one error in harden-below-nxdomain logic when processing queries for the intermediate label between a configured stub or forward zone apex and its DNSSEC parent zone. A remote attacker can send a specially crafted query to cause a denial of service.

The issue can prevent the configured stub or forward upstream from being contacted by causing a DNSSEC-secure NXDOMAIN answer from the public parent to shadow the zone.

3) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-56444)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in the serve-expired logic when handling duplicate in-flight queries for a client-controlled slow-on-demand authoritative zone. A remote attacker can issue crafted queries to cause a denial of service.

Only configurations with 'serve-expired: yes' and 'serve-expired-client-timeout > discard-timeout > 0' are vulnerable, while the shipped default values make the affected branch unreachable.

4) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-40622)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to extend the ghost domain window.

The vulnerability exists due to improper handling of cached parent-side referral NS records in Unbound when processing NS queries for a ghost zone. A remote attacker can control a ghost zone and trigger replacement of an expired parent-side referral NS rrset with the child-side apex NS rrset to extend the ghost domain window.

In configurations with 'harden-referral-path: yes', no client NS query is required because the resolver performs that query implicitly.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-3437