SB2026082052 - openEuler 24.03 LTS SP4 update for unbound
Published: August 20, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 16 vulnerabilities.
1) Heap-based buffer overflow (CVE-ID: CVE-2026-40691)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to heap-based buffer overflow in the DNSCrypt packet reading and reply encryption procedure when processing a crafted DNSCrypt query over TCP. A remote attacker can send a specially crafted DNSCrypt query to cause a denial of service.
Only installations compiled with DNSCrypt support and configured with the dnscrypt feature enabled for listening interfaces are vulnerable.
2) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-42955)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to extend the ghost domain window.
The vulnerability exists due to improper cache handling in the handling of cached parent-side A/AAAA glue rrsets when processing A/AAAA queries for a ghost zone. A remote user can trigger a client A/AAAA query to extend the ghost domain window.
Exploitation requires control of a ghost zone and the ability to query a vulnerable resolver. In configurations with 'harden-referral-path: yes' enabled, no client query is required because the resolver performs the query implicitly.
3) Improper access control (CVE-ID: CVE-2026-44621)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper access control in the libworker_alloc_cleanup function call allow list in libunbound when processing enough wrong-transaction-ID UDP replies to cross the unwanted-reply-threshold. A remote attacker can send crafted UDP replies to cause a denial of service.
Only applications using libunbound with 'unwanted-reply-threshold' set to a non-zero value are vulnerable. Unbound itself is not affected.
4) Off-by-one (CVE-ID: CVE-2026-44687)
CWE-ID: CWE-193 - Off-by-one Error
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an off-by-one error in harden-below-nxdomain logic when processing queries for the intermediate label between a configured stub or forward zone apex and its DNSSEC parent zone. A remote attacker can send a specially crafted query to cause a denial of service.
The issue can prevent the configured stub or forward upstream from being contacted by causing a DNSSEC-secure NXDOMAIN answer from the public parent to shadow the zone.
5) Input validation error (CVE-ID: CVE-2026-44690)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to poison the DNS cache and cause DNS responses for arbitrary sibling zones to be treated as insecure.
The vulnerability exists due to improper input validation in aggressive NSEC processing when processing malicious DNS responses containing fraudulent wildcard DS records and invalid RRSIG labels. A remote attacker can control a single delegated zone and serve crafted DNS responses to poison the DNS cache and cause DNS responses for arbitrary sibling zones to be treated as insecure.
Exploitation requires Unbound to be configured with aggressive-nsec and the attacker to control one registered domain under an NSEC-signed parent domain.
6) Insufficient verification of data authenticity (CVE-ID: CVE-2026-46582)
CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to poison the DNS cache and cause incorrect DNS resolution.
The vulnerability exists due to improper cache state management in the rrset cache and DNSSEC validation logic when processing injected wildcard rrsets on the serve expired path. A remote attacker can inject a signed wildcard rrset without the accompanying NSEC rrset to poison the DNS cache and cause incorrect DNS resolution.
Exploitation requires a DNSSEC-signed domain controlled by the attacker and a CNAME wrapper record pointing to a record adjacent to a wildcard that could cover it.
7) Use-after-free (CVE-ID: CVE-2026-50046)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a use-after-free in the DNS-over-TLS forwarding logic when handling forwarded queries during TLS handshake error paths. A remote attacker can query records in the appropriate zone while keeping the daemon under pressure to trigger the vulnerable error path and cause a denial of service.
Exploitation requires a stub or forward zone configured for DNS-over-TLS together with a configured authname suffix on the server identification, and transient connectivity failure at a precise time during the handshake.
8) Input validation error (CVE-ID: CVE-2026-50243)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to redirect DNSSEC-protected responses to an operator-configured IP.
The vulnerability exists due to improper input validation in the response-ip/RPZ-IP rewriting handler when processing rewritten upstream A/AAAA answers with invalid DNSSEC signatures. A remote attacker can spoof a BOGUS A/AAAA answer to redirect DNSSEC-protected responses to an operator-configured IP.
Exploitation requires Unbound to be configured with the respip module in front of the validator together with a response-ip redirect rule or an RPZ file with an RPZ-IP trigger.
9) Insufficient verification of data authenticity (CVE-ID: CVE-2026-50248)
CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to replace the entire zone data or the resolver's entire response policy.
The vulnerability exists due to improper validation of configured primary hostnames in auth/rpz zone XFR endpoint selection when resolving a configured primary hostname to BOGUS A/AAAA records. A remote attacker can spoof the hostname's A/AAAA record to replace the entire zone data or the resolver's entire response policy.
No valid RRSIG is required for exploitation.
10) Improper handling of exceptional conditions (CVE-ID: CVE-2026-50251)
CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of unwanted replies in the iterator when processing in-bailiwick glue records of 0.0.0.0/::0 with 'unwanted-reply-threshold' enabled. A remote attacker can control a delegation that returns crafted glue records to cause a denial of service.
The issue can repeatedly trigger defensive clearing of the message and rrset caches, and does not require sending spoofed packets.
11) Improper access control (CVE-ID: CVE-2026-55708)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass local DNS policy protections.
The vulnerability exists due to improper access control in the unbound-control view_local_data and view_local_datas command handling when creating local zones for an already configured named view with no local data. A remote user can invoke the control interface to bypass local DNS policy protections.
Queries for default-protected names from clients mapped to the affected view may be forwarded to the public DNS instead of being answered locally.
12) NULL pointer dereference (CVE-ID: CVE-2026-55717)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a NULL pointer dereference in the serve-expired-client-timeout callback when processing delayed responses involving a respip-generated CNAME alias. A remote attacker can control a delegated domain and delay an answer so the vulnerable code path is reached to cause a denial of service.
The issue occurs when 'serve-expired: yes' is used together with a 'response-ip: redirect' and 'response-ip-data: CNAME' rule, or the equivalent RPZ cname override configuration.
13) Improper Initialization (CVE-ID: CVE-2026-55990)
CWE-ID: CWE-665 - Improper Initialization
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper initialization in the DNSCrypt certificate array handling in Unbound when processing a UDP datagram sent to dnscrypt-port under a faulty DNSCrypt configuration with more certificate files than matching secret key files. A remote attacker can send a specially crafted UDP datagram whose first 8 bytes are 0xdb to cause a denial of service.
Only installations compiled with DNSCrypt support are affected, and exploitation requires a silent faulty configuration in which the number of dnscrypt-provider-cert files exceeds the number of matching dnscrypt-secret-key files.
14) Heap-based buffer overflow (CVE-ID: CVE-2026-56416)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a heap-based buffer overflow in query_dname_tolower() when validating DNSSEC-signed PX, RP, MINFO, or SOA RRsets with truncated multi-dname RDATA. A remote attacker can serve a specially crafted DNS record with an absent second domain name to cause a denial of service.
Exploitation requires control of a DNSSEC-signed authoritative server, and the outcome depends on heap memory layout and buffer contents.
15) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-56444)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper state management in the serve-expired logic when handling duplicate in-flight queries for a client-controlled slow-on-demand authoritative zone. A remote attacker can issue crafted queries to cause a denial of service.
Only configurations with 'serve-expired: yes' and 'serve-expired-client-timeout > discard-timeout > 0' are vulnerable, while the shipped default values make the affected branch unreachable.
16) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-40622)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to extend the ghost domain window.
The vulnerability exists due to improper handling of cached parent-side referral NS records in Unbound when processing NS queries for a ghost zone. A remote attacker can control a ghost zone and trigger replacement of an expired parent-side referral NS rrset with the child-side apex NS rrset to extend the ghost domain window.
In configurations with 'harden-referral-path: yes', no client NS query is required because the resolver performs that query implicitly.
Remediation
Install update from vendor's website.