SB2026082054 - openEuler 24.03 LTS SP1 update for unbound
Published: August 20, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 vulnerabilities.
1) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-42955)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to extend the ghost domain window.
The vulnerability exists due to improper cache handling in the handling of cached parent-side A/AAAA glue rrsets when processing A/AAAA queries for a ghost zone. A remote user can trigger a client A/AAAA query to extend the ghost domain window.
Exploitation requires control of a ghost zone and the ability to query a vulnerable resolver. In configurations with 'harden-referral-path: yes' enabled, no client query is required because the resolver performs the query implicitly.
2) Off-by-one (CVE-ID: CVE-2026-44687)
CWE-ID: CWE-193 - Off-by-one Error
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an off-by-one error in harden-below-nxdomain logic when processing queries for the intermediate label between a configured stub or forward zone apex and its DNSSEC parent zone. A remote attacker can send a specially crafted query to cause a denial of service.
The issue can prevent the configured stub or forward upstream from being contacted by causing a DNSSEC-secure NXDOMAIN answer from the public parent to shadow the zone.
3) Use-after-free (CVE-ID: CVE-2026-50046)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a use-after-free in the DNS-over-TLS forwarding logic when handling forwarded queries during TLS handshake error paths. A remote attacker can query records in the appropriate zone while keeping the daemon under pressure to trigger the vulnerable error path and cause a denial of service.
Exploitation requires a stub or forward zone configured for DNS-over-TLS together with a configured authname suffix on the server identification, and transient connectivity failure at a precise time during the handshake.
4) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-56444)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper state management in the serve-expired logic when handling duplicate in-flight queries for a client-controlled slow-on-demand authoritative zone. A remote attacker can issue crafted queries to cause a denial of service.
Only configurations with 'serve-expired: yes' and 'serve-expired-client-timeout > discard-timeout > 0' are vulnerable, while the shipped default values make the affected branch unreachable.
5) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-40622)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to extend the ghost domain window.
The vulnerability exists due to improper handling of cached parent-side referral NS records in Unbound when processing NS queries for a ghost zone. A remote attacker can control a ghost zone and trigger replacement of an expired parent-side referral NS rrset with the child-side apex NS rrset to extend the ghost domain window.
In configurations with 'harden-referral-path: yes', no client NS query is required because the resolver performs that query implicitly.
Remediation
Install update from vendor's website.