SB2026091656 - Fedora 44 update for unbound
Published: September 16, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 vulnerabilities.
1) Out-of-bounds write (CVE-ID: CVE-2026-81642)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code or cause a denial of service.
The vulnerability exists due to a buffer overflow in Unbound's DNSSEC validator when processing a DNSKEY with an owner compression pointer to its own RDATA. A remote attacker can control a malicious zone and query a vulnerable Unbound instance to execute arbitrary code or cause a denial of service.
2) Heap-based buffer overflow (CVE-ID: CVE-2026-81634)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause memory corruption.
The vulnerability exists due to improper buffer length validation in the RRSet canonicalisation routine when processing a 255-length query name with a large TCP response. A remote attacker can provide a crafted DNS response to cause memory corruption.
Canonicalisation occurs before DNSSEC validation.
3) Heap-based buffer overflow (CVE-ID: CVE-2026-82717)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to a heap-based buffer overflow in the CNAME synthesis packet-buffer handling logic when processing a crafted upstream DNS response that requires max TTL rewriting. A remote attacker can send a specially crafted upstream DNS response to execute arbitrary code.
Successful code execution depends on the system configuration, compilation options, and heap memory layout.
4) Race condition (CVE-ID: CVE-2026-77955)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause tampered zone contents to be served or stored on disk.
The vulnerability exists due to a race condition caused by asynchronous DS/DNSKEY resolution in ZONEMD validation for configured zones when validating ZONEMD-configured zones located below, but not at, a trust anchor. A remote attacker can exploit the validation window to cause tampered zone contents to become available before integrity verification completes.
When zonefile writing is enabled, data from a failed verification can persist on disk and be reloaded after restart until verification concludes again.
5) Use-after-free (CVE-ID: CVE-2026-78227)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in the DNS-over-QUIC stream output buffer handling when processing a client RESET_STREAM and retransmitting a STREAM frame after a PTO timeout. A remote attacker can query the server, withhold acknowledgments, send a RESET_STREAM, and wait for a PTO timeout to cause a denial of service.
Only builds compiled with DNS-over-QUIC support using --with-libngtcp2 are vulnerable.
6) Resource exhaustion (CVE-ID: CVE-2026-80225)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in Unbound's TCP/DoT reading procedure when processing a sustained stream of distinct uncached names over a TCP/DoT connection. A remote attacker can stream distinct uncached names at a sustained rate to cause a denial of service.
7) Use-after-free (CVE-ID: CVE-2026-82720)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in DNS-over-HTTPS stream handling when processing dropped streams during failure code paths. A remote attacker can send appropriate traffic over a single DNS-over-HTTPS connection to terminate the process.
The issue affects builds compiled with DNS-over-HTTPS support using --with-libnghttp2 and requires an RPZ drop query or heavy client traffic.
8) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-85501)
CWE-ID: CWE-407 - Inefficient Algorithmic Complexity
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient algorithmic complexity in the DNSSEC validator's Zone, Algo, KeyTag matching mechanism when processing DNS responses containing numerous mismatched DNSKEY, RRSIG, and DS records. A remote attacker can provide a crafted DNS response to cause a denial of service.
9) Incorrect calculation (CVE-ID: CVE-2026-77860)
CWE-ID: CWE-682 - Incorrect Calculation
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper wait-limit counter management in the serve-expired code path when handling queries for expired cached names. A remote attacker can alternate unanswered queries with queries for expired cached names to cause a denial of service.
Exploitation requires control of an authoritative zone with a short TTL so cached entries expire quickly.
Remediation
Install update from vendor's website.