SB2026102193 - Multiple vulnerabilities in Unbound

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026102193

SB2026102193 - Multiple vulnerabilities in Unbound

Published: October 21, 2026

Security Bulletin ID SB2026102193
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 80% Low 20%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Observable discrepancy (CVE-ID: CVE-2026-109125)

CWE-ID: CWE-203 - Observable discrepancy

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to discover the upstream UDP source port used by a recursive query and potentially poison the DNS cache.

The vulnerability exists due to an observable cache-state discrepancy in Unbound's unwanted-reply handling when reaching the configured threshold clears cached records but leaves pending upstream UDP queries active. A remote attacker can send response-like UDP datagrams with nonmatching transaction IDs to candidate ports and check whether cached items disappear to identify the active source port, then attempt birthday-style transaction ID guessing to poison the cache if a concurrent query window can be kept alive.

Exposure requires the nondefault configuration unwanted-reply-threshold > 0.


2) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-35501)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass DNSSEC validation and cause a configured trust-anchor zone to be treated as insecure.

The vulnerability exists due to improper cryptographic signature verification in the Unbound DNSSEC validator when processing NSEC replies at a configured trust anchor apex. A remote attacker can supply a forged NSEC reply with the SOA bit cleared to have it accepted and cached without RRSIG validation, causing the configured trust island to be treated as insecure when both a root trust anchor and an additional island-of-security trust anchor are configured and the island's parent is provably insecure under the root chain.


3) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-50106)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass DNSSEC validation and deny resolution of records within an island-of-security zone.

The vulnerability exists due to improper verification of DNSSEC signatures in Unbound's validator when processing denial-of-existence responses for an island-of-security zone configured with an additional trust anchor alongside a root trust anchor, where the zone's parent is provably insecure under the root chain. A remote attacker can deliver a single forged NXDOMAIN response for a name inside the island, with the NSEC/SOA RRSIG SignerName set to the insecure parent, to make the validator use the root trust anchor and then the insecure parent, incorrectly accepting the denial of existence as insecure.


4) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-96405)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service through excessive CPU consumption and degraded resolver performance.

The vulnerability exists due to insufficient limits on aggregate decompression work in Unbound's DNS decompression processing when decompressing upstream replies and zone transfer packets. A remote attacker can supply specially crafted DNS replies containing many chained compression pointers to consume excessive CPU resources and degrade resolver performance.

Exploitation requires recursive-query access and control of an ordinarily delegated authority.


5) Use-after-free (CVE-ID: CVE-2026-97206)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by crashing Unbound.

The vulnerability exists due to use-after-free in Unbound's DNS-over-QUIC stream cleanup when handling client-triggered QUIC path migration during multi-threaded operation. A remote attacker can trigger path migration while a pending mesh reply retains a pointer to a DoQ stream, causing the reply to dereference the stream after cleanup frees it, to crash the service.


Remediation

Install update from vendor's website.

References