SB2026103126 - Ubuntu update for unbound
Published: October 31, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 10 vulnerabilities.
1) Resource exhaustion (CVE-ID: CVE-2026-80225)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in Unbound's TCP/DoT reading procedure when processing a sustained stream of distinct uncached names over a TCP/DoT connection. A remote attacker can stream distinct uncached names at a sustained rate to cause a denial of service.
2) Heap-based buffer overflow (CVE-ID: CVE-2026-81634)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause memory corruption.
The vulnerability exists due to improper buffer length validation in the RRSet canonicalisation routine when processing a 255-length query name with a large TCP response. A remote attacker can provide a crafted DNS response to cause memory corruption.
Canonicalisation occurs before DNSSEC validation.
3) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-85501)
CWE-ID: CWE-407 - Inefficient Algorithmic Complexity
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient algorithmic complexity in the DNSSEC validator's Zone, Algo, KeyTag matching mechanism when processing DNS responses containing numerous mismatched DNSKEY, RRSIG, and DS records. A remote attacker can provide a crafted DNS response to cause a denial of service.
4) Use of insufficiently random values (CVE-ID: CVE-2026-50252)
CWE-ID: CWE-330 - Use of Insufficiently Random Values
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to conduct DNS cache poisoning attacks.
The vulnerability exists due to improper randomness management in UDP source port selection when handling DNS queries with the SO_REUSEPORT configuration option enabled. A remote attacker can send queries and observe outgoing source ports to conduct DNS cache poisoning attacks.
The issue occurs because worker threads use disjoint UDP source port subsets, allowing observed outgoing source ports to reveal which thread processed the original query.
5) Heap-based buffer overflow (CVE-ID: CVE-2026-40691)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to heap-based buffer overflow in the DNSCrypt packet reading and reply encryption procedure when processing a crafted DNSCrypt query over TCP. A remote attacker can send a specially crafted DNSCrypt query to cause a denial of service.
Only installations compiled with DNSCrypt support and configured with the dnscrypt feature enabled for listening interfaces are vulnerable.
6) Input validation error (CVE-ID: CVE-2026-44690)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to poison the DNS cache and cause DNS responses for arbitrary sibling zones to be treated as insecure.
The vulnerability exists due to improper input validation in aggressive NSEC processing when processing malicious DNS responses containing fraudulent wildcard DS records and invalid RRSIG labels. A remote attacker can control a single delegated zone and serve crafted DNS responses to poison the DNS cache and cause DNS responses for arbitrary sibling zones to be treated as insecure.
Exploitation requires Unbound to be configured with aggressive-nsec and the attacker to control one registered domain under an NSEC-signed parent domain.
7) Input validation error (CVE-ID: CVE-2026-32665)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service for new DoQ clients.
The vulnerability exists due to improper input validation in the downstream DNS-over-QUIC implementation when processing client-provided stream length values on new QUIC connections. A remote attacker can send specially crafted QUIC streams with large declared lengths to cause a denial of service for new DoQ clients.
The issue affects the first two bidirectional streams on a new QUIC connection and requires Unbound to be built with DoQ support and configured to listen on a quic-port.
8) Stack-based buffer overflow (CVE-ID: CVE-2026-55973)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a stack-based buffer overflow in find_closest_of_type() when processing a crafted upstream DNS response containing an EDNS Report-Channel option. A remote attacker can send a specially crafted upstream response from a delegated zone they control to cause a denial of service.
The issue is reachable only when 'dns-error-reporting: yes' is enabled.
9) Resource exhaustion (CVE-ID: CVE-2023-50387)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation when processing DNSSEC related records. A remote attacker can trigger resource exhaustion by forcing the DNS server to query a specially crafted DNSSEC zone and perform a denial of service (DoS) attack.
10) Resource exhaustion (CVE-ID: CVE-2023-50868)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation when processing DNSSEC related records. A remote attacker can trigger resource exhaustion by forcing the DNS server to query a specially crafted DNSSEC zone and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.