Hi all, Prepared fixes for a batch of unbound CVEs against bookworm's 1.17.1. I'd originally sent this to [email protected], since it doesn't appear on dla-needed.txt or dsa-needed.txt and none of the CVEs carry a no-dsa note either, so I wasn't sure which track it belonged on. Moritz Mühlenhoff clarified that bookworm security updates are entirely LTS's now, so following up here instead.
The security tracker lists 43 open issues for bookworm, but 12 of those have an affected-version range that starts after 1.17.1 (the vulnerable code was added by a later feature), so they don't actually apply here - checked each one's real "affected products" range against bookworm's version rather than trusting the tracker's flat "vulnerable" status. That leaves 31 genuinely applicable CVEs, of which 21 are fixed and verified so far: CVE-2026-40622, 41292, 42923, 42959, 42960, 44390, 44608, 44621, 44687, 44690, 46582, 50046, 50243, 50248, 50251, 55708, 55717, 56416, 80225, 81634, 81642. Every patch is verified against the real bookworm source with a full build and the complete test suite (zero fuzz, all tests passing), not just a clean apply. MR here: https://salsa.debian.org/dns-team/unbound/-/merge_requests/29 Three more are set aside deliberately rather than shipped: one caused a real regression in the test suite once adapted (a glue-record TTL clamp that ended up too broad), one has a patch hunk that still won't apply cleanly for reasons I haven't fully tracked down yet, and one (a ZONEMD timing fix) needs more adaptation work than I've finished. The remaining 7, including CVE-2026-85501 (a much larger DNSSEC algorithmic-complexity fix touching 21 files), are still in progress. Happy to send the rest as a follow-up once ready, or fold them into this MR if that's preferred. Ivo
