[oss-security] Unbound: 1.26.1 addresses multiple CVE items

[Yorgos Thessalonikefs]

Hi there,

(The official announcement can be found at:
https://community.nlnetlabs.nl/t/unbound-1-26-1-released/3463)

Several vulnerabilities were found in Unbound.



The overview of the vulnerabilities with a brief description is:

CVE-2026-81642 - severity: CRITICAL


CVE-2026-81634 - severity: HIGH
Possible heap buffer overflow during DNSSEC canonicalization

CVE-2026-82717 - severity: HIGH
CNAME synthesis could lead to heap corruption

CVE-2026-77955 - severity: MEDIUM
Possible ZONEMD verification bypass window

CVE-2026-78227 - severity: MEDIUM
Use-after-free in DoQ stream output buffer on reset re-transmission

CVE-2026-80225 - severity: MEDIUM


CVE-2026-82720 - severity: MEDIUM
Use-after-free in DoH stream cleanup code path

CVE-2026-85501 - severity: MEDIUM


CVE-2026-77860 - severity: LOW
'serve-expired' can bypass Unbound 'wait-limit'


More information about the vulnerabilities can be found at:
https://nlnetlabs.nl/projects/unbound/security-advisories/


Best regards,
-- Yorgos, on behalf of the Unbound team.


** This email is signed. Keys of the NLnet Labs people are published on
https://www.nlnetlabs.nl/people/ **

We are releasing 1.26.1 as a security release today (September 16) including the relevant fixes. Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY Possible degradation of service from continuous queries on the same TCP/DoT connection Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC

OpenPGP_signature.asc
Description: OpenPGP digital signature