Public bug reported:
A new release of unbound is available for merging from Debian.
Ubuntu Proposed: 1.25.1-1ubuntu4
Debian Unstable: 1.26.1-1
### New Debian Changes ###
unbound (1.26.1-1) unstable; urgency=medium
* new upstream security/bugfx release, including the following fixes:
- CVE-2026-81642 - severity: CRITICAL
Heap buffer overflow and possible Remote Code Execution
when digesting DNSKEY
- CVE-2026-81634 - severity: HIGH
Possible heap buffer overflow during DNSSEC canonicalization
- CVE-2026-82717 - severity: HIGH
CNAME synthesis could lead to heap corruption
- CVE-2026-77955 - severity: MEDIUM
Possible ZONEMD verification bypass window
- CVE-2026-78227 - severity: MEDIUM
Use-after-free in DoQ stream output buffer on reset re-transmission
- CVE-2026-80225 - severity: MEDIUM
Possible degradation of service from continuous queries
on the same TCP/DoT connection
- CVE-2026-82720 - severity: MEDIUM
Use-after-free in DoH stream cleanup code path
- CVE-2026-85501 - severity: MEDIUM
Retrap: Novel Vulnerabilities to launch
Algorithmic Complexity Attacks on DNSSEC
- CVE-2026-77860 - severity: LOW
'serve-expired' can bypass Unbound 'wait-limit'
-- Michael Tokarev <[email protected]> Wed, 16 Sep 2026 18:31:09 +0300
unbound (1.26.0-2) unstable; urgency=medium
* replace-removed-Python-2-C-API-macros.patch from upstream
(Closes: #1145860)
-- Michael Tokarev <[email protected]> Mon, 31 Aug 2026 07:18:21 +0300
unbound (1.26.0-1) unstable; urgency=medium
* new upstream release
-- Michael Tokarev <[email protected]> Tue, 04 Aug 2026 11:31:02 +0300
unbound (1.25.2-1) unstable; urgency=medium
* new upstream release addressing the following vulnerabilities:
o CVE-2026-32665 - severity: HIGH
Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass
o CVE-2026-40691 - severity: HIGH
Packet of death for DNSCrypt over TCP
o CVE-2026-44690 - severity: HIGH
Cross-zone wildcard cache poisoning via RRSIG.labels manipulation
o CVE-2026-55973 - severity: HIGH
'dns-error-reporting: yes' leads to stack buffer overflow
o CVE-2026-14586 - severity: MEDIUM
Assertion in libngtcp2 when under pressure in high concurrency
DNS-over-QUIC environments
o CVE-2026-44621 - severity: MEDIUM
Libunbound applications configured with 'unwanted-reply-threshold'
could eventually be abruptly terminated
o CVE-2026-50045 - severity: MEDIUM
'max-global-quota' reset by DNSSEC validation restarts
o CVE-2026-50046 - severity: MEDIUM
Possible heap use-after-free in an error path when
a DoT forwarded query is jostled out
o CVE-2026-50243 - severity: MEDIUM
response-ip/rpz can rewrite BOGUS answers instead of returning SERVFAIL
o CVE-2026-50248 - severity: MEDIUM
BOGUS configured primary hostname accepted for XFR in auth/rpz zones
o CVE-2026-50251 - severity: MEDIUM
Attacker supplied 0.0.0.0/:: glue triggers defensive full-cache flush
o CVE-2026-50252 - severity: MEDIUM
Possible cache poisoning attack by mapping source port population
per thread
o CVE-2026-52863 - severity: MEDIUM
Memory corruption could lead to crash and denial of service
o CVE-2026-55717 - severity: MEDIUM
'serve-expired-client-timeout' and 'response-ip' CNAME redirect
could lead to a crash
o CVE-2026-55990 - severity: MEDIUM
Packet of death for a DNSCrypt misconfigured Unbound
o CVE-2026-55991 - severity: MEDIUM
Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2
o CVE-2026-56416 - severity: MEDIUM
Possible heap buffer overflow when validator canonicalizes RDATA
that contains domain name
o CVE-2026-56444 - severity: MEDIUM
Degradation of resolution service when 'discard-timeout' and
'serve-expired-client-timeout' are combined in unusual configuration
o CVE-2026-41637 - severity: LOW
Degradation of resolution service from improperly accounted
client-terminated DNS-over-QUIC queries
o CVE-2026-42955 - severity: LOW
Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records
disallowing a one-time 'ghost domain' delegation renewal via glue records
o CVE-2026-44687 - severity: LOW
Off-by-one error in 'harden-below-nxdomain' logic can shadow
a stub/forward zone by a legitimate parent's NXDOMAIN
o CVE-2026-46582 - severity: LOW
A wildcard replay, as another piece of data, triggers poisoning
in the serve expired reply path
o CVE-2026-54478 - severity: LOW
DNS Cookie bypass when combined with proxy-protocol use
o CVE-2026-55708 - severity: LOW
Privacy/configuration issue when adding local data in views
through 'unbound-control'
-- Michael Tokarev <[email protected]> Wed, 22 Jul 2026 22:13:25 +0300
### Old Ubuntu Delta ###
unbound (1.25.1-1ubuntu4) stonking; urgency=medium
* d/p/replace-removed-Python-2-C-API-macros.patch: upstream fix for FTBFS
with SWIG 4.5.0+ (LP: #2169795)
-- Dmitrii Kuvaiskii <[email protected]> Thu, 08 Oct
2026 14:44:11 +0500
unbound (1.25.1-1ubuntu3) stonking; urgency=medium
* No-change rebuild against libssl4
-- Ravi Kant Sharma <[email protected]> Fri, 24 Jul 2026
15:28:11 +0000
unbound (1.25.1-1ubuntu2) stonking; urgency=medium
* Fix OpenSSL 4.0 compatibility (LP: #2154915)
- d/p/fix-for-openssl4-compat.patch: upstream fix for opaque
ASN1_STRING and constified X509 accessors
-- Ravi Kant Sharma <[email protected]> Tue, 30 Jun 2026
14:11:41 +0200
unbound (1.25.1-1ubuntu1) stonking; urgency=medium
* Merge with Debian unstable (LP: #2151212).
- This merge will resolve the following bugs:
- unbound-resolvconf.service fails with systemd-resolved (LP: #2078599)
- systemd warns about empty DAEMON_OPTS (LP: #2091977)
- unbound-helper fails to properly detect nameservers (LP: #2092779)
- Remaining changes:
- Don't build with hiredis on i386. hiredis and redis are not built
on i386 and require bootstrapping due to circular
build-dependencies; simpler to just disable this in the i386
unbound server binary (that no one will ever use).
* Drop security patches applied in 1.25.1:
- d/p/CVE-2026-32792.patch
- d/p/CVE-2026-33278.patch
- d/p/CVE-2026-40622.patch
- d/p/CVE-2026-41292.patch
- d/p/CVE-2026-42534.patch
- d/p/CVE-2026-42923.patch
- d/p/CVE-2026-42944.patch
- d/p/CVE-2026-42959.patch
- d/p/CVE-2026-42960.patch
- d/p/CVE-2026-44390.patch
- d/p/CVE-2026-44608.patch
-- Wesley Hershberger <[email protected]> Tue, 09 Jun
2026 10:45:54 -0500
** Affects: unbound (Ubuntu)
Importance: Wishlist
Status: New
** Tags: needs-merge upgrade-software-version
** Changed in: unbound (Ubuntu)
Importance: Undecided => Wishlist
** Changed in: unbound (Ubuntu)
Milestone: None => ubuntu-27.01
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171161
Title:
Merge unbound 1.26.1-1 from Debian for tenacious cycle
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/unbound/+bug/2171161/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
