NLnet Labs Unbound

• CVE-2026-97206 High 7.5 DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments. 0.3%
• CVE-2026-96405 Medium 5.3 Aggregate DNS name chained pointer decompression work leads to degradation of service. 0.3%
• CVE-2026-50106 Medium 6.5 Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent. 0.2%
• CVE-2026-35501 Low 3.7 Bypass of a configured island trust anchor underneath an insecure parent from an atacker-controlled NSEC record. 0.1%
• CVE-2026-109125 Medium 5.3 Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold' 0.2%
• CVE-2026-85501 Medium 5.3 Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC 0.5%
• CVE-2026-82720 Medium 5.9 Use-after-free in DoH stream cleanup code path 0.4%
• CVE-2026-82717 High 8.4 CNAME synthesis could lead to heap corruption 0.8%
• CVE-2026-81642 Critical 9.1 Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY 1.0%
• CVE-2026-81634 High 7.5 Possible heap buffer overflow during DNSSEC canonicalization 0.5%
• CVE-2026-80225 Medium 5.3 Possible degradation of service from continuous queries on the same TCP/DoT connection 0.5%
• CVE-2026-78227 Medium 6.5 Use-after-free in DoQ stream output buffer on reset re-transmission 0.3%
• CVE-2026-77955 Medium 4.4 Possible ZONEMD verification bypass window 0.2%
• CVE-2026-77860 Low 3.7 'serve-expired' can bypass Unbound 'wait-limit' 0.3%
• CVE-2026-56444 Medium 5.9 Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration 0.4%
• CVE-2026-56416 Medium 4.8 Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name 0.1%
• CVE-2026-55991 Medium 5.9 Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2 0.4%
• CVE-2026-55990 Medium 5.9 Packet of death for a DNSCrypt misconfigured Unbound 0.2%
• CVE-2026-55973 High 7.5 'dns-error-reporting: yes' leads to stack buffer overflow 0.3%
• CVE-2026-55717 Medium 5.9 'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash 0.2%
• CVE-2026-55708 Low 3.1 Privacy/configuration issue when adding local data in views through 'unbound-control' 0.2%
• CVE-2026-54478 Low 3.7 DNS Cookie bypass when combined with proxy-protocol use 0.2%
• CVE-2026-52863 Medium 5.9 Memory corruption could lead to crash and denial of service 0.4%
• CVE-2026-50252 Medium 5.7 Possible cache poisoning attack by mapping source port population per thread 0.2%
• CVE-2026-50251 Medium 5.3 Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush 0.3%
• CVE-2026-50248 Medium 6.5 BOGUS configured primary hostname accepted for XFR in auth/rpz zones 0.1%
• CVE-2026-50243 Medium 6.3 'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL 0.1%
• CVE-2026-50046 Medium 5.9 Possible heap use-after-free in an error path when a DoT forwarded query is jostled out 0.2%
• CVE-2026-50045 Medium 5.3 'max-global-quota' reset by DNSSEC validation restarts 0.5%
• CVE-2026-46582 Low 3.7 A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path 0.2%
• CVE-2026-44690 High 7.5 Cross-zone wildcard cache poisoning via RRSIG.labels manipulation 0.2%
• CVE-2026-44687 Low 3.7 Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN 0.2%
• CVE-2026-44621 Medium 5.9 Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abruptly terminated 0.2%
• CVE-2026-42955 Low 3.7 Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records 0.2%
• CVE-2026-41637 Low 3.7 Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries 0.4%
• CVE-2026-40691 High 7.5 Packet of death for DNSCrypt over TCP 0.3%
• CVE-2026-32665 High 7.5 Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass 0.3%
• CVE-2026-14586 Medium 5.9 Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments 0.4%
• CVE-2026-44608 Medium 4.6 Use after free and crash under special conditions in RPZ code 0.3%
• CVE-2026-44390 High 7.5 Unbounded name compression in certain cases causes degradation of service 0.6%
• CVE-2026-42960 Medium 5.7 Possible cache poisoning via promiscuous records for the authority section 0.3%
• CVE-2026-42959 High 7.5 Crash during DNSSEC validation of malicious content 0.8%
• CVE-2026-42944 High 7.5 Heap overflow with multiple NSID, COOKIE, PADDING EDNS options 0.8%
• CVE-2026-42923 Medium 6.9 Degradation of service with unbounded NSEC3 hash calculations 0.3%
• CVE-2026-42534 High 7.5 Jostle logic bypass degrades resolution performance 0.6%
• CVE-2026-41292 High 7.5 Long list of incoming EDNS options degrades performance 0.7%
• CVE-2026-40622 Medium 6.6 Another 'ghost domain names' attack variant 0.1%
• CVE-2026-33278 High 8.1 Possible arbitrary code execution during DNSSEC validation 1.4%
• CVE-2026-32792 Medium 4.6 Packet of death with DNSCrypt 0.3%
• CVE-2025-11411 Medium 5.7 Possible domain hijacking via promiscuous records in the authority section 0.3%