Ubuntu fixes Unbound denial-of-service flaws in USN-8946-1
Original title: USN-8946-1: Unbound vulnerabilities
Crafted TCP connections or DNS responses can exhaust resources or crash Unbound; fixed package versions are not in the excerpt.
Ubuntu security notice USN-8946-1 covers denial-of-service flaws in Unbound. CVE-2026-80225 lets a remote attacker waste resources over certain TCP connections and affects only Ubuntu 26.04 LTS, 24.04 LTS, 22.04 LTS and 20.04 LTS. CVE-2026-81634 can crash Unbound through certain DNS responses. A further DNSSEC-validation issue, described as resource consumption, is cut off in the notice excerpt.
Unconfirmed: The notice excerpt cuts off the DNSSEC issue and does not name fixed versions.
- CVE-2026-80225 is limited to four named Ubuntu LTS releases.
- CVE-2026-81634 is a crash via certain DNS responses.
- The DNSSEC issue is only partly described in the excerpt.
- No exploitation or fixed package versions are stated.
Impact: Remote denial of service against Unbound
| Product | Affected |
|---|---|
| Ubuntu Unbound | Ubuntu 26.04 LTS, 24.04 LTS, 22.04 LTS and 20.04 LTS for CVE-2026-80225 |
- 1.Install the Unbound updates published in USN-8946-1 on affected Ubuntu LTS systems.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-80225+1 related CVE | Unbounded-read DoS in NLnetLabs Unbound TCP/DoT lets one client stall a worker | 7.5 | — |
From the original article
It was discovered that Unbound incorrectly handled certain TCP connections. A remote attacker could possibly use this issue to cause Unbound to consume resources, leading to a denial of service. This issue only affected Ubuntu 26.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.