Ubuntu 26.10 gets Unbound fixes from USN-8946-1
Original title: USN-8946-2: Unbound vulnerabilities
CVE-2026-80225 can let a remote attacker exhaust Unbound resources over TCP on listed LTS releases.
USN-8946-2 supplies for Ubuntu 26.10 the Unbound fixes already issued in USN-8946-1 for earlier Ubuntu releases. One issue, CVE-2026-80225, is improper handling of certain TCP connections that a remote attacker could use to make Unbound consume resources and cause a denial of service. Ubuntu says that issue affected only Ubuntu 26.04 LTS, 24.04 LTS, 22.04 LTS and 20.04 LTS. The notice's description of a second DNS-response issue is cut off.
Unconfirmed: The snippet cuts off before describing the second Unbound issue or naming a fixed package version.
- The update covers Ubuntu 26.10.
- CVE-2026-80225 is a remote resource-consumption denial of service.
- No fixed package version is stated in the snippet.
Impact: Remote denial of service by exhausting Unbound resources
| Product | Affected |
|---|---|
| Ubuntu Unbound | Ubuntu 26.10; CVE-2026-80225 on 26.04, 24.04, 22.04 and 20.04 LTS |
- 1.Install the Unbound update provided by USN-8946-2 on Ubuntu 26.10.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-80225 | Unbounded-read DoS in NLnetLabs Unbound TCP/DoT lets one client stall a worker | 7.5 | — |
From the original article
USN-8946-1 fixed vulnerabilities in Unbound in Ubuntu 26. 04 LTS, Ubuntu 24. 04 LTS, Ubuntu 22.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.