#unbound

1 stories this week · 3 this month · 7 in 6 months · mostly security

Stories per day · 30 days

7 stories, newest first · one card per story

CVE-2026-80225 can let a remote attacker exhaust Unbound resources over TCP on listed LTS releases.

CVE-2026-97206 can cause a use-after-free during DoQ path migration on multi-threaded Unbound deployments.

Crafted TCP connections or DNS responses can exhaust resources or crash Unbound; fixed package versions are not in the excerpt.

Ubuntu patches two Unbound memory bugs that could allow denial of service or code execution.

NetBSD 10.2 fixes a remotely triggerable ipfilter kernel null-pointer bug and a TCP timestamp leak.

The Hacker NewsSep 17, 2026high

NLnet Labs patched a critical heap overflow (CVE-2026-81642) in Unbound's DNSSEC validator that a malicious DNS zone can trigger for possible RCE.

4 min readdns dnssec

oss-securitySep 16, 2026high

Unbound 1.26.1 fixes critical heap buffer overflow CVE-2026-81642 in DNSKEY digesting that may allow remote code execution.

Stories tagged #unbound