# NLnet Labs Unbound.

Every CVE that names NLnet Labs Unbound among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.](https://agentprime.io/advisories/CVE-2026-97206.md)
  `CVE-2026-97206` · CVE record: NLnet Labs Unbound · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Memory corruption
- [Aggregate DNS name chained pointer decompression work leads to degradation of service.](https://agentprime.io/advisories/CVE-2026-96405.md)
  `CVE-2026-96405` · CVE record: NLnet Labs Unbound · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service
- [Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent.](https://agentprime.io/advisories/CVE-2026-50106.md)
  `CVE-2026-50106` · CVE record: NLnet Labs Unbound · CVSS 6.5 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-807
- [Bypass of a configured island trust anchor underneath an insecure parent from an atacker-controlled NSEC record.](https://agentprime.io/advisories/CVE-2026-35501.md)
  `CVE-2026-35501` · CVE record: NLnet Labs Unbound · CVSS 3.7 Low · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-354
- [Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'](https://agentprime.io/advisories/CVE-2026-109125.md)
  `CVE-2026-109125` · CVE record: NLnet Labs Unbound · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-205
- [Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC](https://agentprime.io/advisories/CVE-2026-85501.md)
  `CVE-2026-85501` · CVE record: NLnet Labs Unbound · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [Use-after-free in DoH stream cleanup code path](https://agentprime.io/advisories/CVE-2026-82720.md)
  `CVE-2026-82720` · CVE record: NLnet Labs Unbound · CVSS 5.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Memory corruption
- [CNAME synthesis could lead to heap corruption](https://agentprime.io/advisories/CVE-2026-82717.md)
  `CVE-2026-82717` · CVE record: NLnet Labs Unbound · CVSS 8.4 High · Not analysed yet · Published 16 Sept 2026 · Tags: Memory corruption
- [Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY](https://agentprime.io/advisories/CVE-2026-81642.md)
  `CVE-2026-81642` · CVE record: NLnet Labs Unbound · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Memory corruption
- [Possible heap buffer overflow during DNSSEC canonicalization](https://agentprime.io/advisories/CVE-2026-81634.md)
  `CVE-2026-81634` · CVE record: NLnet Labs Unbound · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: Memory corruption
- [Possible degradation of service from continuous queries on the same TCP/DoT connection](https://agentprime.io/advisories/CVE-2026-80225.md)
  `CVE-2026-80225` · CVE record: NLnet Labs Unbound · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [Use-after-free in DoQ stream output buffer on reset re-transmission](https://agentprime.io/advisories/CVE-2026-78227.md)
  `CVE-2026-78227` · CVE record: NLnet Labs Unbound · CVSS 6.5 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Memory corruption
- [Possible ZONEMD verification bypass window](https://agentprime.io/advisories/CVE-2026-77955.md)
  `CVE-2026-77955` · CVE record: NLnet Labs Unbound · CVSS 4.4 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-345
- ['serve-expired' can bypass Unbound 'wait-limit'](https://agentprime.io/advisories/CVE-2026-77860.md)
  `CVE-2026-77860` · CVE record: NLnet Labs Unbound · CVSS 3.7 Low · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-675
- [Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration](https://agentprime.io/advisories/CVE-2026-56444.md)
  `CVE-2026-56444` · CVE record: NLnet Labs Unbound · CVSS 5.9 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service
- [Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name](https://agentprime.io/advisories/CVE-2026-56416.md)
  `CVE-2026-56416` · CVE record: NLnet Labs Unbound · CVSS 4.8 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-354
- [Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2](https://agentprime.io/advisories/CVE-2026-55991.md)
  `CVE-2026-55991` · CVE record: NLnet Labs Unbound · CVSS 5.9 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-195
- [Packet of death for a DNSCrypt misconfigured Unbound](https://agentprime.io/advisories/CVE-2026-55990.md)
  `CVE-2026-55990` · CVE record: NLnet Labs Unbound · CVSS 5.9 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Memory corruption
- ['dns-error-reporting: yes' leads to stack buffer overflow](https://agentprime.io/advisories/CVE-2026-55973.md)
  `CVE-2026-55973` · CVE record: NLnet Labs Unbound · CVSS 7.5 High · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-20
- ['serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash](https://agentprime.io/advisories/CVE-2026-55717.md)
  `CVE-2026-55717` · CVE record: NLnet Labs Unbound · CVSS 5.9 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Memory corruption
- [Privacy/configuration issue when adding local data in views through 'unbound-control'](https://agentprime.io/advisories/CVE-2026-55708.md)
  `CVE-2026-55708` · CVE record: NLnet Labs Unbound · CVSS 3.1 Low · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-1188
- [DNS Cookie bypass when combined with proxy-protocol use](https://agentprime.io/advisories/CVE-2026-54478.md)
  `CVE-2026-54478` · CVE record: NLnet Labs Unbound · CVSS 3.7 Low · Not analysed yet · Published 22 Jul 2026 · Tags: Authentication bypass
- [Memory corruption could lead to crash and denial of service](https://agentprime.io/advisories/CVE-2026-52863.md)
  `CVE-2026-52863` · CVE record: NLnet Labs Unbound · CVSS 5.9 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Memory corruption
- [Possible cache poisoning attack by mapping source port population per thread](https://agentprime.io/advisories/CVE-2026-50252.md)
  `CVE-2026-50252` · CVE record: NLnet Labs Unbound · CVSS 5.7 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-349
- [Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush](https://agentprime.io/advisories/CVE-2026-50251.md)
  `CVE-2026-50251` · CVE record: NLnet Labs Unbound · CVSS 5.3 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-184
- [BOGUS configured primary hostname accepted for XFR in auth/rpz zones](https://agentprime.io/advisories/CVE-2026-50248.md)
  `CVE-2026-50248` · CVE record: NLnet Labs Unbound · CVSS 6.5 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-345
- ['response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL](https://agentprime.io/advisories/CVE-2026-50243.md)
  `CVE-2026-50243` · CVE record: NLnet Labs Unbound · CVSS 6.3 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-348
- [Possible heap use-after-free in an error path when a DoT forwarded query is jostled out](https://agentprime.io/advisories/CVE-2026-50046.md)
  `CVE-2026-50046` · CVE record: NLnet Labs Unbound · CVSS 5.9 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Memory corruption
- ['max-global-quota' reset by DNSSEC validation restarts](https://agentprime.io/advisories/CVE-2026-50045.md)
  `CVE-2026-50045` · CVE record: NLnet Labs Unbound · CVSS 5.3 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-406
- [A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path](https://agentprime.io/advisories/CVE-2026-46582.md)
  `CVE-2026-46582` · CVE record: NLnet Labs Unbound · CVSS 3.7 Low · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-358
- [Cross-zone wildcard cache poisoning via RRSIG.labels manipulation](https://agentprime.io/advisories/CVE-2026-44690.md)
  `CVE-2026-44690` · CVE record: NLnet Labs Unbound · CVSS 7.5 High · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-345
- [Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN](https://agentprime.io/advisories/CVE-2026-44687.md)
  `CVE-2026-44687` · CVE record: NLnet Labs Unbound · CVSS 3.7 Low · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-193
- [Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abruptly terminated](https://agentprime.io/advisories/CVE-2026-44621.md)
  `CVE-2026-44621` · CVE record: NLnet Labs Unbound · CVSS 5.9 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-754
- [Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records](https://agentprime.io/advisories/CVE-2026-42955.md)
  `CVE-2026-42955` · CVE record: NLnet Labs Unbound · CVSS 3.7 Low · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-672
- [Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries](https://agentprime.io/advisories/CVE-2026-41637.md)
  `CVE-2026-41637` · CVE record: NLnet Labs Unbound · CVSS 3.7 Low · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service
- [Packet of death for DNSCrypt over TCP](https://agentprime.io/advisories/CVE-2026-40691.md)
  `CVE-2026-40691` · CVE record: NLnet Labs Unbound · CVSS 7.5 High · Not analysed yet · Published 22 Jul 2026 · Tags: Memory corruption
- [Remote DNS-over-QUIC denial of service due to \`quic-size\` budget bypass](https://agentprime.io/advisories/CVE-2026-32665.md)
  `CVE-2026-32665` · CVE record: NLnet Labs Unbound · CVSS 7.5 High · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-1284
- [Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments](https://agentprime.io/advisories/CVE-2026-14586.md)
  `CVE-2026-14586` · CVE record: NLnet Labs Unbound · CVSS 5.9 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service
- [Use after free and crash under special conditions in RPZ code](https://agentprime.io/advisories/CVE-2026-44608.md)
  `CVE-2026-44608` · CVE record: NLnet Labs Unbound · CVSS 4.6 Medium · Not analysed yet · Published 20 May 2026 · Tags: CWE-413
- [Unbounded name compression in certain cases causes degradation of service](https://agentprime.io/advisories/CVE-2026-44390.md)
  `CVE-2026-44390` · CVE record: NLnet Labs Unbound · CVSS 6.9 Medium · Not analysed yet · Published 20 May 2026 · Tags: Denial of service, CWE-1050
- [Possible cache poisoning via promiscuous records for the authority section](https://agentprime.io/advisories/CVE-2026-42960.md)
  `CVE-2026-42960` · CVE record: NLnet Labs Unbound · CVSS 5.7 Medium · Not analysed yet · Published 20 May 2026 · Tags: CWE-349
- [Crash during DNSSEC validation of malicious content](https://agentprime.io/advisories/CVE-2026-42959.md)
  `CVE-2026-42959` · CVE record: NLnet Labs Unbound · CVSS 8.7 High · Not analysed yet · Published 20 May 2026 · Tags: Memory corruption
- [Heap overflow with multiple NSID, COOKIE, PADDING EDNS options](https://agentprime.io/advisories/CVE-2026-42944.md)
  `CVE-2026-42944` · CVE record: NLnet Labs Unbound · CVSS 8.7 High · Not analysed yet · Published 20 May 2026 · Tags: Memory corruption, CWE-197
- [Degradation of service with unbounded NSEC3 hash calculations](https://agentprime.io/advisories/CVE-2026-42923.md)
  `CVE-2026-42923` · CVE record: NLnet Labs Unbound · CVSS 6.9 Medium · Not analysed yet · Published 20 May 2026 · Tags: Denial of service
- [Jostle logic bypass degrades resolution performance](https://agentprime.io/advisories/CVE-2026-42534.md)
  `CVE-2026-42534` · CVE record: NLnet Labs Unbound · CVSS 6.9 Medium · Not analysed yet · Published 20 May 2026 · Tags: CWE-440, CWE-911
- [Long list of incoming EDNS options degrades performance](https://agentprime.io/advisories/CVE-2026-41292.md)
  `CVE-2026-41292` · CVE record: NLnet Labs Unbound · CVSS 6.6 Medium · Not analysed yet · Published 20 May 2026 · Tags: Denial of service, CWE-1050
- [Another 'ghost domain names' attack variant](https://agentprime.io/advisories/CVE-2026-40622.md)
  `CVE-2026-40622` · CVE record: NLnet Labs Unbound · CVSS 6.6 Medium · Not analysed yet · Published 20 May 2026 · Tags: CWE-346
- [Possible arbitrary code execution during DNSSEC validation](https://agentprime.io/advisories/CVE-2026-33278.md)
  `CVE-2026-33278` · CVE record: NLnet Labs Unbound · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 May 2026 · Tags: Memory corruption, CWE-672
- [Packet of death with DNSCrypt](https://agentprime.io/advisories/CVE-2026-32792.md)
  `CVE-2026-32792` · CVE record: NLnet Labs Unbound · CVSS 4.6 Medium · Not analysed yet · Published 20 May 2026 · Tags: Memory corruption, CWE-166
- [Possible domain hijacking via promiscuous records in the authority section](https://agentprime.io/advisories/CVE-2025-11411.md)
  `CVE-2025-11411` · CVE record: NLnet Labs Unbound · CVSS 5.7 Medium · Not analysed yet · Published 22 Oct 2025 · Tags: CWE-349
- [Cache poisoning via the ECS-enabled Rebirthday Attack](https://agentprime.io/advisories/CVE-2025-5994.md)
  `CVE-2025-5994` · CVE record: NLnet Labs Unbound · CVSS 8.7 High · Not analysed yet · Published 16 Jul 2025 · Tags: CWE-349
- [Unbounded name compression could lead to Denial of Service](https://agentprime.io/advisories/CVE-2024-8508.md)
  `CVE-2024-8508` · CVE record: NLnet Labs Unbound · CVSS 5.3 Medium · Not analysed yet · Published 3 Oct 2024 · Tags: CWE-606
- [Denial of service when trimming EDE text on positive replies](https://agentprime.io/advisories/CVE-2024-1931.md)
  `CVE-2024-1931` · CVE record: NLnet Labs Unbound · CVSS 7.5 High · Not analysed yet · Published 7 Mar 2024 · Tags: Denial of service
- [NRDelegation Attack](https://agentprime.io/advisories/CVE-2022-3204.md)
  `CVE-2022-3204` · CVE record: NLnet Labs Unbound · CVSS 7.5 High · Not analysed yet · Published 26 Sept 2022 · Tags: Denial of service
- [Novel "ghost domain names" attack by updating almost expired delegation information](https://agentprime.io/advisories/CVE-2022-30699.md)
  `CVE-2022-30699` · CVE record: NLnet Labs Unbound · No CVSS score · Not analysed yet · Published 1 Aug 2022
- [Novel "ghost domain names" attack by introducing subdomain delegations](https://agentprime.io/advisories/CVE-2022-30698.md)
  `CVE-2022-30698` · CVE record: NLnet Labs Unbound · No CVSS score · Not analysed yet · Published 1 Aug 2022
- [Local symlink attack in Unbound and NSD](https://agentprime.io/advisories/CVE-2020-28935.md)
  `CVE-2020-28935` · CVE record: NLnet Labs Unbound and 1 more · No CVSS score · Not analysed yet · Published 7 Dec 2020 · Tags: Path traversal
- [A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records.](https://agentprime.io/advisories/CVE-2017-15105.md)
  `CVE-2017-15105` · CVE record: NLnet Labs unbound · No CVSS score · Not analysed yet · Published 23 Jan 2018 · Tags: CWE-358

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=nlnet-labs-unbound>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/nlnet-labs-unbound/>. Everything for agents: <https://agentprime.io/llms.txt>.