Advisories · Technology

NLnet Labs Unbound.

Every CVE that names NLnet Labs Unbound among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-97206 CVE record

CVSS 7.5 High

DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.
- NLnet Labs Unbound
- Memory corruption
Not analysed yet 21 Oct 2026
CVE-2026-96405 CVE record

CVSS 5.3 Medium

Aggregate DNS name chained pointer decompression work leads to degradation of service.
- NLnet Labs Unbound
- Denial of service
Not analysed yet 21 Oct 2026
CVE-2026-50106 CVE record

CVSS 6.5 Medium

Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent.
- NLnet Labs Unbound
- CWE-807
Not analysed yet 21 Oct 2026
CVE-2026-35501 CVE record

CVSS 3.7 Low

Bypass of a configured island trust anchor underneath an insecure parent from an atacker-controlled NSEC record.
- NLnet Labs Unbound
- CWE-354
Not analysed yet 21 Oct 2026
CVE-2026-109125 CVE record

CVSS 5.3 Medium

Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'
- NLnet Labs Unbound
- CWE-205
Not analysed yet 21 Oct 2026
CVE-2026-85501 CVE record

CVSS 5.3 Medium

Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC
- NLnet Labs Unbound
- Denial of service
Not analysed yet 16 Sept 2026
CVE-2026-82720 CVE record

CVSS 5.9 Medium

Use-after-free in DoH stream cleanup code path
- NLnet Labs Unbound
- Memory corruption
Not analysed yet 16 Sept 2026
CVE-2026-82717 CVE record

CVSS 8.4 High

CNAME synthesis could lead to heap corruption
- NLnet Labs Unbound
- Memory corruption
Not analysed yet 16 Sept 2026
CVE-2026-81642 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY
- NLnet Labs Unbound
- Memory corruption
Not analysed yet 16 Sept 2026
CVE-2026-81634 CVE record

CVSS 7.5 High

Possible heap buffer overflow during DNSSEC canonicalization
- NLnet Labs Unbound
- Memory corruption
Not analysed yet 16 Sept 2026
CVE-2026-80225 CVE record

CVSS 5.3 Medium

Possible degradation of service from continuous queries on the same TCP/DoT connection
- NLnet Labs Unbound
- Denial of service
Not analysed yet 16 Sept 2026
CVE-2026-78227 CVE record

CVSS 6.5 Medium

Use-after-free in DoQ stream output buffer on reset re-transmission
- NLnet Labs Unbound
- Memory corruption
Not analysed yet 16 Sept 2026
CVE-2026-77955 CVE record

CVSS 4.4 Medium

Possible ZONEMD verification bypass window
- NLnet Labs Unbound
- CWE-345
Not analysed yet 16 Sept 2026
CVE-2026-77860 CVE record

CVSS 3.7 Low

'serve-expired' can bypass Unbound 'wait-limit'
- NLnet Labs Unbound
- CWE-675
Not analysed yet 16 Sept 2026
CVE-2026-56444 CVE record

CVSS 5.9 Medium

Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration
- NLnet Labs Unbound
- Denial of service
Not analysed yet 22 Jul 2026
CVE-2026-56416 CVE record

CVSS 4.8 Medium

Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name
- NLnet Labs Unbound
- CWE-354
Not analysed yet 22 Jul 2026
CVE-2026-55991 CVE record

CVSS 5.9 Medium

Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2
- NLnet Labs Unbound
- CWE-195
Not analysed yet 22 Jul 2026
CVE-2026-55990 CVE record

CVSS 5.9 Medium

Packet of death for a DNSCrypt misconfigured Unbound
- NLnet Labs Unbound
- Memory corruption
Not analysed yet 22 Jul 2026
CVE-2026-55973 CVE record

CVSS 7.5 High

'dns-error-reporting: yes' leads to stack buffer overflow
- NLnet Labs Unbound
- CWE-20
Not analysed yet 22 Jul 2026
CVE-2026-55717 CVE record

CVSS 5.9 Medium

'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash
- NLnet Labs Unbound
- Memory corruption
Not analysed yet 22 Jul 2026
CVE-2026-55708 CVE record

CVSS 3.1 Low

Privacy/configuration issue when adding local data in views through 'unbound-control'
- NLnet Labs Unbound
- CWE-1188
Not analysed yet 22 Jul 2026
CVE-2026-54478 CVE record

CVSS 3.7 Low

DNS Cookie bypass when combined with proxy-protocol use
- NLnet Labs Unbound
- Authentication bypass
Not analysed yet 22 Jul 2026
CVE-2026-52863 CVE record

CVSS 5.9 Medium

Memory corruption could lead to crash and denial of service
- NLnet Labs Unbound
- Memory corruption
Not analysed yet 22 Jul 2026
CVE-2026-50252 CVE record

CVSS 5.7 Medium

Possible cache poisoning attack by mapping source port population per thread
- NLnet Labs Unbound
- CWE-349
Not analysed yet 22 Jul 2026
CVE-2026-50251 CVE record

CVSS 5.3 Medium

Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush
- NLnet Labs Unbound
- CWE-184
Not analysed yet 22 Jul 2026
CVE-2026-50248 CVE record

CVSS 6.5 Medium

BOGUS configured primary hostname accepted for XFR in auth/rpz zones
- NLnet Labs Unbound
- CWE-345
Not analysed yet 22 Jul 2026
CVE-2026-50243 CVE record

CVSS 6.3 Medium

'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL
- NLnet Labs Unbound
- CWE-348
Not analysed yet 22 Jul 2026
CVE-2026-50046 CVE record

CVSS 5.9 Medium

Possible heap use-after-free in an error path when a DoT forwarded query is jostled out
- NLnet Labs Unbound
- Memory corruption
Not analysed yet 22 Jul 2026
CVE-2026-50045 CVE record

CVSS 5.3 Medium

'max-global-quota' reset by DNSSEC validation restarts
- NLnet Labs Unbound
- CWE-406
Not analysed yet 22 Jul 2026
CVE-2026-46582 CVE record

CVSS 3.7 Low

A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path
- NLnet Labs Unbound
- CWE-358
Not analysed yet 22 Jul 2026
CVE-2026-44690 CVE record

CVSS 7.5 High

Cross-zone wildcard cache poisoning via RRSIG.labels manipulation
- NLnet Labs Unbound
- CWE-345
Not analysed yet 22 Jul 2026
CVE-2026-44687 CVE record

CVSS 3.7 Low

Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN
- NLnet Labs Unbound
- CWE-193
Not analysed yet 22 Jul 2026
CVE-2026-44621 CVE record

CVSS 5.9 Medium

Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abruptly terminated
- NLnet Labs Unbound
- CWE-754
Not analysed yet 22 Jul 2026
CVE-2026-42955 CVE record

CVSS 3.7 Low

Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records
- NLnet Labs Unbound
- CWE-672
Not analysed yet 22 Jul 2026
CVE-2026-41637 CVE record

CVSS 3.7 Low

Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries
- NLnet Labs Unbound
- Denial of service
Not analysed yet 22 Jul 2026
CVE-2026-40691 CVE record

CVSS 7.5 High

Packet of death for DNSCrypt over TCP
- NLnet Labs Unbound
- Memory corruption
Not analysed yet 22 Jul 2026
CVE-2026-32665 CVE record

CVSS 7.5 High

Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass
- NLnet Labs Unbound
- CWE-1284
Not analysed yet 22 Jul 2026
CVE-2026-14586 CVE record

CVSS 5.9 Medium

Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments
- NLnet Labs Unbound
- Denial of service
Not analysed yet 22 Jul 2026
CVE-2026-44608 CVE record

CVSS 4.6 Medium

Use after free and crash under special conditions in RPZ code
- NLnet Labs Unbound
- CWE-413
Not analysed yet 20 May 2026
CVE-2026-44390 CVE record

CVSS 6.9 Medium

Unbounded name compression in certain cases causes degradation of service
- NLnet Labs Unbound
- Denial of service
- CWE-1050
Not analysed yet 20 May 2026
CVE-2026-42960 CVE record

CVSS 5.7 Medium

Possible cache poisoning via promiscuous records for the authority section
- NLnet Labs Unbound
- CWE-349
Not analysed yet 20 May 2026
CVE-2026-42959 CVE record

CVSS 8.7 High

Crash during DNSSEC validation of malicious content
- NLnet Labs Unbound
- Memory corruption
Not analysed yet 20 May 2026
CVE-2026-42944 CVE record

CVSS 8.7 High

Heap overflow with multiple NSID, COOKIE, PADDING EDNS options
- NLnet Labs Unbound
- Memory corruption
- CWE-197
Not analysed yet 20 May 2026
CVE-2026-42923 CVE record

CVSS 6.9 Medium

Degradation of service with unbounded NSEC3 hash calculations
- NLnet Labs Unbound
- Denial of service
Not analysed yet 20 May 2026
CVE-2026-42534 CVE record

CVSS 6.9 Medium

Jostle logic bypass degrades resolution performance
- NLnet Labs Unbound
- CWE-440
- CWE-911
Not analysed yet 20 May 2026
CVE-2026-41292 CVE record

CVSS 6.6 Medium

Long list of incoming EDNS options degrades performance
- NLnet Labs Unbound
- Denial of service
- CWE-1050
Not analysed yet 20 May 2026
CVE-2026-40622 CVE record

CVSS 6.6 Medium

Another 'ghost domain names' attack variant
- NLnet Labs Unbound
- CWE-346
Not analysed yet 20 May 2026
CVE-2026-33278 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Possible arbitrary code execution during DNSSEC validation
- NLnet Labs Unbound
- Memory corruption
- CWE-672
Not analysed yet 20 May 2026
CVE-2026-32792 CVE record

CVSS 4.6 Medium

Packet of death with DNSCrypt
- NLnet Labs Unbound
- Memory corruption
- CWE-166
Not analysed yet 20 May 2026
CVE-2025-11411 CVE record

CVSS 5.7 Medium

Possible domain hijacking via promiscuous records in the authority section
- NLnet Labs Unbound
- CWE-349
Not analysed yet 22 Oct 2025
CVE-2025-5994 CVE record

CVSS 8.7 High

Cache poisoning via the ECS-enabled Rebirthday Attack
- NLnet Labs Unbound
- CWE-349
Not analysed yet 16 Jul 2025
CVE-2024-8508 CVE record

CVSS 5.3 Medium

Unbounded name compression could lead to Denial of Service
- NLnet Labs Unbound
- CWE-606
Not analysed yet 3 Oct 2024
CVE-2024-1931 CVE record

CVSS 7.5 High

Denial of service when trimming EDE text on positive replies
- NLnet Labs Unbound
- Denial of service
Not analysed yet 7 Mar 2024
CVE-2022-3204 CVE record

CVSS 7.5 High

NRDelegation Attack
- NLnet Labs Unbound
- Denial of service
Not analysed yet 26 Sept 2022
CVE-2022-30699 CVE record

Novel "ghost domain names" attack by updating almost expired delegation information
- NLnet Labs Unbound
Not analysed yet 1 Aug 2022
CVE-2022-30698 CVE record

Novel "ghost domain names" attack by introducing subdomain delegations
- NLnet Labs Unbound
Not analysed yet 1 Aug 2022
CVE-2020-28935 CVE record

Local symlink attack in Unbound and NSD
- NLnet Labs Unbound
- NLnet Labs NSD
- Path traversal
Not analysed yet 7 Dec 2020
CVE-2017-15105 CVE record

A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records.
- NLnet Labs unbound
- CWE-358
Not analysed yet 23 Jan 2018