Verified Advisories

Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 4 total.

Severity: All Critical High

Library: unbound

CVE-2026-55973 HIGH CVSS 7.5 Verified Advisory Jul 22, 2026

Stack Buffer Overflow in Unbound EDNS Report-Channel Processing (CVE-2026-55973)

When 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from an upstream response is processed, using the option's length as the length of the agent domain. If the agent domain is followed by ...

Fixed in 1.25.2

Information Disclosure Red Hat Suse Nlnet Labs

CVE-2026-44690 HIGH CVSS 7.5 Verified Advisory Jul 22, 2026

Cross-zone wildcard cache poisoning in Unbound (CVE-2026-44690)

Insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning in Unbound. A malicious actor controlling a single delegated z...

Fixed in 1.25.2

Code Injection Red Hat Suse Nlnet Labs

CVE-2026-40691 HIGH CVSS 7.5 Verified Advisory Jul 22, 2026

Heap Overflow in Unbound DNSCrypt TCP Handling (CVE-2026-40691)

A heap overflow vulnerability exists in Unbound when compiled with DNSCrypt support. A malicious DNSCrypt query over TCP causes the reply encryption routine to fail to bound the reply length against the destination bu...

Fixed in 1.25.2

Buffer Overflow Denial Of Service Heap Overflow Red Hat

CVE-2026-32665 HIGH CVSS 7.5 Verified Advisory Jul 22, 2026

Memory accounting bypass in Unbound downstream DoQ implementation (CVE-2026-32665)

In NLnet Labs Unbound versions 1.22.0 through 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streams on a new QUIC connection bypass the per-stream 'quic-size' gate, allowing a rem...

Fixed in 1.25.2

Denial Of Service Red Hat Suse Nlnet Labs