Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

11 records

Release: NLnet Labs Unbound 1.25.1 Clear all filters
TI-2026-32517 CVE-2026-44608 · GHSA-fx8q-9cm5-75v9

Use after free and crash under special conditions in RPZ code

Priority LOW 21

NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met (multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers…

CVSS 4.0MEDIUM 4.6 Network No auth No interaction EPSS 0.00255 Published 2026-05-20 Partial fix · 1.25.1 CWE-413
TI-2026-32341 CVE-2026-44390 · GHSA-6522-r5fq-99gw

Unbounded name compression in certain cases causes degradation of service

Priority LOW 37

NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets that Unbound needs to perform name compression for.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00648 Published 2026-05-20 Partial fix · 1.25.1 CWE-407
TI-2026-31146 CVE-2026-42959 · GHSA-5jp8-75xr-qrmf

Crash during DNSSEC validation of malicious content

Priority MEDIUM 45

NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validator that can lead to a crash given malicious upstream replies.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00807 Published 2026-05-20 Partial fix · 1.25.1 CWE-824
TI-2026-31135 CVE-2026-42944 · GHSA-7mmq-q3m9-jrv7

Heap overflow with multiple NSID, COOKIE, PADDING EDNS options

Priority MEDIUM 45

NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00842 Published 2026-05-20 Partial fix · 1.25.1 CWE-197
TI-2026-31123 CVE-2026-42923 · GHSA-8f6w-8h24-fw66

Degradation of service with unbounded NSEC3 hash calculations

Priority LOW 36

NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code path to consult the negative cache for DS records does not take into account the limit on NSEC3 hash calcul…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00339 Published 2026-05-20 Partial fix · 1.25.1 CWE-407
TI-2026-30814 CVE-2026-42534 · GHSA-xfcv-gp55-3wpf

Jostle logic bypass degrades resolution performance

Priority LOW 37

NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could defeat its purpose and degrade resolution performance.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00604 Published 2026-05-20 Partial fix · 1.25.1 CWE-440
TI-2026-29895 CVE-2026-41292 · GHSA-2wvj-gvc7-gfhx

Long list of incoming EDNS options degrades performance

Priority LOW 37

NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00748 Published 2026-05-20 Partial fix · 1.25.1 CWE-407
TI-2026-29354 CVE-2026-40622 · GHSA-m3vq-fgh9-hq65

Another 'ghost domain names' attack variant

Priority LOW 34

NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00142 Published 2026-05-20 Partial fix · 1.25.1 CWE-346
TI-2026-25690 CVE-2026-33278 · GHSA-m234-r435-cxjw

Possible arbitrary code execution during DNSSEC validation

Priority MEDIUM 50

NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code execution as a result of deep copying a data structure and…

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.0142 Published 2026-05-20 Partial fix · 1.25.1 CWE-416
TI-2026-25270 CVE-2026-32792 · GHSA-8v34-57vr-p4cp

Packet of death with DNSCrypt

Priority LOW 27

NLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service vulnerability when compiled with DNSCrypt support ('--enable-dnscrypt').

CVSS 4.0MEDIUM 4.6 Network No auth No interaction EPSS 0.00337 Published 2026-05-20 Partial fix · 1.25.1 CWE-125