Updated unbound packages fixes security vulnerabilities
Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY Possible heap buffer overflow during DNSSEC canonicalization CNAME synthesis could lead to heap corruption Possible ZONEMD verification bypass window Use-after-free in DoQ stream output buffer on reset re-transmission Possible degradation of service from continuous queries on the same TCP/DoT connection Use-after-free in DoH stream cleanup code path Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC 'serve-expired' can bypass Unbound 'wait-limit' Remote DNS-over-QUIC denial of service due to 'quic-size' budget bypass Packet of death for DNSCrypt over TCP Cross-zone wildcard cache poisoning via RRSIG.labels manipulation 'dns-error-reporting: yes' leads to stack buffer overflow Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abruptly terminated 'max-global-quota' reset by DNSSEC validation restarts Possible heap use-after-free in an error path when a DoT forwarded query is jostled out 'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL BOGUS configured primary hostname accepted for XFR in auth/rpz zones Date: Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush Possible cache poisoning attack by mapping source port population per thread Memory corruption could lead to crash and denial of service 'serv
MGASA-2026-0451
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MGASA-2026-0451
unbound
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.26.1-1.mga10
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
unbound
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.26.1-1.mga9
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.26.1-1.mga10"
}
]
}
],
"package": {
"name": "unbound",
"purl": "pkg:rpm/mageia/unbound?arch=source&distro=mageia-10",
"ecosystem": "Mageia:10"
},
"database_specific": {
"source": "https://advisories.mageia.org/MGASA-2026-0451.json"
},
"ecosystem_specific": {
"section": "core"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.26.1-1.mga9"
}
]
}
],
"package": {
"name": "unbound",
"purl": "pkg:rpm/mageia/unbound?arch=source&distro=mageia-9",
"ecosystem": "Mageia:9"
},
"database_specific": {
"source": "https://advisories.mageia.org/MGASA-2026-0451.json"
},
"ecosystem_specific": {
"section": "core"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #14917 · Revision 1
- Added to Heist Feed
- Publisher date