Skip to content
Heist/ feed
CriticalFix available

unbound security update

Type: advisorySource: OSV1 source record

Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn't make custom builds or provide specific features to paying customers only. Security Fix(es): In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA can overflow the digest buffer. Remote code execution is possible through attacker controlled data. An adversary can exploit the vulnerability by controlling a malicious zone and querying a vulnerable Unbound.(CVE-2026-81642)

Announced Group revision 1
Original source ↗

OESA-2026-4130

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:OESA-2026-4130

unbound

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
1.17.1-21.oe2403sp4

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

unbound

Source reference: /affected/1/package/name

Affected versions
Not stated in this record
Fixed versions
1.11.0-27.oe2003sp4

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

unbound

Source reference: /affected/2/package/name

Affected versions
Not stated in this record
Fixed versions
1.13.2-27.oe2203sp4

Source reference: /affected/2/ranges

Prerequisites
Not stated in this record

unbound

Source reference: /affected/3/package/name

Affected versions
Not stated in this record
Fixed versions
1.17.1-21.oe2403sp1

Source reference: /affected/3/ranges

Prerequisites
Not stated in this record

unbound

Source reference: /affected/4/package/name

Affected versions
Not stated in this record
Fixed versions
1.17.1-21.oe2403sp3

Source reference: /affected/4/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.17.1-21.oe2403sp4"
          }
        ]
      }
    ],
    "package": {
      "name": "unbound",
      "purl": "pkg:rpm/openEuler/unbound&distro=openEuler-24.03-LTS-SP4",
      "ecosystem": "openEuler:24.03-LTS-SP4"
    },
    "database_specific": {
      "source": "https://repo.openeuler.org/security/data/osv/OESA-2026-4130.json"
    },
    "ecosystem_specific": {
      "src": [
        "unbound-1.17.1-21.oe2403sp4.src.rpm"
      ],
      "x86_64": [
        "python3-unbound-1.17.1-21.oe2403sp4.x86_64.rpm",
        "unbound-1.17.1-21.oe2403sp4.x86_64.rpm",
        "unbound-anchor-1.17.1-21.oe2403sp4.x86_64.rpm",
        "unbound-debuginfo-1.17.1-21.oe2403sp4.x86_64.rpm",
        "unbound-debugsource-1.17.1-21.oe2403sp4.x86_64.rpm",
        "unbound-devel-1.17.1-21.oe2403sp4.x86_64.rpm",
        "unbound-help-1.17.1-21.oe2403sp4.x86_64.rpm",
        "unbound-libs-1.17.1-21.oe2403sp4.x86_64.rpm",
        "unbound-utils-1.17.1-21.oe2403sp4.x86_64.rpm"
      ],
      "aarch64": [
        "python3-unbound-1.17.1-21.oe2403sp4.aarch64.rpm",
        "unbound-1.17.1-21.oe2403sp4.aarch64.rpm",
        "unbound-anchor-1.17.1-21.oe2403sp4.aarch64.rpm",
        "unbound-debuginfo-1.17.1-21.oe2403sp4.aarch64.rpm",
        "unbound-debugsource-1.17.1-21.oe2403sp4.aarch64.rpm",
        "unbound-devel-1.17.1-21.oe2403sp4.aarch64.rpm",
        "unbound-help-1.17.1-21.oe2403sp4.aarch64.rpm",
        "unbound-libs-1.17.1-21.oe2403sp4.aarch64.rpm",
        "unbound-utils-1.17.1-21.oe2403sp4.aarch64.rpm"
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.11.0-27.oe2003sp4"
          }
        ]
      }
    ],
    "package": {
      "name": "unbound",
      "purl": "pkg:rpm/openEuler/unbound&distro=openEuler-20.03-LTS-SP4",
      "ecosystem": "openEuler:20.03-LTS-SP4"
    },
    "database_specific": {
      "source": "https://repo.openeuler.org/security/data/osv/OESA-2026-4130.json"
    },
    "ecosystem_specific": {
      "src": [
        "unbound-1.11.0-27.oe2003sp4.src.rpm"
      ],
      "x86_64": [
        "python3-unbound-1.11.0-27.oe2003sp4.x86_64.rpm",
        "unbound-1.11.0-27.oe2003sp4.x86_64.rpm",
        "unbound-debuginfo-1.11.0-27.oe2003sp4.x86_64.rpm",
        "unbound-debugsource-1.11.0-27.oe2003sp4.x86_64.rpm",
        "unbound-devel-1.11.0-27.oe2003sp4.x86_64.rpm",
        "unbound-help-1.11.0-27.oe2003sp4.x86_64.rpm",
        "unbound-libs-1.11.0-27.oe2003sp4.x86_64.rpm"
      ],
      "aarch64": [
        "python3-unbound-1.11.0-27.oe2003sp4.aarch64.rpm",
        "unbound-1.11.0-27.oe2003sp4.aarch64.rpm",
        "unbound-debuginfo-1.11.0-27.oe2003sp4.aarch64.rpm",
        "unbound-debugsource-1.11.0-27.oe2003sp4.aarch64.rpm",
        "unbound-devel-1.11.0-27.oe2003sp4.aarch64.rpm",
        "unbound-help-1.11.0-27.oe2003sp4.aarch64.rpm",
        "unbound-libs-1.11.0-27.oe2003sp4.aarch64.rpm"
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.13.2-27.oe2203sp4"
          }
        ]
      }
    ],
    "package": {
      "name": "unbound",
      "purl": "pkg:rpm/openEuler/unbound&distro=openEuler-22.03-LTS-SP4",
      "ecosystem": "openEuler:22.03-LTS-SP4"
    },
    "database_specific": {
      "source": "https://repo.openeuler.org/security/data/osv/OESA-2026-4130.json"
    },
    "ecosystem_specific": {
      "src": [
        "unbound-1.13.2-27.oe2203sp4.src.rpm"
      ],
      "x86_64": [
        "python3-unbound-1.13.2-27.oe2203sp4.x86_64.rpm",
        "unbound-1.13.2-27.oe2203sp4.x86_64.rpm",
        "unbound-anchor-1.13.2-27.oe2203sp4.x86_64.rpm",
        "unbound-debuginfo-1.13.2-27.oe2203sp4.x86_64.rpm",
        "unbound-debugsource-1.13.2-27.oe2203sp4.x86_64.rpm",
        "unbound-devel-1.13.2-27.oe2203sp4.x86_64.rpm",
        "unbound-help-1.13.2-27.oe2203sp4.x86_64.rpm",
        "unbound-libs-1.13.2-27.oe2203sp4.x86_64.rpm"
      ],
      "aarch64": [
        "python3-unbound-1.13.2-27.oe2203sp4.aarch64.rpm",
        "unbound-1.13.2-27.oe2203sp4.aarch64.rpm",
        "unbound-anchor-1.13.2-27.oe2203sp4.aarch64.rpm",
        "unbound-debuginfo-1.13.2-27.oe2203sp4.aarch64.rpm",
        "unbound-debugsource-1.13.2-27.oe2203sp4.aarch64.rpm",
        "unbound-devel-1.13.2-27.oe2203sp4.aarch64.rpm",
        "unbound-help-1.13.2-27.oe2203sp4.aarch64.rpm",
        "unbound-libs-1.13.2-27.oe2203sp4.aarch64.rpm"
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.17.1-21.oe2403sp1"
          }
        ]
      }
    ],
    "package": {
      "name": "unbound",
      "purl": "pkg:rpm/openEuler/unbound&distro=openEuler-24.03-LTS-SP1",
      "ecosystem": "openEuler:24.03-LTS-SP1"
    },
    "database_specific": {
      "source": "https://repo.openeuler.org/security/data/osv/OESA-2026-4130.json"
    },
    "ecosystem_specific": {
      "src": [
        "unbound-1.17.1-21.oe2403sp1.src.rpm"
      ],
      "x86_64": [
        "python3-unbound-1.17.1-21.oe2403sp1.x86_64.rpm",
        "unbound-1.17.1-21.oe2403sp1.x86_64.rpm",
        "unbound-anchor-1.17.1-21.oe2403sp1.x86_64.rpm",
        "unbound-debuginfo-1.17.1-21.oe2403sp1.x86_64.rpm",
        "unbound-debugsource-1.17.1-21.oe2403sp1.x86_64.rpm",
        "unbound-devel-1.17.1-21.oe2403sp1.x86_64.rpm",
        "unbound-help-1.17.1-21.oe2403sp1.x86_64.rpm",
        "unbound-libs-1.17.1-21.oe2403sp1.x86_64.rpm",
        "unbound-utils-1.17.1-21.oe2403sp1.x86_64.rpm"
      ],
      "aarch64": [
        "python3-unbound-1.17.1-21.oe2403sp1.aarch64.rpm",
        "unbound-1.17.1-21.oe2403sp1.aarch64.rpm",
        "unbound-anchor-1.17.1-21.oe2403sp1.aarch64.rpm",
        "unbound-debuginfo-1.17.1-21.oe2403sp1.aarch64.rpm",
        "unbound-debugsource-1.17.1-21.oe2403sp1.aarch64.rpm",
        "unbound-devel-1.17.1-21.oe2403sp1.aarch64.rpm",
        "unbound-help-1.17.1-21.oe2403sp1.aarch64.rpm",
        "unbound-libs-1.17.1-21.oe2403sp1.aarch64.rpm",
        "unbound-utils-1.17.1-21.oe2403sp1.aarch64.rpm"
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.17.1-21.oe2403sp3"
          }
        ]
      }
    ],
    "package": {
      "name": "unbound",
      "purl": "pkg:rpm/openEuler/unbound&distro=openEuler-24.03-LTS-SP3",
      "ecosystem": "openEuler:24.03-LTS-SP3"
    },
    "database_specific": {
      "source": "https://repo.openeuler.org/security/data/osv/OESA-2026-4130.json"
    },
    "ecosystem_specific": {
      "src": [
        "unbound-1.17.1-21.oe2403sp3.src.rpm"
      ],
      "x86_64": [
        "python3-unbound-1.17.1-21.oe2403sp3.x86_64.rpm",
        "unbound-1.17.1-21.oe2403sp3.x86_64.rpm",
        "unbound-anchor-1.17.1-21.oe2403sp3.x86_64.rpm",
        "unbound-debuginfo-1.17.1-21.oe2403sp3.x86_64.rpm",
        "unbound-debugsource-1.17.1-21.oe2403sp3.x86_64.rpm",
        "unbound-devel-1.17.1-21.oe2403sp3.x86_64.rpm",
        "unbound-help-1.17.1-21.oe2403sp3.x86_64.rpm",
        "unbound-libs-1.17.1-21.oe2403sp3.x86_64.rpm",
        "unbound-utils-1.17.1-21.oe2403sp3.x86_64.rpm"
      ],
      "aarch64": [
        "python3-unbound-1.17.1-21.oe2403sp3.aarch64.rpm",
        "unbound-1.17.1-21.oe2403sp3.aarch64.rpm",
        "unbound-anchor-1.17.1-21.oe2403sp3.aarch64.rpm",
        "unbound-debuginfo-1.17.1-21.oe2403sp3.aarch64.rpm",
        "unbound-debugsource-1.17.1-21.oe2403sp3.aarch64.rpm",
        "unbound-devel-1.17.1-21.oe2403sp3.aarch64.rpm",
        "unbound-help-1.17.1-21.oe2403sp3.aarch64.rpm",
        "unbound-libs-1.17.1-21.oe2403sp3.aarch64.rpm",
        "unbound-utils-1.17.1-21.oe2403sp3.aarch64.rpm"
      ]
    }
  }
]

Publisher severity

critical

Source reference: /database_specific/severity

Event
#14750 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement

Revision history

  1. OESA-2026-4130 · Revision 1Source updated