unbound-1.25.1 (sysv only)

[Bruce Dubbs]

New minor version.

[Douglas R. Reno]

Now 1.25.1, with a swath of security vulnerability fixes. One of them is rated as Critical due to remote code execution when simply validating DNSSEC responses.

CVE-2026-33278 - severity: CRITICAL
Possible remote code execution during DNSSEC validation

CVE-2026-42944 - severity: HIGH
Heap overflow and crash with multiple nsid, cookie, padding EDNS options

CVE-2026-42959 - severity: HIGH
Crash during DNSSEC validation of malicious content

CVE-2026-32792 - severity: MEDIUM
Packet of death with DNSCrypt (feasibility very low)

CVE-2026-40622 - severity: MEDIUM
"Ghost domain name" variant

CVE-2026-41292 - severity: MEDIUM
Parsing a long list of incoming EDNS options degrades performance

CVE-2026-42534 - severity: MEDIUM
Jostle logic bypass degrades resolution performance

CVE-2026-42923 - severity: MEDIUM
Degradation of service with unbounded NSEC3 hash calculations

CVE-2026-42960 - severity: MEDIUM
Possible cache poisoning attack while following delegation

CVE-2026-44390 - severity: MEDIUM
Unbounded name compression in certain cases causes degradation of service

CVE-2026-44608 - severity: MEDIUM
Use after free and crash in RPZ code (special requirements apply)

[zeckma]

Taking this ticket since we haven't heard from Randy and I have a system capable of testing Unbound properly.

[zeckma]

Fixed at d7ab8e88000c79fc8779381e4ffbef230f17a191. Leaving open for SA.

[Douglas R. Reno]

SA-12.4-113 issued

Note that this is a 12.4 specific advisory as 13.0 does not carry unbound (since 13.0 was systemd only)