Opened 3 weeks ago

Closed 3 weeks ago

Last modified 3 weeks ago

#24164 closed enhancement (fixed)

unbound-1.26.2 (sysv-only)

Reported by: zeckma Owned by: zeckma
Priority: high Milestone: 13.2
Component: BOOK Version: git
Severity: high Keywords:
Cc:

Description

New point release.

This fixes multiple CVEs.

Defaulting to high until I get more information.

Change History (7)

comment:1 by zeckma, 3 weeks ago

Security Fixes

  • CVE-2026-35501 (Low): Configured island trust anchor bypassing
  • CVE-2026-50106 (Medium): Possible insecure NXDOMAIN
  • CVE-2026-96405 (Medium): Degradation of service via aggregate DNS name chained pointer decompression
  • CVE-2026-97206 (High): Use-after-free for DoQ path-migration in multi-threaded deployments
  • CVE-2026-109125 (Medium): Possible cache poisoning

comment:2 by zeckma, 3 weeks ago

Owner: changed from zeckma to SecurityAdvisory
Status: assigned → new

Fixed at d52f8353bb876f44cb4ea086e7fcda1f741c3296. Leaving open for security advisory.

comment:3 by zeckma, 3 weeks ago

Milestone: 13.2 → 98-Security

comment:4 by zeckma, 3 weeks ago

Milestone: 98-Security → 13.2
Owner: changed from SecurityAdvisory to zeckma
Status: new → assigned

comment:5 by zeckma, 3 weeks ago

Resolution: → fixed
Status: assigned → closed

comment:6 by zeckma, 3 weeks ago

Since SysV is no longer supported for security, there will not be a security advisory filed for BLFS.

SLFS still needs libunbound from Unbound, and is init system agnostic, which is why it is in SLFS, so an advisory will be filed for SLFS. A link will be posted soon for the SLFS advisory soon when it has been filed.

Note: See TracTickets for help on using tickets.