NLnet Labs Unbound

Novel "ghost domain names" attack by updating almost expired delegation information

Use-after-free in DoQ stream output buffer on reset re-transmission

BOGUS configured primary hostname accepted for XFR in auth/rpz zones

'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL

Unbound before 1.9.5 allows configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session. NOTE: The vendor does not consider this a vulnerability of the Unbound software. create_unbound_ad_servers.sh is a contributed script from the community that facilitates automatic configuration creation. It is not part of the Unbound installation

Use-after-free in DoH stream cleanup code path

Possible heap use-after-free in an error path when a DoT forwarded query is jostled out

Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abruptly terminated

Memory corruption could lead to crash and denial of service

'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash

Packet of death for a DNSCrypt misconfigured Unbound

Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2

Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration

Use after free and crash under special conditions in RPZ code

Local symlink attack in Unbound and NSD

A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. An improperly validated wildcard NSEC record could be used to prove the non-existence (NXDOMAIN answer) of an existing wildcard record, or trick unbound into accepting a NODATA proof.

Unbounded name compression could lead to Denial of Service

'max-global-quota' reset by DNSSEC validation restarts

Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush

Packet of death with DNSCrypt

Unbound before 1.4.4 does not send responses for signed zones after mishandling an unspecified query, which allows remote attackers to cause a denial of service (DNSSEC outage) via a crafted query.

Unbound before 1.4.3 does not properly align structures on 64-bit platforms, which allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors.

Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name

Possible ZONEMD verification bypass window

iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a large or infinite number of referrals.

daemon/worker.c in Unbound 1.x before 1.4.10, when debugging functionality and the interface-automatic option are enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted DNS request that triggers improper error handling.

Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries

Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN

'serve-expired' can bypass Unbound 'wait-limit'

Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records

A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path

DNS Cookie bypass when combined with proxy-protocol use

Privacy/configuration issue when adding local data in views through 'unbound-control'