NLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service vulnerability when compiled with DNSCrypt support ('--enable-dnscrypt'). A bad DNSCrypt query could underflow Unbound's DNSCrypt packet reading procedure that may lead to heap overflow. A malicious actor can exploit the vulnerability with a single bad DNSCrypt query that its decrypted plaintext consists entirely of '0x00' bytes and does not contain the expected '0x80' marker. Unbound would then start reading more bytes than necessary until it finds a non-'0x00' byte. Based on the underlying memory allocator and the memory layout, it could lead to heap overflow while reading followed by a crash. Likelihood of a crash is low, since it relies heavily on the underlying memory allocator and the memory layout. If the heap overflow does not happen, Unbound's later packet checks will deny the packet. Unbound 1.25.1 contains a patch with a fix to bound reading in the given buffer space.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2369-1 advisory.

    This update for unbound fixes the following issues

    - CVE-2026-32792: Packet of death with DNSCrypt (bsc#1265583).
    - CVE-2026-33278: Possible remote code execution during DNSSEC validation (bsc#1265587).
    - CVE-2026-40622: 'Ghost domain name' variant (bsc#1265581).
    - CVE-2026-41292: Parsing a long list of incoming EDNS options degrades performance (bsc#1265580).
    - CVE-2026-42534: Jostle logic bypass degrades resolution performance (bsc#1265585).
    - CVE-2026-42923: Degradation of service with unbounded NSEC3 hash calculations (bsc#1265589).
    - CVE-2026-42944: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (bsc#1265578).
    - CVE-2026-42959: Crash during DNSSEC validation of malicious content (bsc#1265586).
    - CVE-2026-42960: Possible cache poisoning attack while following delegation (bsc#1265588).
    - CVE-2026-44390: Unbounded name compression in certain cases causes degradation of service (bsc#1265584).
    - CVE-2026-44608: Use after free and crash in RPZ code (bsc#1265582).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the b604d3e1-6474-11f1-958d-bc241121aa0a advisory.

    Multiple vulnerabilities have been reported in Unbound.  Instead               of listing detailed writeups for each issue, please see the upstream               advisories referenced below.
    The issues range from Denial of Service (DoS) through resource               exhaustion or crashes to possible remote code execution during               DNSSEC validation.  See the upstream Unbound advisories for specific               details.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 72e5b334-6365-11f1-8c57-000af7b98cf6 advisory.

    NLnet Labs reports:
    This release consolidates security fixes for issues reported                 over a period of time. There are fixes for:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the unbound package has been released.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3223ded15e advisory.

    # Update to 1.25.1 (rhbz#2480119)


    - Fix [CVE-2026-33278](https://nlnetlabs.nl/downloads/unbound/CVE-2026-33278.txt), Possible remote code     execution during DNSSEC validation. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix [CVE-2026-42944](https://nlnetlabs.nl/downloads/unbound/CVE-2026-42944.txt), Heap overflow and crash     with multiple nsid, cookie, padding EDNS options. Thanks to Qifan Zhang, Palo Alto Networks, for the     report.
    - Fix [CVE-2026-42959](https://nlnetlabs.nl/downloads/unbound/CVE-2026-42959.txt), Crash during DNSSEC     validation of malicious content. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix [CVE-2026-32792](https://nlnetlabs.nl/downloads/unbound/CVE-2026-32792.txt), Packet of death with     DNSCrypt. Thanks to Andrew Griffiths from 'calif.io' for the report.
    - Fix [CVE-2026-40622](https://nlnetlabs.nl/downloads/unbound/CVE-2026-40622.txt), Ghost domain name     variant. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix [CVE-2026-41292](https://nlnetlabs.nl/downloads/unbound/CVE-2026-41292.txt), Parsing a long list of     incoming EDNS options degrades performance. Thanks to GitHub user 'N0zoM1z0', also Qifan Zhang from Palo     Alto Networks, for the report.
    - Fix [CVE-2026-42534](https://nlnetlabs.nl/downloads/unbound/CVE-2026-42534.txt), Jostle logic bypass     degrades resolution performance. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix [CVE-2026-42923](https://nlnetlabs.nl/downloads/unbound/CVE-2026-42923.txt), Degradation of service     with unbounded NSEC3 hash calculations. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix [CVE-2026-42960](https://nlnetlabs.nl/downloads/unbound/CVE-2026-42960.txt), Possible cache     poisoning attack while following delegation. Thanks to TaoFei Guo from Peking University, Yang Luo and     JianJun Chen, Tsinghua University, for the report.
    - Fix [CVE-2026-44390](https://nlnetlabs.nl/downloads/unbound/CVE-2026-44390.txt), Unbounded name     compression in certain cases causes degradation of service. Thanks to Qifan Zhang, Palo Alto Networks, for     the report.
    - Fix [CVE-2026-44608](https://nlnetlabs.nl/downloads/unbound/CVE-2026-44608.txt), Use after free and     crash in RPZ code. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

    Swapped sources signature source number with systemd unit to have them     close.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6304 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6304-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     May 27, 2026                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : unbound     CVE ID         : CVE-2026-33278 CVE-2026-42944 CVE-2026-42959                      CVE-2026-32792 CVE-2026-40622 CVE-2026-41292                      CVE-2026-42534 CVE-2026-42923 CVE-2026-42960                      CVE-2026-44390 CVE-2026-44608

    Multiple security vulnerabilities were discovered in Unbound, a     validating, recursive, caching DNS resolver, which could result     in denial of service, cache poisoning or potentially the execution     of arbitrary code.

    For the stable distribution (trixie), this problem has been fixed in     version 1.22.0-2+deb13u3.

    We recommend that you upgrade your unbound packages.

    For the detailed security status of unbound please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/unbound

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-49f37e16aa advisory.

    # Update to 1.25.1 (rhbz#2480119)


    - Fix [CVE-2026-33278](https://nlnetlabs.nl/downloads/unbound/CVE-2026-33278.txt), Possible remote code     execution during DNSSEC validation. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix [CVE-2026-42944](https://nlnetlabs.nl/downloads/unbound/CVE-2026-42944.txt), Heap overflow and crash     with multiple nsid, cookie, padding EDNS options. Thanks to Qifan Zhang, Palo Alto Networks, for the     report.
    - Fix [CVE-2026-42959](https://nlnetlabs.nl/downloads/unbound/CVE-2026-42959.txt), Crash during DNSSEC     validation of malicious content. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix [CVE-2026-32792](https://nlnetlabs.nl/downloads/unbound/CVE-2026-32792.txt), Packet of death with     DNSCrypt. Thanks to Andrew Griffiths from 'calif.io' for the report.
    - Fix [CVE-2026-40622](https://nlnetlabs.nl/downloads/unbound/CVE-2026-40622.txt), Ghost domain name     variant. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix [CVE-2026-41292](https://nlnetlabs.nl/downloads/unbound/CVE-2026-41292.txt), Parsing a long list of     incoming EDNS options degrades performance. Thanks to GitHub user 'N0zoM1z0', also Qifan Zhang from Palo     Alto Networks, for the report.
    - Fix [CVE-2026-42534](https://nlnetlabs.nl/downloads/unbound/CVE-2026-42534.txt), Jostle logic bypass     degrades resolution performance. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix [CVE-2026-42923](https://nlnetlabs.nl/downloads/unbound/CVE-2026-42923.txt), Degradation of service     with unbounded NSEC3 hash calculations. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix [CVE-2026-42960](https://nlnetlabs.nl/downloads/unbound/CVE-2026-42960.txt), Possible cache     poisoning attack while following delegation. Thanks to TaoFei Guo from Peking University, Yang Luo and     JianJun Chen, Tsinghua University, for the report.
    - Fix [CVE-2026-44390](https://nlnetlabs.nl/downloads/unbound/CVE-2026-44390.txt), Unbounded name     compression in certain cases causes degradation of service. Thanks to Qifan Zhang, Palo Alto Networks, for     the report.
    - Fix [CVE-2026-44608](https://nlnetlabs.nl/downloads/unbound/CVE-2026-44608.txt), Use after free and     crash in RPZ code. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

    Swapped sources signature source number with systemd unit to have them     close.

    ----

    # Update to 1.25.0 (rhbz#2463781)

    ## Feature changes:

    - Improved TTL 0 handling
    - Reload also certificates on reload if they have changed
    - Allow control-interface specification also of port.
    - Added new tls-protocols option. Can disable TLS 1.2 explicitly.

    And bug fixes.

    Remove merged patches.

    Source: https://nlnetlabs.nl/projects/unbound/download/#unbound-1-25-0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8282-1 advisory.

    Andrew Griffiths discovered that Unbound did not properly handle certain DNSCrypt packets. A remote     attacker could possibly use this issue to cause Unbound to crash, resulting in a denial of service.
    (CVE-2026-32792)

    Qifan Zhang discovered that Unbound incorrectly handled DNSSEC validation in certain situations. A remote     attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 24.04     LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-33278)

    Qifan Zhang discovered that Unbound incorrectly handled certain ghost domain name records. A remote     attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04     LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-40622)

    Qifan Zhang discovered that Unbound did not properly limit processing of long EDNS option lists. A remote     attacker could possibly use this issue to cause Unbound to use excessive resources, leading to a denial of     service. (CVE-2026-41292)

    Qifan Zhang discovered that Unbound incorrectly handled jostle logic under certain circumstances. A remote     attacker could possibly use this issue to cause Unbound to use excessive resources, leading to a denial of     service. (CVE-2026-42534)

    Qifan Zhang discovered that Unbound did not properly bound NSEC3 hash calculations. A remote attacker     could possibly use this issue to cause Unbound to use excessive resources, leading to a denial of service.
    (CVE-2026-42923)

    Qifan Zhang discovered that Unbound incorrectly handled multiple EDNS options in certain situations. A     remote attacker could possibly use this issue to cause Unbound to crash, resulting in a denial of service,     or execute arbitrary code. This issue only affected Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS.
    (CVE-2026-42944)

    Qifan Zhang discovered that Unbound incorrectly handled DNSSEC validation of malicious content. A remote     attacker could possibly use this issue to cause Unbound to crash, resulting in a denial of service.
    (CVE-2026-42959)

    TaoFei Guo, Yang Luo, and JianJun Chen discovered that Unbound incorrectly handled delegation processing     in certain situations. A remote attacker could possibly use this issue to poison the DNS cache and obtain     sensitive information. (CVE-2026-42960)

    Qifan Zhang discovered that Unbound did not properly bound name compression in certain cases. A remote     attacker could possibly use this issue to cause Unbound to use excessive resources, leading to a denial of     service. (CVE-2026-44390)

    Qifan Zhang discovered that Unbound had a use-after-free issue in RPZ handling. A remote attacker could     possibly use this issue to cause Unbound to crash, resulting in a denial of service, or execute arbitrary     code. This issue only affected Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-44608)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - NLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service vulnerability when     compiled with DNSCrypt support ('--enable-dnscrypt'). A bad DNSCrypt query could underflow Unbound's     DNSCrypt packet reading procedure that may lead to heap overflow. A malicious actor can exploit the     vulnerability with a single bad DNSCrypt query that its decrypted plaintext consists entirely of '0x00'     bytes and does not contain the expected '0x80' marker. Unbound would then start reading more bytes than     necessary until it finds a non-'0x00' byte. Based on the underlying memory allocator and the memory     layout, it could lead to heap overflow while reading followed by a crash. Likelihood of a crash is low,     since it relies heavily on the underlying memory allocator and the memory layout. If the heap overflow     does not happen, Unbound's later packet checks will deny the packet. Unbound 1.25.1 contains a patch with     a fix to bound reading in the given buffer space. (CVE-2026-32792)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
321050	SUSE SLES15 Security Update : unbound (SUSE-SU-2026:2369-1)	Nessus	SuSE Local Security Checks	critical
320471	FreeBSD : FreeBSD -- Multiple vulnerabilities in unbound (b604d3e1-6474-11f1-958d-bc241121aa0a)	Nessus	FreeBSD Local Security Checks	critical
320011	FreeBSD : Unbound -- Multiple vulnerabilities (72e5b334-6365-11f1-8c57-000af7b98cf6)	Nessus	FreeBSD Local Security Checks	critical
318595	Photon OS 4.0: Unbound PHSA-2026-4.0-1027	Nessus	PhotonOS Local Security Checks	critical
318268	Fedora 43 : unbound (2026-3223ded15e)	Nessus	Fedora Local Security Checks	critical
317343	Debian dsa-6304 : libunbound-dev - security update	Nessus	Debian Local Security Checks	critical
316993	Fedora 44 : unbound (2026-49f37e16aa)	Nessus	Fedora Local Security Checks	critical
316076	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : Unbound vulnerabilities (USN-8282-1)	Nessus	Ubuntu Local Security Checks	critical
315753	Linux Distros Unpatched Vulnerability : CVE-2026-32792	Nessus	Misc.	high

Detections

Analytics

CVE-2026-32792

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

high