NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validator that can lead to a crash given malicious upstream replies. When Unbound constructs chase-reply messages for validation, the code uses the wrong counter to calculate write offsets for ADDITIONAL section rrsets. DNAME duplication could increase the ANSWER section count and authority filtering could decrease the AUTHORITY section count and create an uninitialized array slot. Combining these two, the validator later dereferences this uninitialized pointer, causing an immediate process crash. An adversary controlling a DNSSEC-signed domain can trigger this bug with a single query by configuring a DNAME chain with unsigned CNAMEs and a response containing unsigned AUTHORITY records alongside signed ADDITIONAL glue records. Unbound 1.25.1 contains a patch with a fix to use the proper counters to calculate the write offsets.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0156 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2026-42944:
    NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap     overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply     packet. The relevant options ('nsid', 'answer-cookie', 'pad-responses' (default)) need to be enabled for     the vulnerability to be exploited. An adversary who can query Unbound can exploit the vulnerability by     attaching multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options to the query. A flaw in the     size calculation of the EDNS field truncates the correct value which allows the encoder to overflow the     available space when writing. Those two combined lead to a heap overflow write of Unbound controlled data     and eventually a crash. Unbound 1.25.1 contains a patch with a fix to de-duplicate the EDNS options and a     fix to prevent truncation of the EDNS field size calculation.

    CVE-2026-42959:
    NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC     validator that can lead to a crash given malicious upstream replies. When Unbound constructs chase-reply     messages for validation, the code uses the wrong counter to calculate write offsets for ADDITIONAL section     rrsets. DNAME duplication could increase the ANSWER section count and authority filtering could decrease     the AUTHORITY section count and create an uninitialized array slot. Combining these two, the validator     later dereferences this uninitialized pointer, causing an immediate process crash. An adversary     controlling a DNSSEC-signed domain can trigger this bug with a single query by configuring a DNAME chain     with unsigned CNAMEs and a response containing unsigned AUTHORITY records alongside signed ADDITIONAL glue     records. Unbound 1.25.1 contains a patch with a fix to use the proper counters to calculate the write     offsets.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2369-1 advisory.

    This update for unbound fixes the following issues

    - CVE-2026-32792: Packet of death with DNSCrypt (bsc#1265583).
    - CVE-2026-33278: Possible remote code execution during DNSSEC validation (bsc#1265587).
    - CVE-2026-40622: 'Ghost domain name' variant (bsc#1265581).
    - CVE-2026-41292: Parsing a long list of incoming EDNS options degrades performance (bsc#1265580).
    - CVE-2026-42534: Jostle logic bypass degrades resolution performance (bsc#1265585).
    - CVE-2026-42923: Degradation of service with unbounded NSEC3 hash calculations (bsc#1265589).
    - CVE-2026-42944: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (bsc#1265578).
    - CVE-2026-42959: Crash during DNSSEC validation of malicious content (bsc#1265586).
    - CVE-2026-42960: Possible cache poisoning attack while following delegation (bsc#1265588).
    - CVE-2026-44390: Unbounded name compression in certain cases causes degradation of service (bsc#1265584).
    - CVE-2026-44608: Use after free and crash in RPZ code (bsc#1265582).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:24369 advisory.

    * unbound: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (CVE-2026-42944)
      * unbound: Unbound DNSSEC Validator Denial of Service via Incorrect Write Offset Counter in Chase-Reply     Messages (CVE-2026-42959)
      * unbound: Unbound DNSSEC Validator Use-After-Free via Deep Copy Pointer Overwrite Leading to DoS and     Possible Remote Code Execution (CVE-2026-33278)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:24369 advisory.

    * unbound: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (CVE-2026-42944)

    * unbound: Unbound DNSSEC Validator Denial of Service via Incorrect Write Offset Counter in Chase-Reply     Messages (CVE-2026-42959)

    * unbound: Unbound DNSSEC Validator Use-After-Free via Deep Copy Pointer Overwrite Leading to DoS and     Possible Remote Code Execution (CVE-2026-33278)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:24365 advisory.

    * unbound: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (CVE-2026-42944)

    * unbound: Unbound DNSSEC Validator Denial of Service via Incorrect Write Offset Counter in Chase-Reply     Messages (CVE-2026-42959)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the b604d3e1-6474-11f1-958d-bc241121aa0a advisory.

    Multiple vulnerabilities have been reported in Unbound.  Instead               of listing detailed writeups for each issue, please see the upstream               advisories referenced below.
    The issues range from Denial of Service (DoS) through resource               exhaustion or crashes to possible remote code execution during               DNSSEC validation.  See the upstream Unbound advisories for specific               details.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-768:04 advisory.

    * unbound: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (CVE-2026-42944)
      * unbound: Unbound DNSSEC Validator Denial of Service via Incorrect Write Offset Counter in Chase-Reply     Messages (CVE-2026-42959)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 72e5b334-6365-11f1-8c57-000af7b98cf6 advisory.

    NLnet Labs reports:
    This release consolidates security fixes for issues reported                 over a period of time. There are fixes for:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of unbound installed on the remote host is prior to 1.7.3-15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3322 advisory.

    NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator     that enables denial of service and possible remote code execution as a result of deep copying a data     structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by     controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend     validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-     copies response messages to preserve them across memory region teardown. A struct-assignment bug     overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the     resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary     code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep     copying the data structure. (CVE-2026-33278)

    NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack     related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS     options can hold Unbound threads hostage while they are parsing and creating internal data structures for     the options. Coordinated attacks can result in degradation and/or denial of service. Unbound 1.25.1     contains a patch with a fix to limit acceptable incoming EDNS options (100). (CVE-2026-41292)

    NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could     defeat its purpose and degrade resolution performance. Retransmits of the same query could renew the age     of slow running queries and not allow the jostle logic to see them as aged and potential targets for     replacement with new queries. An adversary who can query a vulnerable Unbound and who can control a domain     name server that replies slowly and/or maliciously to Unbound's queries can exploit the vulnerability and     degrade the resolution performance of Unbound. When Unbound's 'num-queries-per-thread' reaches its limit,     the jostle logic kicks in. When a new query comes in, half of the available queries that are also slow to     resolve are candidates for replacement. The vulnerability then happens because duplicate queries that need     resolution would skew the aging result by using the timestamp of the latest duplicate query instead of the     original one that started the resolution effort. Cache and local data response performance remains     unaffected. Coordinated attacks could raise this to a denial of resolution service. Unbound 1.25.1     contains a patch with a fix to attach an initial, non-updatable start time for incoming queries that allow     the jostle logic to work as intended. (CVE-2026-42534)

    NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where     the code path to consult the negative cache for DS records does not take into account the limit on NSEC3     hash calculations introduced in 1.19.1. This leads to degradation of service during the attack. An     adversary that controls a DNSSEC signed zone can exploit this by signing NSEC3 records with acceptably     high iterations for child delegations and querying a vulnerable Unbound. Unbound will keep performing the     allowed hash calculations on the NSEC3 records and will not limit the work by the mitigation introduced in     1.19.1. As a side effect, a global lock for the negative cache will be held for the duration of the     hashing, blocking other threads that need to consult the negative cache. Coordinated attacks could raise     the vulnerability to denial of service. Unbound 1.25.1 contains a patch with a fix to bound the vulnerable     code path with the existing limit for NSEC3 hash calculations. (CVE-2026-42923)

    NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC     validator that can lead to a crash given malicious upstream replies. When Unbound constructs chase-reply     messages for validation, the code uses the wrong counter to calculate write offsets for ADDITIONAL section     rrsets. DNAME duplication could increase the ANSWER section count and authority filtering could decrease     the AUTHORITY section count and create an uninitialized array slot. Combining these two, the validator     later dereferences this uninitialized pointer, causing an immediate process crash. An adversary     controlling a DNSSEC-signed domain can trigger this bug with a single query by configuring a DNAME chain     with unsigned CNAMEs and a response containing unsigned AUTHORITY records alongside signed ADDITIONAL glue     records. Unbound 1.25.1 contains a patch with a fix to use the proper counters to calculate the write     offsets. (CVE-2026-42959)

    NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records     for the authority section. Promiscuous RRSets that complement DNS replies in the authority section can be     used to trick Unbound to cache such records. If an adversary is able to attach such records in a reply     (i.e., spoofed packet, fragmentation attack) he would be able to poison Unbound's cache. A malicious actor     can exploit the possible poisonous effect by injecting RRSets other than NS that are also accompanied by     address records in a reply, for example MX. This could be achieved by trying to spoof a reply packet or     fragmentation attacks. Unbound would then accept the relative address records in the additional section     and cache them if the authority RRSet has enough trust at this point, i.e., in-zone data for the     delegation point. Unbound 1.25.1 contains a patch with a fix that disregards address records from the     additional section if they are not explicitly relevant only to authority NS records, mitigating the     possible poison effect. This is a complement fix to CVE-2025-11411. (CVE-2026-42960)

    NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very     large RRsets that Unbound needs to perform name compression for. Malicious upstream responses with very     large RRsets with records that don't share a suffix above the root can cause Unbound to spend a     considerable time applying name compression to downstream replies. This can lead to degraded performance     and eventually denial of service in well orchestrated attacks. An adversary can exploit the vulnerability     by querying Unbound for the specially crafted contents of a malicious zone with very large RRsets. Before     Unbound replies to the query it will try to apply name compression which was an unbounded operation that     could lock the CPU until the whole packet was complete. A compression limit was introduced in 1.21.1 for     this but it didn't account for the case where records would not share any suffix above the root. That     causes Unbound to go in a different code path because of the compression tree lookup failure and     eventually not increment the compression counter for those operations. Unbound 1.25.1 contains a patch     with a fix that increments the compression counter regardless of the compression tree lookup. This is a     complement fix to CVE-2024-8508. (CVE-2026-44390)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-24365 advisory.

    - Fix CVE-2026-42944 (RHEL-177909)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:24369 advisory.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    Security Fix(es):

    * unbound: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (CVE-2026-42944)

    * unbound: Unbound DNSSEC Validator Denial of Service via Incorrect Write Offset Counter in Chase-Reply     Messages (CVE-2026-42959)

    * unbound: Unbound DNSSEC Validator Use-After-Free via Deep Copy Pointer Overwrite Leading to DoS and     Possible Remote Code Execution (CVE-2026-33278)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:24365 advisory.

    * unbound: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (CVE-2026-42944)
      * unbound: Unbound DNSSEC Validator Denial of Service via Incorrect Write Offset Counter in Chase-Reply     Messages (CVE-2026-42959)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:24365 advisory.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    Security Fix(es):

    * unbound: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (CVE-2026-42944)

    * unbound: Unbound DNSSEC Validator Denial of Service via Incorrect Write Offset Counter in Chase-Reply     Messages (CVE-2026-42959)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:23231 advisory.

    * unbound: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (CVE-2026-42944)

    * unbound: Unbound DNSSEC Validator Denial of Service via Incorrect Write Offset Counter in Chase-Reply     Messages (CVE-2026-42959)

    * unbound: Unbound DNSSEC Validator Use-After-Free via Deep Copy Pointer Overwrite Leading to DoS and     Possible Remote Code Execution (CVE-2026-33278)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:23231 advisory.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    Security Fix(es):

    * unbound: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (CVE-2026-42944)

    * unbound: Unbound DNSSEC Validator Denial of Service via Incorrect Write Offset Counter in Chase-Reply     Messages (CVE-2026-42959)

    * unbound: Unbound DNSSEC Validator Use-After-Free via Deep Copy Pointer Overwrite Leading to DoS and     Possible Remote Code Execution (CVE-2026-33278)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:23231 advisory.

    * unbound: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (CVE-2026-42944)
      * unbound: Unbound DNSSEC Validator Denial of Service via Incorrect Write Offset Counter in Chase-Reply     Messages (CVE-2026-42959)
      * unbound: Unbound DNSSEC Validator Use-After-Free via Deep Copy Pointer Overwrite Leading to DoS and     Possible Remote Code Execution (CVE-2026-33278)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the unbound package has been released.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3223ded15e advisory.

    # Update to 1.25.1 (rhbz#2480119)


    - Fix [CVE-2026-33278](https://nlnetlabs.nl/downloads/unbound/CVE-2026-33278.txt), Possible remote code     execution during DNSSEC validation. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix [CVE-2026-42944](https://nlnetlabs.nl/downloads/unbound/CVE-2026-42944.txt), Heap overflow and crash     with multiple nsid, cookie, padding EDNS options. Thanks to Qifan Zhang, Palo Alto Networks, for the     report.
    - Fix [CVE-2026-42959](https://nlnetlabs.nl/downloads/unbound/CVE-2026-42959.txt), Crash during DNSSEC     validation of malicious content. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix [CVE-2026-32792](https://nlnetlabs.nl/downloads/unbound/CVE-2026-32792.txt), Packet of death with     DNSCrypt. Thanks to Andrew Griffiths from 'calif.io' for the report.
    - Fix [CVE-2026-40622](https://nlnetlabs.nl/downloads/unbound/CVE-2026-40622.txt), Ghost domain name     variant. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix [CVE-2026-41292](https://nlnetlabs.nl/downloads/unbound/CVE-2026-41292.txt), Parsing a long list of     incoming EDNS options degrades performance. Thanks to GitHub user 'N0zoM1z0', also Qifan Zhang from Palo     Alto Networks, for the report.
    - Fix [CVE-2026-42534](https://nlnetlabs.nl/downloads/unbound/CVE-2026-42534.txt), Jostle logic bypass     degrades resolution performance. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix [CVE-2026-42923](https://nlnetlabs.nl/downloads/unbound/CVE-2026-42923.txt), Degradation of service     with unbounded NSEC3 hash calculations. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix [CVE-2026-42960](https://nlnetlabs.nl/downloads/unbound/CVE-2026-42960.txt), Possible cache     poisoning attack while following delegation. Thanks to TaoFei Guo from Peking University, Yang Luo and     JianJun Chen, Tsinghua University, for the report.
    - Fix [CVE-2026-44390](https://nlnetlabs.nl/downloads/unbound/CVE-2026-44390.txt), Unbounded name     compression in certain cases causes degradation of service. Thanks to Qifan Zhang, Palo Alto Networks, for     the report.
    - Fix [CVE-2026-44608](https://nlnetlabs.nl/downloads/unbound/CVE-2026-44608.txt), Use after free and     crash in RPZ code. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

    Swapped sources signature source number with systemd unit to have them     close.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6304 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6304-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     May 27, 2026                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : unbound     CVE ID         : CVE-2026-33278 CVE-2026-42944 CVE-2026-42959                      CVE-2026-32792 CVE-2026-40622 CVE-2026-41292                      CVE-2026-42534 CVE-2026-42923 CVE-2026-42960                      CVE-2026-44390 CVE-2026-44608

    Multiple security vulnerabilities were discovered in Unbound, a     validating, recursive, caching DNS resolver, which could result     in denial of service, cache poisoning or potentially the execution     of arbitrary code.

    For the stable distribution (trixie), this problem has been fixed in     version 1.22.0-2+deb13u3.

    We recommend that you upgrade your unbound packages.

    For the detailed security status of unbound please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/unbound

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-49f37e16aa advisory.

    # Update to 1.25.1 (rhbz#2480119)


    - Fix [CVE-2026-33278](https://nlnetlabs.nl/downloads/unbound/CVE-2026-33278.txt), Possible remote code     execution during DNSSEC validation. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix [CVE-2026-42944](https://nlnetlabs.nl/downloads/unbound/CVE-2026-42944.txt), Heap overflow and crash     with multiple nsid, cookie, padding EDNS options. Thanks to Qifan Zhang, Palo Alto Networks, for the     report.
    - Fix [CVE-2026-42959](https://nlnetlabs.nl/downloads/unbound/CVE-2026-42959.txt), Crash during DNSSEC     validation of malicious content. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix [CVE-2026-32792](https://nlnetlabs.nl/downloads/unbound/CVE-2026-32792.txt), Packet of death with     DNSCrypt. Thanks to Andrew Griffiths from 'calif.io' for the report.
    - Fix [CVE-2026-40622](https://nlnetlabs.nl/downloads/unbound/CVE-2026-40622.txt), Ghost domain name     variant. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix [CVE-2026-41292](https://nlnetlabs.nl/downloads/unbound/CVE-2026-41292.txt), Parsing a long list of     incoming EDNS options degrades performance. Thanks to GitHub user 'N0zoM1z0', also Qifan Zhang from Palo     Alto Networks, for the report.
    - Fix [CVE-2026-42534](https://nlnetlabs.nl/downloads/unbound/CVE-2026-42534.txt), Jostle logic bypass     degrades resolution performance. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix [CVE-2026-42923](https://nlnetlabs.nl/downloads/unbound/CVE-2026-42923.txt), Degradation of service     with unbounded NSEC3 hash calculations. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
    - Fix [CVE-2026-42960](https://nlnetlabs.nl/downloads/unbound/CVE-2026-42960.txt), Possible cache     poisoning attack while following delegation. Thanks to TaoFei Guo from Peking University, Yang Luo and     JianJun Chen, Tsinghua University, for the report.
    - Fix [CVE-2026-44390](https://nlnetlabs.nl/downloads/unbound/CVE-2026-44390.txt), Unbounded name     compression in certain cases causes degradation of service. Thanks to Qifan Zhang, Palo Alto Networks, for     the report.
    - Fix [CVE-2026-44608](https://nlnetlabs.nl/downloads/unbound/CVE-2026-44608.txt), Use after free and     crash in RPZ code. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

    Swapped sources signature source number with systemd unit to have them     close.

    ----

    # Update to 1.25.0 (rhbz#2463781)

    ## Feature changes:

    - Improved TTL 0 handling
    - Reload also certificates on reload if they have changed
    - Allow control-interface specification also of port.
    - Added new tls-protocols option. Can disable TLS 1.2 explicitly.

    And bug fixes.

    Remove merged patches.

    Source: https://nlnetlabs.nl/projects/unbound/download/#unbound-1-25-0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1756 advisory.

    NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator     that enables denial of service and possible remote code execution as a result of deep copying a data     structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by     controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend     validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-     copies response messages to preserve them across memory region teardown. A struct-assignment bug     overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the     resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary     code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep     copying the data structure. (CVE-2026-33278)

    NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain     names' family of attacks that could extend the ghost domain window by up to one cached TTL configured     value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be     able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached     expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost     domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-     referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound     implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension     of TTLs for (parent) NS records regardless of their trust. (CVE-2026-40622)

    NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack     related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS     options can hold Unbound threads hostage while they are parsing and creating internal data structures for     the options. Coordinated attacks can result in degradation and/or denial of service. Unbound 1.25.1     contains a patch with a fix to limit acceptable incoming EDNS options (100). (CVE-2026-41292)

    NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could     defeat its purpose and degrade resolution performance. Retransmits of the same query could renew the age     of slow running queries and not allow the jostle logic to see them as aged and potential targets for     replacement with new queries. An adversary who can query a vulnerable Unbound and who can control a domain     name server that replies slowly and/or maliciously to Unbound's queries can exploit the vulnerability and     degrade the resolution performance of Unbound. When Unbound's 'num-queries-per-thread' reaches its limit,     the jostle logic kicks in. When a new query comes in, half of the available queries that are also slow to     resolve are candidates for replacement. The vulnerability then happens because duplicate queries that need     resolution would skew the aging result by using the timestamp of the latest duplicate query instead of the     original one that started the resolution effort. Cache and local data response performance remains     unaffected. Coordinated attacks could raise this to a denial of resolution service. Unbound 1.25.1     contains a patch with a fix to attach an initial, non-updatable start time for incoming queries that allow     the jostle logic to work as intended. (CVE-2026-42534)

    NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where     the code path to consult the negative cache for DS records does not take into account the limit on NSEC3     hash calculations introduced in 1.19.1. This leads to degradation of service during the attack. An     adversary that controls a DNSSEC signed zone can exploit this by signing NSEC3 records with acceptably     high iterations for child delegations and querying a vulnerable Unbound. Unbound will keep performing the     allowed hash calculations on the NSEC3 records and will not limit the work by the mitigation introduced in     1.19.1. As a side effect, a global lock for the negative cache will be held for the duration of the     hashing, blocking other threads that need to consult the negative cache. Coordinated attacks could raise     the vulnerability to denial of service. Unbound 1.25.1 contains a patch with a fix to bound the vulnerable     code path with the existing limit for NSEC3 hash calculations. (CVE-2026-42923)

    NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap     overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply     packet. The relevant options ('nsid', 'answer-cookie', 'pad-responses' (default)) need to be enabled for     the vulnerability to be exploited. An adversary who can query Unbound can exploit the vulnerability by     attaching multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options to the query. A flaw in the     size calculation of the EDNS field truncates the correct value which allows the encoder to overflow the     available space when writing. Those two combined lead to a heap overflow write of Unbound controlled data     and eventually a crash. Unbound 1.25.1 contains a patch with a fix to de-duplicate the EDNS options and a     fix to prevent truncation of the EDNS field size calculation. (CVE-2026-42944)

    NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC     validator that can lead to a crash given malicious upstream replies. When Unbound constructs chase-reply     messages for validation, the code uses the wrong counter to calculate write offsets for ADDITIONAL section     rrsets. DNAME duplication could increase the ANSWER section count and authority filtering could decrease     the AUTHORITY section count and create an uninitialized array slot. Combining these two, the validator     later dereferences this uninitialized pointer, causing an immediate process crash. An adversary     controlling a DNSSEC-signed domain can trigger this bug with a single query by configuring a DNAME chain     with unsigned CNAMEs and a response containing unsigned AUTHORITY records alongside signed ADDITIONAL glue     records. Unbound 1.25.1 contains a patch with a fix to use the proper counters to calculate the write     offsets. (CVE-2026-42959)

    NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records     for the authority section. Promiscuous RRSets that complement DNS replies in the authority section can be     used to trick Unbound to cache such records. If an adversary is able to attach such records in a reply     (i.e., spoofed packet, fragmentation attack) he would be able to poison Unbound's cache. A malicious actor     can exploit the possible poisonous effect by injecting RRSets other than NS that are also accompanied by     address records in a reply, for example MX. This could be achieved by trying to spoof a reply packet or     fragmentation attacks. Unbound would then accept the relative address records in the additional section     and cache them if the authority RRSet has enough trust at this point, i.e., in-zone data for the     delegation point. Unbound 1.25.1 contains a patch with a fix that disregards address records from the     additional section if they are not explicitly relevant only to authority NS records, mitigating the     possible poison effect. This is a complement fix to CVE-2025-11411. (CVE-2026-42960)

    NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very     large RRsets that Unbound needs to perform name compression for. Malicious upstream responses with very     large RRsets with records that don't share a suffix above the root can cause Unbound to spend a     considerable time applying name compression to downstream replies. This can lead to degraded performance     and eventually denial of service in well orchestrated attacks. An adversary can exploit the vulnerability     by querying Unbound for the specially crafted contents of a malicious zone with very large RRsets. Before     Unbound replies to the query it will try to apply name compression which was an unbounded operation that     could lock the CPU until the whole packet was complete. A compression limit was introduced in 1.21.1 for     this but it didn't account for the case where records would not share any suffix above the root. That     causes Unbound to go in a different code path because of the compression tree lookup failure and     eventually not increment the compression counter for those operations. Unbound 1.25.1 contains a patch     with a fix that increments the compression counter regardless of the compression tree lookup. This is a     complement fix to CVE-2024-8508. (CVE-2026-44390)

    NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability     that when certain conditions are met (multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-     nsdname' triggers) it could result in heap use-after-free and eventual crash. An adversary can exploit the     vulnerability if conditions are first met on a vulnerable Unbound, i.e., multi-threaded, an RPZ zone with     'rpz-nsip'/'rpz-nsdname' triggers and an ongoing XFR for that RPZ zone. Local RPZ files do not trigger the     vulnerability. If the timing is right and an XFR happens at the same time another thread needs to read     that RPZ zone, the reader may not hold the lock long enough and the thread applying the XFR may free     objects that the reader is about to walk causing the use-after-free. Unbound 1.25.1 contains a patch with     a fix to the locking code. (CVE-2026-44608)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8282-1 advisory.

    Andrew Griffiths discovered that Unbound did not properly handle certain DNSCrypt packets. A remote     attacker could possibly use this issue to cause Unbound to crash, resulting in a denial of service.
    (CVE-2026-32792)

    Qifan Zhang discovered that Unbound incorrectly handled DNSSEC validation in certain situations. A remote     attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 24.04     LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-33278)

    Qifan Zhang discovered that Unbound incorrectly handled certain ghost domain name records. A remote     attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04     LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-40622)

    Qifan Zhang discovered that Unbound did not properly limit processing of long EDNS option lists. A remote     attacker could possibly use this issue to cause Unbound to use excessive resources, leading to a denial of     service. (CVE-2026-41292)

    Qifan Zhang discovered that Unbound incorrectly handled jostle logic under certain circumstances. A remote     attacker could possibly use this issue to cause Unbound to use excessive resources, leading to a denial of     service. (CVE-2026-42534)

    Qifan Zhang discovered that Unbound did not properly bound NSEC3 hash calculations. A remote attacker     could possibly use this issue to cause Unbound to use excessive resources, leading to a denial of service.
    (CVE-2026-42923)

    Qifan Zhang discovered that Unbound incorrectly handled multiple EDNS options in certain situations. A     remote attacker could possibly use this issue to cause Unbound to crash, resulting in a denial of service,     or execute arbitrary code. This issue only affected Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS.
    (CVE-2026-42944)

    Qifan Zhang discovered that Unbound incorrectly handled DNSSEC validation of malicious content. A remote     attacker could possibly use this issue to cause Unbound to crash, resulting in a denial of service.
    (CVE-2026-42959)

    TaoFei Guo, Yang Luo, and JianJun Chen discovered that Unbound incorrectly handled delegation processing     in certain situations. A remote attacker could possibly use this issue to poison the DNS cache and obtain     sensitive information. (CVE-2026-42960)

    Qifan Zhang discovered that Unbound did not properly bound name compression in certain cases. A remote     attacker could possibly use this issue to cause Unbound to use excessive resources, leading to a denial of     service. (CVE-2026-44390)

    Qifan Zhang discovered that Unbound had a use-after-free issue in RPZ handling. A remote attacker could     possibly use this issue to cause Unbound to crash, resulting in a denial of service, or execute arbitrary     code. This issue only affected Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-44608)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC     validator that can lead to a crash given malicious upstream replies. When Unbound constructs chase-reply     messages for validation, the code uses the wrong counter to calculate write offsets for ADDITIONAL section     rrsets. DNAME duplication could increase the ANSWER section count and authority filtering could decrease     the AUTHORITY section count and create an uninitialized array slot. Combining these two, the validator     later dereferences this uninitialized pointer, causing an immediate process crash. An adversary     controlling a DNSSEC-signed domain can trigger this bug with a single query by configuring a DNAME chain     with unsigned CNAMEs and a response containing unsigned AUTHORITY records alongside signed ADDITIONAL glue     records. Unbound 1.25.1 contains a patch with a fix to use the proper counters to calculate the write     offsets. (CVE-2026-42959)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
321241	Alibaba Cloud Linux 3 : 0156: unbound (ALINUX3-SA-2026:0156)	Nessus	Alibaba Cloud Linux Local Security Checks	high
321050	SUSE SLES15 Security Update : unbound (SUSE-SU-2026:2369-1)	Nessus	SuSE Local Security Checks	critical
320652	AlmaLinux 9 : unbound (ALSA-2026:24369)	Nessus	Alma Linux Local Security Checks	critical
320613	RockyLinux 9 : unbound (RLSA-2026:24369)	Nessus	Rocky Linux Local Security Checks	critical
320519	RockyLinux 8 : unbound (RLSA-2026:24365)	Nessus	Rocky Linux Local Security Checks	high
320471	FreeBSD : FreeBSD -- Multiple vulnerabilities in unbound (b604d3e1-6474-11f1-958d-bc241121aa0a)	Nessus	FreeBSD Local Security Checks	critical
320122	MiracleLinux 8 : unbound-1.16.2-5.11.el8_10 (AXSA:2026-768:04)	Nessus	Miracle Linux Local Security Checks	high
320011	FreeBSD : Unbound -- Multiple vulnerabilities (72e5b334-6365-11f1-8c57-000af7b98cf6)	Nessus	FreeBSD Local Security Checks	critical
319844	Amazon Linux 2 : unbound, --advisory ALAS2-2026-3322 (ALAS-2026-3322)	Nessus	Amazon Linux Local Security Checks	critical
319713	Oracle Linux 8 : unbound (ELSA-2026-24365)	Nessus	Oracle Linux Local Security Checks	high
319711	RHEL 9 : unbound (RHSA-2026:24369)	Nessus	Red Hat Local Security Checks	critical
319684	AlmaLinux 8 : unbound (ALSA-2026:24365)	Nessus	Alma Linux Local Security Checks	high
319680	RHEL 8 : unbound (RHSA-2026:24365)	Nessus	Red Hat Local Security Checks	high
319604	RockyLinux 10 : unbound (RLSA-2026:23231)	Nessus	Rocky Linux Local Security Checks	critical
319496	RHEL 10 : unbound (RHSA-2026:23231)	Nessus	Red Hat Local Security Checks	critical
318680	AlmaLinux 10 : unbound (ALSA-2026:23231)	Nessus	Alma Linux Local Security Checks	critical
318595	Photon OS 4.0: Unbound PHSA-2026-4.0-1027	Nessus	PhotonOS Local Security Checks	critical
318268	Fedora 43 : unbound (2026-3223ded15e)	Nessus	Fedora Local Security Checks	critical
317343	Debian dsa-6304 : libunbound-dev - security update	Nessus	Debian Local Security Checks	critical
316993	Fedora 44 : unbound (2026-49f37e16aa)	Nessus	Fedora Local Security Checks	critical
316916	Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2026-1756)	Nessus	Amazon Linux Local Security Checks	critical
316076	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : Unbound vulnerabilities (USN-8282-1)	Nessus	Ubuntu Local Security Checks	critical
315768	Linux Distros Unpatched Vulnerability : CVE-2026-42959	Nessus	Misc.	high

Detections

Analytics

CVE-2026-42959

high

Tenable Plugins

high

critical

critical

critical

high

critical

high

critical

critical

high

critical

high

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

high