NLnet Labs Unbound
58 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-97206 | 1.22.0 – < 1.26.2 | DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments. | HIGH 7.5 | 0.3 % | ||
| CVE-2026-96405 | < 1.26.2 | Aggregate DNS name chained pointer decompression work leads to degradation of service. | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-50106 | < 1.26.2 | Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent. | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-35501 | 1.0.1 – < 1.26.2 | Bypass of a configured island trust anchor underneath an insecure parent from an atacker-controlled NSEC record. | LOW 3.7 | 0.1 % | ||
| CVE-2026-109125 | < 1.26.2 | Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold' | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-85501 | < 1.26.1 | Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC | HIGH 7.5 | 0.5 % | ||
| CVE-2026-82720 | 1.12.0 – < 1.26.1 | Use-after-free in DoH stream cleanup code path | MEDIUM 5.9 | 0.4 % | ||
| CVE-2026-82717 | < 1.26.1 | CNAME synthesis could lead to heap corruption | HIGH 8.4 | 0.8 % | ||
| CVE-2026-81642 | < 1.26.1 | Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY | CRITICAL 9.1 | 1.0 % | ||
| CVE-2026-81634 | < 1.26.1 | Possible heap buffer overflow during DNSSEC canonicalization | HIGH 7.5 | 0.5 % | ||
| CVE-2026-80225 | < 1.26.1 | Possible degradation of service from continuous queries on the same TCP/DoT connection | HIGH 7.5 | 0.5 % | ||
| CVE-2026-78227 | 1.22.0 – < 1.26.1 | Use-after-free in DoQ stream output buffer on reset re-transmission | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-77955 | 1.13.2 – < 1.26.1 | Possible ZONEMD verification bypass window | MEDIUM 4.4 | 0.2 % | ||
| CVE-2026-77860 | 1.20.0 – < 1.26.1 | 'serve-expired' can bypass Unbound 'wait-limit' | LOW 3.7 | 0.3 % | ||
| CVE-2026-56444 | 1.20.0 – < 1.25.2 | Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration | MEDIUM 5.9 | 0.4 % | ||
| CVE-2026-56416 | < 1.25.2 | Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name | MEDIUM 4.8 | 0.1 % | ||
| CVE-2026-55991 | 1.22.0 – < 1.25.2 | Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2 | MEDIUM 5.9 | 0.4 % | ||
| CVE-2026-55990 | 1.7.0 – < 1.25.2 | Packet of death for a DNSCrypt misconfigured Unbound | MEDIUM 5.9 | 0.2 % | ||
| CVE-2026-55973 | 1.23.0 – < 1.25.2 | 'dns-error-reporting: yes' leads to stack buffer overflow | HIGH 7.5 | 0.3 % | ||
| CVE-2026-55717 | 1.10.0 – < 1.25.2 | 'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash | MEDIUM 5.9 | 0.2 % | ||
| CVE-2026-55708 | 1.6.0 – < 1.25.2 | Privacy/configuration issue when adding local data in views through 'unbound-control' | LOW 3.1 | 0.2 % | ||
| CVE-2026-54478 | 1.18.0 – < 1.25.2 | DNS Cookie bypass when combined with proxy-protocol use | LOW 3.7 | 0.2 % | ||
| CVE-2026-52863 | 1.25.0 – < 1.25.2 | Memory corruption could lead to crash and denial of service | MEDIUM 5.9 | 0.4 % | ||
| CVE-2026-50252 | 1.4.22 – < 1.25.2 | Possible cache poisoning attack by mapping source port population per thread | MEDIUM 5.7 | 0.2 % | ||
| CVE-2026-50251 | < 1.25.2 | Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-50248 | 1.7.0 – < 1.25.2 | BOGUS configured primary hostname accepted for XFR in auth/rpz zones | MEDIUM 6.5 | 0.1 % | ||
| CVE-2026-50243 | 1.6.2 – < 1.25.2 | 'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL | MEDIUM 6.3 | 0.1 % | ||
| CVE-2026-50046 | 1.15.0 – < 1.25.2 | Possible heap use-after-free in an error path when a DoT forwarded query is jostled out | MEDIUM 5.9 | 0.2 % | ||
| CVE-2026-50045 | 1.22.0 – < 1.25.2 | 'max-global-quota' reset by DNSSEC validation restarts | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-46582 | 1.6.0 – < 1.25.2 | A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path | LOW 3.7 | 0.2 % | ||
| CVE-2026-44690 | 1.7.0 – < 1.25.2 | Cross-zone wildcard cache poisoning via RRSIG.labels manipulation | HIGH 7.5 | 0.2 % | ||
| CVE-2026-44687 | 1.13.2 – < 1.25.2 | Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN | LOW 3.7 | 0.2 % | ||
| CVE-2026-44621 | < 1.25.2 | Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abruptly terminated | MEDIUM 5.9 | 0.2 % | ||
| CVE-2026-42955 | 1.16.2 – < 1.25.2 | Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue re… | LOW 3.7 | 0.2 % | ||
| CVE-2026-41637 | 1.22.0 – < 1.25.2 | Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries | LOW 3.7 | 0.4 % | ||
| CVE-2026-40691 | 1.9.0 – < 1.25.2 | Packet of death for DNSCrypt over TCP | HIGH 7.5 | 0.3 % | ||
| CVE-2026-32665 | 1.22.0 – < 1.25.2 | Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass | HIGH 7.5 | 0.3 % | ||
| CVE-2026-14586 | 1.22.0 – < 1.25.2 | Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments | MEDIUM 5.9 | 0.4 % | ||
| CVE-2026-44608 | 1.14.0 – < 1.25.1 | Use after free and crash under special conditions in RPZ code | MEDIUM 4.6 | 0.3 % | ||
| CVE-2026-44390 | < 1.25.1 | Unbounded name compression in certain cases causes degradation of service | MEDIUM 6.9 | 0.6 % | ||
| CVE-2026-42960 | < 1.25.1 | Possible cache poisoning via promiscuous records for the authority section | MEDIUM 5.7 | 0.3 % | ||
| CVE-2026-42959 | < 1.25.1 | Crash during DNSSEC validation of malicious content | HIGH 8.7 | 0.8 % | ||
| CVE-2026-42944 | 1.14.0 – < 1.25.1 | Heap overflow with multiple NSID, COOKIE, PADDING EDNS options | HIGH 8.7 | 0.8 % | ||
| CVE-2026-42923 | < 1.25.1 | Degradation of service with unbounded NSEC3 hash calculations | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-42534 | < 1.25.1 | Jostle logic bypass degrades resolution performance | MEDIUM 6.9 | 0.6 % | ||
| CVE-2026-41292 | < 1.25.1 | Long list of incoming EDNS options degrades performance | MEDIUM 6.6 | 0.7 % | ||
| CVE-2026-40622 | 1.16.2 – < 1.25.1 | Another 'ghost domain names' attack variant | MEDIUM 6.6 | 0.1 % | ||
| CVE-2026-33278 | 1.19.1 – < 1.25.1 | Possible arbitrary code execution during DNSSEC validation | CRITICAL 9.1 | 1.4 % | ||
| CVE-2026-32792 | 1.6.2 – < 1.25.1 | Packet of death with DNSCrypt | MEDIUM 4.6 | 0.3 % | ||
| CVE-2025-11411 | ≤ 1.24.1 | Possible domain hijacking via promiscuous records in the authority section | MEDIUM 5.7 | 0.3 % | ||
| CVE-2025-5994 | 1.6.2 – < 1.23.0 | Cache poisoning via the ECS-enabled Rebirthday Attack | HIGH 8.7 | 0.2 % | ||
| CVE-2024-8508 | ≤ 1.21.0 | Unbounded name compression could lead to Denial of Service | MEDIUM 5.3 | 0.8 % | ||
| CVE-2024-1931 | 1.18.0 – < 1.19.2 | Denial of service when trimming EDE text on positive replies | HIGH 7.5 | 2.5 % | ||
| CVE-2022-3204 | unspecified – 1.16.2 | NRDelegation Attack | HIGH 7.5 | 1.6 % | ||
| CVE-2022-30699 | unspecified – 1.16.1 | Novel "ghost domain names" attack by updating almost expired delegation information | MEDIUM 6.5 | 1.2 % | ||
| CVE-2022-30698 | unspecified – 1.16.1 | Novel "ghost domain names" attack by introducing subdomain delegations | MEDIUM 6.5 | 1.2 % | ||
| CVE-2020-28935 | <= 1.12.0 | Local symlink attack in Unbound and NSD | MEDIUM 5.5 | 0.5 % | ||
| CVE-2017-15105 | before 1.6.8 | A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. An improperly validated wildcard NSEC record c | MEDIUM 5.3 | 3.2 % |