{"schema_version":"1.7.2","id":"OESA-2026-4277","modified":"2026-10-16T11:58:52Z","published":"2026-10-16T11:58:52Z","upstream":["CVE-2026-77860","CVE-2026-77955","CVE-2026-82720","CVE-2026-85501"],"summary":"unbound security update","details":"Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn't make custom builds or provide specific features to paying customers only.\r\n\r\nSecurity Fix(es):\n\nIn NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb (CVE-2024-33655). A malicious actor can exploit this by controlling an authoritative zone with short TTL, so cached entries expire quickly. Each 'slow' query, one the attacker's authoritative never answers, is followed by one query for an expired cached name, which is answered immediately via the 'serve-expired' path and decrements the counter twice. This second query was named 'pump'. By alternating slow queries and pumps, the attacker keeps the per-client counter at or below the configured 'wait-limit' indefinitely, and can hold an arbitrary number of pending queries from a single source IP, up to the global mesh quota (num-queries-per-thread); eventually bypassing one of the counter measures introduced for DNSBomb (CVE-2024-33655). This vulnerability is present on the 'serve-expired' code path.(CVE-2026-77860)\n\nIn NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check failed, the tampered data are reloaded on startup and available until ZONEMD verification concludes again. If verification fails, the data is not served any more but still persists on disk for future reloads.(CVE-2026-77955)\n\nNLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. During failure code paths (i.e., RPZ drop query, jostle due to heavy traffic), a dropped DoH stream brings down the whole DoH session and does not account properly for other DoH streams in the same session. This leads to use-after-free in those code paths. If the prerequisites are satisfied (possible RPZ drop or heavy client traffic), a malicious actor can trigger the vulnerability with a single DoH connection and the appropriate traffic. Impact is limited as the reads are not user controlled and the use-after-free leads to early returns. However, a hardened allocator can catch the use-after-free and controllably terminate the process resulting to denial of service.(CVE-2026-82720)\n\nNovel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where  the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested domains, this results in significant computational overhead. NsecTrap, where  responses with excessive invalid NSEC records compel the resolver to validate each one. AdditionalTrap, where Unbound by default would try to DNSSEC validate the ADDITIONAL section as well. This can be exploited to waste validation resources by malicious users.(CVE-2026-85501)","affected":[{"package":{"ecosystem":"openEuler:24.03-LTS-SP1","name":"unbound","purl":"pkg:rpm/openEuler/unbound&distro=openEuler-24.03-LTS-SP1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-23.oe2403sp1"}]}],"ecosystem_specific":{"aarch64":["python3-unbound-1.17.1-23.oe2403sp1.aarch64.rpm","unbound-1.17.1-23.oe2403sp1.aarch64.rpm","unbound-anchor-1.17.1-23.oe2403sp1.aarch64.rpm","unbound-debuginfo-1.17.1-23.oe2403sp1.aarch64.rpm","unbound-debugsource-1.17.1-23.oe2403sp1.aarch64.rpm","unbound-devel-1.17.1-23.oe2403sp1.aarch64.rpm","unbound-help-1.17.1-23.oe2403sp1.aarch64.rpm","unbound-libs-1.17.1-23.oe2403sp1.aarch64.rpm","unbound-utils-1.17.1-23.oe2403sp1.aarch64.rpm"],"src":["unbound-1.17.1-23.oe2403sp1.src.rpm"],"x86_64":["python3-unbound-1.17.1-23.oe2403sp1.x86_64.rpm","unbound-1.17.1-23.oe2403sp1.x86_64.rpm","unbound-anchor-1.17.1-23.oe2403sp1.x86_64.rpm","unbound-debuginfo-1.17.1-23.oe2403sp1.x86_64.rpm","unbound-debugsource-1.17.1-23.oe2403sp1.x86_64.rpm","unbound-devel-1.17.1-23.oe2403sp1.x86_64.rpm","unbound-help-1.17.1-23.oe2403sp1.x86_64.rpm","unbound-libs-1.17.1-23.oe2403sp1.x86_64.rpm","unbound-utils-1.17.1-23.oe2403sp1.x86_64.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4277"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77860"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77955"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82720"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85501"}],"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"database_specific":{"severity":"Medium"}}