Nlnet Labs Unbound
53 CVEs affecting Nlnet Labs Unbound. Latest disclosed: 2026-09-16. Critical: 5, High: 11.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-42960 | Critical | 10.0 | 2026-05-20 | NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. Promiscuous RRSets that com… |
CVE-2026-82717 | Critical | 9.8 | 2026-09-16 | In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compila… |
CVE-2026-81642 | Critical | 9.8 | 2026-09-16 | In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code exe… |
CVE-2026-33278 | Critical | 9.8 | 2026-05-20 | NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote cod… |
CVE-2026-50252 | Critical | 9.3 | 2026-07-22 | In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DN… |
CVE-2026-81634 | High | 7.5 | 2026-09-16 | In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonic… |
CVE-2026-55973 | High | 7.5 | 2026-07-22 | In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from the last upstrea… |
CVE-2026-44690 | High | 7.5 | 2026-07-22 | In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198… |
CVE-2026-40691 | High | 7.5 | 2026-07-22 | In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply… |
CVE-2026-32665 | High | 7.5 | 2026-07-22 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streams on a new QUIC conn… |
CVE-2026-42959 | High | 7.5 | 2026-05-20 | NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validator that can lead to a crash given malicious up… |
CVE-2026-42944 | High | 7.5 | 2026-05-20 | NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie ED… |
CVE-2026-41292 | High | 7.5 | 2026-05-20 | NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options… |
CVE-2026-40622 | High | 7.5 | 2026-05-20 | NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost doma… |
CVE-2024-1931 | High | 7.5 | 2024-03-07 | NLnet Labs Unbound version 1.18.0 up to and including version 1.19.1 contain a vulnerability that can cause denial of service by a certain code path that can l… |
CVE-2022-3204 | High | 7.5 | 2022-09-26 | A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolving software. The NRDelegation Attack w… |
CVE-2026-78227 | Medium | 6.5 | 2026-09-16 | NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each… |
CVE-2026-50248 | Medium | 6.5 | 2026-07-22 | In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still cons… |
CVE-2022-30699 | Medium | 6.5 | 2022-08-01 | NLnet Labs Unbound, up to and including version 1.16.1, is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targeting… |
CVE-2022-30698 | Medium | 6.5 | 2022-08-01 | NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targeting a… |