Nlnetlabs Unbound
41 CVEs affecting Nlnetlabs Unbound. Latest disclosed: 2026-05-20. Critical: 9, High: 16.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-42960 | Critical | 10.0 | 2026-05-20 | NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. Promiscuous RRSets that com… |
CVE-2026-33278 | Critical | 9.8 | 2026-05-20 | NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote cod… |
CVE-2019-25042 | Critical | 9.8 | 2021-04-27 | Unbound before 1.9.5 allows an out-of-bounds write via a compressed name in rdata_copy. NOTE: The vendor disputes that this is a vulnerability. Although the co… |
CVE-2019-25039 | Critical | 9.8 | 2021-04-27 | Unbound before 1.9.5 allows an integer overflow in a size calculation in respip/respip.c. NOTE: The vendor disputes that this is a vulnerability. Although the… |
CVE-2019-25038 | Critical | 9.8 | 2021-04-27 | Unbound before 1.9.5 allows an integer overflow in a size calculation in dnscrypt/dnscrypt.c. NOTE: The vendor disputes that this is a vulnerability. Although… |
CVE-2019-25035 | Critical | 9.8 | 2021-04-27 | Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vu… |
CVE-2019-25034 | Critical | 9.8 | 2021-04-27 | Unbound before 1.9.5 allows an integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write. NOTE: The vendor disputes that this is a… |
CVE-2019-25033 | Critical | 9.8 | 2021-04-27 | Unbound before 1.9.5 allows an integer overflow in the regional allocator via the ALIGN_UP macro. NOTE: The vendor disputes that this is a vulnerability. Altho… |
CVE-2019-25032 | Critical | 9.8 | 2021-04-27 | Unbound before 1.9.5 allows an integer overflow in the regional allocator via regional_alloc. NOTE: The vendor disputes that this is a vulnerability. Although… |
CVE-2026-42959 | High | 7.5 | 2026-05-20 | NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validator that can lead to a crash given malicious up… |
CVE-2026-42944 | High | 7.5 | 2026-05-20 | NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie ED… |
CVE-2026-41292 | High | 7.5 | 2026-05-20 | NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options… |
CVE-2026-40622 | High | 7.5 | 2026-05-20 | NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost doma… |
CVE-2024-1931 | High | 7.5 | 2024-03-07 | NLnet Labs Unbound version 1.18.0 up to and including version 1.19.1 contain a vulnerability that can cause denial of service by a certain code path that can l… |
CVE-2023-50387 | High | 7.5 | 2024-02-14 | Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumpti… |
CVE-2022-3204 | High | 7.5 | 2022-09-26 | A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolving software. The NRDelegation Attack w… |
CVE-2019-25041 | High | 7.5 | 2021-04-27 | Unbound before 1.9.5 allows an assertion failure via a compressed name in dname_pkt_copy. NOTE: The vendor disputes that this is a vulnerability. Although the… |
CVE-2019-25040 | High | 7.5 | 2021-04-27 | Unbound before 1.9.5 allows an infinite loop via a compressed name in dname_pkt_copy. NOTE: The vendor disputes that this is a vulnerability. Although the code… |
CVE-2019-25037 | High | 7.5 | 2021-04-27 | Unbound before 1.9.5 allows an assertion failure and denial of service in dname_pkt_copy via an invalid packet. NOTE: The vendor disputes that this is a vulner… |
CVE-2019-25036 | High | 7.5 | 2021-04-27 | Unbound before 1.9.5 allows an assertion failure and denial of service in synth_cname. NOTE: The vendor disputes that this is a vulnerability. Although the cod… |