Home / mailings [SECURITY] [DSA 6581-1] unbound security update
Posted on 23 October 2026
Debian Security Advisory- -------------------------------------------------------------------------
Debian Security Advisory DSA-6581-1 security@debian.org
https://www.debian.org/security/ Yves-Alexis Perez
October 23, 2026 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : unbound
CVE ID : CVE-2026-35501 CVE-2026-50106 CVE-2026-96405 CVE-2026-97206
CVE-2026-109125
Multiple security vulnerabilities were discovered in Unbound, a validating,
recursive, caching DNS resolver.
CVE-2026-35501
(DNSSEC) Bypass of a configured island trust anchor underneath an insecure
parent from an attacker-controlled NSEC record.
CVE-2026-50106
(DNSSEC) Possible insecure NXDOMAIN for non-existing records under a
configured island trust anchor underneath an insecure parent.
CVE-2026-96405
Aggregate DNS name chained pointer decompression work leads to degradation
of service.
CVE-2026-97206
DNS-over-QUIC path-migration can lead to use-after-free on multi-threaded
deployments, leading to potential denial of service.
CVE-2026-109125
Possible cache poisoning vulnerability via a cache side-channel exposed by
'unwanted-reply-threshold'.
For the stable distribution (trixie), these problems have been fixed in
version 1.26.2-0+deb13u1.
We recommend that you upgrade your unbound packages.
For the detailed security status of unbound please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/unbound
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
