Home / mailings

PDF

[USN-8946-2] Unbound vulnerabilities

Posted on 11 November 2026
Ubuntu Security

==========================================================================Ubuntu Security Notice USN-8946-2
November 10, 2026

unbound vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.10

Summary:

Several security issues were fixed in Unbound.

Software Description:
- unbound: validating, recursive, caching DNS resolver

Details:

USN-8946-1 fixed vulnerabilities in Unbound in Ubuntu 26.04 LTS, Ubuntu
24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 LTS, Ubuntu
16.04 LTS, and Ubuntu 14.04 LTS. This update provides the corresponding
update for Ubuntu 26.10.

Original advisory details:

It was discovered that Unbound incorrectly handled certain TCP
connections. A remote attacker could possibly use this issue to cause
Unbound to consume resources, leading to a denial of service. This issue
only affected Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS and
Ubuntu 20.04 LTS. (CVE-2026-80225)

It was discovered that Unbound incorrectly handled certain DNS responses.
A remote attacker could possibly use this issue to crash Unbound,
resulting in a denial of service. (CVE-2026-81634)

It was discovered that Unbound incorrectly handled certain DNS responses
during DNSSEC validation. A remote attacker could possibly use this issue
to cause Unbound to consume resources, leading to a denial of service.
(CVE-2026-85501)

It was discovered that Unbound incorrectly handled outgoing network ports.
A remote attacker could possibly use this issue to crash Unbound, resulting
in a denial of service. (CVE-2026-50252)

It was discovered that Unbound incorrectly handled certain DNSCrypt
packets. A remote attacker could possibly use this issue to crash Unbound,
resulting in a denial of service. This issue only affected Ubuntu 26.04
LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS and Ubuntu 18.04
LTS. (CVE-2026-40691)

It was discovered that Unbound incorrectly handled certain cached DNS
responses. A remote attacker could possibly use this issue to poison
Unbound's cache. This issue only affected Ubuntu 26.04 LTS, Ubuntu 24.04
LTS, Ubuntu 22.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-44690)

It was discovered that Unbound incorrectly handled certain DNS-over-QUIC
connections. A remote attacker could possibly use this issue to cause
Unbound to consume resources, leading to a denial of service. This issue
only affected Ubuntu 26.04 LTS. (CVE-2026-32665)

It was discovered that Unbound incorrectly handled certain EDNS options. A
remote attacker could possibly use this issue to crash Unbound, resulting
in a denial of service. This issue only affected Ubuntu 26.04 LTS.
(CVE-2026-55973)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.10
libunbound8 1.25.1-1ubuntu3.1
unbound 1.25.1-1ubuntu3.1

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-8946-2
https://ubuntu.com/security/notices/USN-8946-1
CVE-2026-32665, CVE-2026-40691, CVE-2026-44690, CVE-2026-50252,
CVE-2026-55973, CVE-2026-80225, CVE-2026-81634, CVE-2026-85501

Package Information:
https://launchpad.net/ubuntu/+source/unbound/1.25.1-1ubuntu3.1

--===============0262931767789179916==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature

 

TOP