{"schemaVersion":3,"id":"SUSE-SU-2026:23349-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for unbound\n\nThis update for unbound fixes the following issues:\n\nUpdate to version 1.25.2.\n\nSecurity issues fixed:\n\n- CVE-2026-14586: DoS via assertion in `libngtcp2` for DNS-over-QUIC environments with high concurrency (bsc#1271879).\n- CVE-2026-32665: Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass (bsc#1271873).\n- CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875).\n- CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries\n  (bsc#1271891).\n- CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records\n  (bsc#1271892).\n- CVE-2026-44621: Libunbound applications configured with `unwanted-reply-threshold` could eventually be abruptly\n  terminated (bsc#1271876).\n- CVE-2026-44687: Off-by-one error in `harden-below-nxdomain` logic can shadow a stub/forward zone by a legitimate\n  parent's `NXDOMAIN` (bsc#1271893).\n- CVE-2026-44690: Cross-zone wildcard cache poisoning via `RRSIG.labels` manipulation (bsc#1271877).\n- CVE-2026-46582: Replay of a wildcard `rrset` as another piece of data triggers poisoning in the server expired reply\n  path (bsc#1271894).\n- CVE-2026-50045: `max-global-quota` bypass via single client queries for a deeply nested name under a DNSSEC-signed\n  parent (bsc#1271878).\n- CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882).\n- CVE-2026-50243: `response-ip`/`rpz` can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880).\n- CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881).\n- CVE-2026-50251: Attacker supplied `0.0.0.0`/`::` glue triggers defensive full-cache flush (bsc#1271883).\n- CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884).\n- CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with `answer-cookie:yes` is used (bsc#1271895).\n- CVE-2026-55708: Privacy/configuration issue when adding local data in views through `unbound-control` (bsc#1271896).\n- CVE-2026-55717: `serve-expired-client-timeout` and `response-ip` CNAME redirect could lead to a crash (bsc#1271886).\n- CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887).\n- CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in `libngtcp2` (bsc#1271888).\n- CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name\n  (bsc#1271889).\n- CVE-2026-56444: Degradation of resolution service when `discard-timeout` and `serve-expired-client-timeout` are\n  combined in unusual configuration (bsc#1271890).\n\nOther updates and bugfixes:\n\n- Version 1.25.2:\n  * For a complete list of additional changes see the changelog at https://nlnetlabs.nl/projects/unbound/download/.\n- Update `unbound.keyring`.","dates":{"published":"2026-08-26T14:24:09.000Z","modified":"2026-09-10T18:23:12.453Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"suse","product":"unbound&distro=SUSE Linux Micro 6.1","name":"unbound","label":"unbound&distro=SUSE Linux Micro 6.1","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/unbound&distro=SUSE Linux Micro 6.1","purlType":"rpm","versions":[{"text":"< 1.25.2-slfo.1.1_1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.25.2-slfo.1.1_1.1","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623349-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-202623349-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1271873","label":"bugzilla.suse.com/1271873","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271875","label":"bugzilla.suse.com/1271875","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271876","label":"bugzilla.suse.com/1271876","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271877","label":"bugzilla.suse.com/1271877","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271878","label":"bugzilla.suse.com/1271878","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271879","label":"bugzilla.suse.com/1271879","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271880","label":"bugzilla.suse.com/1271880","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271881","label":"bugzilla.suse.com/1271881","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271882","label":"bugzilla.suse.com/1271882","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271883","label":"bugzilla.suse.com/1271883","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271884","label":"bugzilla.suse.com/1271884","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271886","label":"bugzilla.suse.com/1271886","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271887","label":"bugzilla.suse.com/1271887","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271888","label":"bugzilla.suse.com/1271888","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271889","label":"bugzilla.suse.com/1271889","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271890","label":"bugzilla.suse.com/1271890","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271891","label":"bugzilla.suse.com/1271891","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271892","label":"bugzilla.suse.com/1271892","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271893","label":"bugzilla.suse.com/1271893","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271894","label":"bugzilla.suse.com/1271894","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271895","label":"bugzilla.suse.com/1271895","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271896","label":"bugzilla.suse.com/1271896","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14586","label":"www.suse.com/security/cve/CVE-2026-14586","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32665","label":"www.suse.com/security/cve/CVE-2026-32665","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40622","label":"www.suse.com/security/cve/CVE-2026-40622","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40691","label":"www.suse.com/security/cve/CVE-2026-40691","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41637","label":"www.suse.com/security/cve/CVE-2026-41637","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42955","label":"www.suse.com/security/cve/CVE-2026-42955","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44621","label":"www.suse.com/security/cve/CVE-2026-44621","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44687","label":"www.suse.com/security/cve/CVE-2026-44687","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44690","label":"www.suse.com/security/cve/CVE-2026-44690","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46582","label":"www.suse.com/security/cve/CVE-2026-46582","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50045","label":"www.suse.com/security/cve/CVE-2026-50045","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50046","label":"www.suse.com/security/cve/CVE-2026-50046","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50243","label":"www.suse.com/security/cve/CVE-2026-50243","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50248","label":"www.suse.com/security/cve/CVE-2026-50248","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50251","label":"www.suse.com/security/cve/CVE-2026-50251","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50252","label":"www.suse.com/security/cve/CVE-2026-50252","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54478","label":"www.suse.com/security/cve/CVE-2026-54478","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55708","label":"www.suse.com/security/cve/CVE-2026-55708","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55717","label":"www.suse.com/security/cve/CVE-2026-55717","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55990","label":"www.suse.com/security/cve/CVE-2026-55990","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55991","label":"www.suse.com/security/cve/CVE-2026-55991","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56416","label":"www.suse.com/security/cve/CVE-2026-56416","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56444","label":"www.suse.com/security/cve/CVE-2026-56444","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2026-14586","CVE-2026-32665","CVE-2026-40622","CVE-2026-40691","CVE-2026-41637","CVE-2026-42955","CVE-2026-44621","CVE-2026-44687","CVE-2026-44690","CVE-2026-46582","CVE-2026-50045","CVE-2026-50046","CVE-2026-50243","CVE-2026-50248","CVE-2026-50251","CVE-2026-50252","CVE-2026-54478","CVE-2026-55708","CVE-2026-55717","CVE-2026-55990","CVE-2026-55991","CVE-2026-56416","CVE-2026-56444"],"downstream":[],"duplicates":[],"related":["CVE-2026-14586","CVE-2026-32665","CVE-2026-40622","CVE-2026-40691","CVE-2026-41637","CVE-2026-42955","CVE-2026-44621","CVE-2026-44687","CVE-2026-44690","CVE-2026-46582","CVE-2026-50045","CVE-2026-50046","CVE-2026-50243","CVE-2026-50248","CVE-2026-50251","CVE-2026-50252","CVE-2026-54478","CVE-2026-55708","CVE-2026-55717","CVE-2026-55990","CVE-2026-55991","CVE-2026-56416","CVE-2026-56444"]},"timeline":[{"kind":"published","date":"2026-08-26T14:24:09.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-10T18:23:12.453Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T22:37:58.033Z","stale":false,"partial":false}}