UN
Product
Unbound
73
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 12High 23Medium 25Low 8
Watch
Add Unbound to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-50251 | 5.3 | Jul 22 | Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush Affected: before 1.25.2 |
| CVE-2026-50045 | 5.3 | Jul 22 | 'max-global-quota' reset by DNSSEC validation restarts Affected: 1.22.0 before 1.25.2 |
| CVE-2026-44390 | 5.3 | May 20 | Unbounded name compression in certain cases causes degradation of service Affected: before 1.25.1 |
| CVE-2026-42923 | 5.3 | May 20 | Degradation of service with unbounded NSEC3 hash calculations Affected: 1.19.1 before 1.25.1 |
| CVE-2026-42534 | 5.3 | May 20 | Jostle logic bypass degrades resolution performance Affected: before 1.25.1 |
| CVE-2026-32792 | 5.3 | May 20 | Packet of death with DNSCrypt Affected: 1.6.2 before 1.25.1 |
| CVE-2024-8508 | 5.3 | Oct 3 | NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compression for Affected: before 1.21.1 |
| CVE-2017-15105 | 5.3 | Jan 23 | A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records Affected: before 1.6.8 |
| CVE-2026-56416 | 4.8 | Jul 22 | Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name Affected: before 1.25.2 |
| CVE-2026-77955 | 4.4 | Sep 16 | Possible ZONEMD verification bypass window Affected: 1.13.2 before 1.26.1 |
| CVE-2026-77860 | 3.7 | Sep 16 | 'serve-expired' can bypass Unbound 'wait-limit' Affected: 1.20.0 before 1.26.1 |
| CVE-2026-54478 | 3.7 | Jul 22 | DNS Cookie bypass when combined with proxy-protocol use Affected: 1.18.0 before 1.25.2 |
| CVE-2026-50243 | 3.7 | Jul 22 | 'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL Affected: 1.6.2 before 1.25.2 |
| CVE-2026-46582 | 3.7 | Jul 22 | A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path Affected: 1.6.0 before 1.25.2 |
| CVE-2026-44687 | 3.7 | Jul 22 | Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN Affected: 1.13.2 before 1.25.2 |
| CVE-2026-42955 | 3.7 | Jul 22 | Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records Affected: 1.16.2 before 1.25.2 |
| CVE-2026-41637 | 3.7 | Jul 22 | Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries Affected: 1.22.0 before 1.25.2 |
| CVE-2026-55708 | 3.1 | Jul 22 | Privacy/configuration issue when adding local data in views through 'unbound-control' Affected: 1.6.0 before 1.25.2 |
| CVE-2014-8602 | – | Dec 11 | iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a… Affected: through 1.5.0 |
| CVE-2009-4008 | – | Jun 2 | Unbound before 1.4.4 does not send responses for signed zones after mishandling an unspecified query, which allows remote attackers to cause a denial of service (DNSSEC outage)… Affected: through 1.4.3; 0.0; 0.1; 0.2; 0.3; 0.4; +24 more |
| CVE-2011-1922 | – | May 31 | daemon/worker.c in Unbound 1.x before 1.4.10, when debugging functionality and the interface-automatic option are enabled, allows remote attackers to cause a denial of service… Affected: 1.0.0; 1.0.1; 1.0.2; 1.1.0; 1.1.1; 1.2.0; +16 more |
| CVE-2010-0969 | – | Mar 16 | Unbound before 1.4.3 does not properly align structures on 64-bit platforms, which allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors Affected: through 1.4.2; 0.0; 0.1; 0.2; 0.3; 0.4; +23 more |
| CVE-2009-3602 | – | Oct 13 | Unbound before 1.3.4 does not properly verify signatures for NSEC3 records, which allows remote attackers to cause secure delegations to be downgraded via DNS spoofing or other… Affected: through 1.3.3; 0.0; 0.1; 0.2; 0.3; 0.4; +19 more |