Possible cache poisoning via promiscuous records for the authority section

CNAME synthesis could lead to heap corruption

Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY

Possible arbitrary code execution during DNSSEC validation

Unbound before 1.9.5 allows an out-of-bounds write via a compressed name in rdata_copy

Unbound before 1.9.5 allows an integer overflow in a size calculation in respip/respip.c

Unbound before 1.9.5 allows an integer overflow in a size calculation in dnscrypt/dnscrypt.c

Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par

Unbound before 1.9.5 allows an integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write

Unbound before 1.9.5 allows an integer overflow in the regional allocator via the ALIGN_UP macro

Unbound before 1.9.5 allows an integer overflow in the regional allocator via regional_alloc

Possible cache poisoning attack by mapping source port population per thread