UN
Product
Unbound
73
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 12High 23Medium 25Low 8
Watch
Add Unbound to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-85501 | 7.5 | Sep 16 | Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC Affected: before 1.26.1 |
| CVE-2026-81634 | 7.5 | Sep 16 | Possible heap buffer overflow during DNSSEC canonicalization Affected: before 1.26.1 |
| CVE-2026-80225 | 7.5 | Sep 16 | Possible degradation of service from continuous queries on the same TCP/DoT connection Affected: before 1.26.1 |
| CVE-2026-55973 | 7.5 | Jul 22 | 'dns-error-reporting: yes' leads to stack buffer overflow Affected: 1.23.0 before 1.25.2 |
| CVE-2026-44690 | 7.5 | Jul 22 | Cross-zone wildcard cache poisoning via RRSIG.labels manipulation Affected: 1.7.0 before 1.25.2 |
| CVE-2026-40691 | 7.5 | Jul 22 | Packet of death for DNSCrypt over TCP Affected: 1.9.0 before 1.25.2 |
| CVE-2026-32665 | 7.5 | Jul 22 | Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass Affected: 1.22.0 before 1.25.2 |
| CVE-2026-42959 | 7.5 | May 20 | Crash during DNSSEC validation of malicious content Affected: before 1.25.1 |
| CVE-2026-42944 | 7.5 | May 20 | Heap overflow with multiple NSID, COOKIE, PADDING EDNS options Affected: 1.14.0 before 1.25.1 |
| CVE-2026-41292 | 7.5 | May 20 | Long list of incoming EDNS options degrades performance Affected: before 1.25.1 |
| CVE-2026-40622 | 7.5 | May 20 | Another 'ghost domain names' attack variant Affected: 1.16.2 before 1.25.1 |
| CVE-2024-1931 | 7.5 | Mar 7 | NLnet Labs Unbound version 1.18.0 up to and including version 1.19.1 contain a vulnerability that can cause denial of service by a certain code path that can lead to an infinite… Affected: 1.18.0 before 1.19.2 |
| CVE-2023-50387 | 7.5 | Feb 14 | Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more… Affected: before 1.19.1 |
| CVE-2022-3204 | 7.5 | Sep 26 | A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolving software Affected: through 1.16.2 |
| CVE-2019-25041 | 7.5 | Apr 27 | Unbound before 1.9.5 allows an assertion failure via a compressed name in dname_pkt_copy Affected: before 1.9.5 |
| CVE-2019-25040 | 7.5 | Apr 27 | Unbound before 1.9.5 allows an infinite loop via a compressed name in dname_pkt_copy Affected: before 1.9.5 |
| CVE-2019-25037 | 7.5 | Apr 27 | Unbound before 1.9.5 allows an assertion failure and denial of service in dname_pkt_copy via an invalid packet Affected: before 1.9.5 |
| CVE-2019-25036 | 7.5 | Apr 27 | Unbound before 1.9.5 allows an assertion failure and denial of service in synth_cname Affected: before 1.9.5 |
| CVE-2020-10772 | 7.5 | Nov 27 | An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020:2414 Affected: 1.6.6-5 |
| CVE-2020-12663 | 7.5 | May 19 | Unbound before 1.10.1 has an infinite loop via malformed DNS answers received from upstream servers Affected: before 1.10.1 |
| CVE-2020-12662 | 7.5 | May 19 | Unbound before 1.10.1 has Insufficient Control of Network Message Volume, aka an "NXNSAttack" issue Affected: before 1.10.1 |
| CVE-2019-16866 | 7.5 | Oct 3 | Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query Affected: before 1.9.4 |
| CVE-2019-18934 | 7.3 | Nov 19 | Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiving a specially crafted answer Affected: 1.6.4 through 1.9.4 |
Showing 23