An update for unbound is now available for openEuler-24.03-LTS-SP1 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-3434 Final 1.0 1.0 2026-08-20 Initial 2026-08-20 2026-08-20 openEuler SA Tool V1.0 2026-08-20 unbound security update An update for unbound is now available for openEuler-24.03-LTS-SP1 Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn't make custom builds or provide specific features to paying customers only. Security Fix(es): In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client A/AAAA query can cause Unbound to overwrite the cached expired parent-side glue rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client query is required since Unbound implicitly performs that query. This is a variant of CVE-2026-40622 which only addressed the NS query.(CVE-2026-42955) In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed zone could be shadowed by the intermediate label's secure NXDOMAIN answer from the parent. This is caused by an off-by-one error in 'harden-below-nxdomain' logic; enabled by default. It effectively bypasses the configuration and the configured stub/forward zone is never contacted. 'harden-below-nxdomain' does an upward DNS cache walk together with a delegation point guard that does not allow NXDOMAIN synthesis above stub/forward zones. The guard tests the domain name but before stripping a label. This results in an iteration where the domain name equals the configured stub/forward zone apex that passes the guard, strips one more label, and probes the cache at the apex's immediate public parent. If that parent has a cached DNSSEC-secure NXDOMAIN, which it will for any private namespace nested two or more labels under a signed public name, the walk returns it and the configured stub/forward upstream is never contacted. This can only be triggered by the query for the intermediate label (between the stub/forward apex and the DNSSEC parent zone).(CVE-2026-44687) In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS (DoT) forwarded queries is tied to a struct's ('serviced_query') lifetime but also referenced by another struct ('waiting_tcp'). When the owning struct is jostled out of the mesh while the DoT TCP stream is still handshaking it frees the storage behind the referenced string and if the TLS stream then errors out, it dereferences the freed pointer. The dereference is read-only and the practical impact is a daemon crash resulting in denial of service. A malicious actor that knows a DoT forwarding/stub Unbound's configuration could exploit the vulnerability by quering records in the appropriate zone while keeping Unbound uder pressure so that the jostle logic kicks in. If answers for the vulnerable zone are slow, the likelihood of jostling such queries is higher, although the timing of the jostle needs to be precise. Requirements for a vulnerable Unbound is the existence of a stub/forward zone configured for DoT together with a configured '#authname' suffix on the server identification. The connectivity to the server needs to exhibit a transient failure at the correct time in order to kick off the vulnerable error path.(CVE-2026-50046) In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with 'serve-expired: yes' and 'serve-expired-client-timeout > discard-timeout > 0' (contrary to the suggested values), the discard-timeout branch during the serve expired logic drops an aged client reply without performing the correct accounting for the number of reply addresses for the query. Other identical branches outside of serve expired perform the correct decrement. Since the counter is never decremented in such scenario, it can reach the maximum limit and new clients for duplicate in-flight queries are silently dropped resulting in degradation of resolution service. A malicious actor can exploit the vulnerability by querying the resolver for a client-controlled slow-on-demand authoritative zone that can drive the counter past the threshold. Shipped defaults for 'serve-expired-client-timeout: 1800' and 'discard-timeout: 1900' make the branch unreachable.(CVE-2026-56444) An update for unbound is now available for openEuler-24.03-LTS-SP1. openEuler Security has rated this update as having a security impact of low. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Low unbound https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3434 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-42955 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-44687 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-50046 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-56444 https://nvd.nist.gov/vuln/detail/CVE-2026-42955 https://nvd.nist.gov/vuln/detail/CVE-2026-44687 https://nvd.nist.gov/vuln/detail/CVE-2026-50046 https://nvd.nist.gov/vuln/detail/CVE-2026-56444 openEuler-24.03-LTS-SP1 unbound-1.17.1-20.oe2403sp1.src.rpm python3-unbound-1.17.1-20.oe2403sp1.aarch64.rpm unbound-1.17.1-20.oe2403sp1.aarch64.rpm unbound-anchor-1.17.1-20.oe2403sp1.aarch64.rpm unbound-debuginfo-1.17.1-20.oe2403sp1.aarch64.rpm unbound-debugsource-1.17.1-20.oe2403sp1.aarch64.rpm unbound-devel-1.17.1-20.oe2403sp1.aarch64.rpm unbound-help-1.17.1-20.oe2403sp1.aarch64.rpm unbound-libs-1.17.1-20.oe2403sp1.aarch64.rpm unbound-utils-1.17.1-20.oe2403sp1.aarch64.rpm python3-unbound-1.17.1-20.oe2403sp1.x86_64.rpm unbound-1.17.1-20.oe2403sp1.x86_64.rpm unbound-anchor-1.17.1-20.oe2403sp1.x86_64.rpm unbound-debuginfo-1.17.1-20.oe2403sp1.x86_64.rpm unbound-debugsource-1.17.1-20.oe2403sp1.x86_64.rpm unbound-devel-1.17.1-20.oe2403sp1.x86_64.rpm unbound-help-1.17.1-20.oe2403sp1.x86_64.rpm unbound-libs-1.17.1-20.oe2403sp1.x86_64.rpm unbound-utils-1.17.1-20.oe2403sp1.x86_64.rpm In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client A/AAAA query can cause Unbound to overwrite the cached expired parent-side glue rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client query is required since Unbound implicitly performs that query. This is a variant of CVE-2026-40622 which only addressed the NS query. 2026-08-20 CVE-2026-42955 openEuler-24.03-LTS-SP1 Low 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N unbound security update 2026-08-20 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3434 In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed zone could be shadowed by the intermediate label's secure NXDOMAIN answer from the parent. This is caused by an off-by-one error in 'harden-below-nxdomain' logic; enabled by default. It effectively bypasses the configuration and the configured stub/forward zone is never contacted. 'harden-below-nxdomain' does an upward DNS cache walk together with a delegation point guard that does not allow NXDOMAIN synthesis above stub/forward zones. The guard tests the domain name but before stripping a label. This results in an iteration where the domain name equals the configured stub/forward zone apex that passes the guard, strips one more label, and probes the cache at the apex's immediate public parent. If that parent has a cached DNSSEC-secure NXDOMAIN, which it will for any private namespace nested two or more labels under a signed public name, the walk returns it and the configured stub/forward upstream is never contacted. This can only be triggered by the query for the intermediate label (between the stub/forward apex and the DNSSEC parent zone). 2026-08-20 CVE-2026-44687 openEuler-24.03-LTS-SP1 Low 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L unbound security update 2026-08-20 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3434 In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS (DoT) forwarded queries is tied to a struct's ('serviced_query') lifetime but also referenced by another struct ('waiting_tcp'). When the owning struct is jostled out of the mesh while the DoT TCP stream is still handshaking it frees the storage behind the referenced string and if the TLS stream then errors out, it dereferences the freed pointer. The dereference is read-only and the practical impact is a daemon crash resulting in denial of service. A malicious actor that knows a DoT forwarding/stub Unbound's configuration could exploit the vulnerability by quering records in the appropriate zone while keeping Unbound uder pressure so that the jostle logic kicks in. If answers for the vulnerable zone are slow, the likelihood of jostling such queries is higher, although the timing of the jostle needs to be precise. Requirements for a vulnerable Unbound is the existence of a stub/forward zone configured for DoT together with a configured '#authname' suffix on the server identification. The connectivity to the server needs to exhibit a transient failure at the correct time in order to kick off the vulnerable error path. 2026-08-20 CVE-2026-50046 openEuler-24.03-LTS-SP1 Low 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L unbound security update 2026-08-20 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3434 In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with 'serve-expired: yes' and 'serve-expired-client-timeout > discard-timeout > 0' (contrary to the suggested values), the discard-timeout branch during the serve expired logic drops an aged client reply without performing the correct accounting for the number of reply addresses for the query. Other identical branches outside of serve expired perform the correct decrement. Since the counter is never decremented in such scenario, it can reach the maximum limit and new clients for duplicate in-flight queries are silently dropped resulting in degradation of resolution service. A malicious actor can exploit the vulnerability by querying the resolver for a client-controlled slow-on-demand authoritative zone that can drive the counter past the threshold. Shipped defaults for 'serve-expired-client-timeout: 1800' and 'discard-timeout: 1900' make the branch unreachable. 2026-08-20 CVE-2026-56444 openEuler-24.03-LTS-SP1 Low 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L unbound security update 2026-08-20 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3434