unbound - security update
Multiple security vulnerabilities were discovered in Unbound, a validating, recursive, caching DNS resolver. CVE-2026-35501 (DNSSEC) Bypass of a configured island trust anchor underneath an insecure parent from an attacker-controlled NSEC record. CVE-2026-50106 (DNSSEC) Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent. CVE-2026-96405 Aggregate DNS name chained pointer decompression work leads to degradation of service. CVE-2026-97206 DNS-over-QUIC path-migration can lead to use-after-free on multi-threaded deployments, leading to potential denial of service. CVE-2026-109125 Possible cache poisoning vulnerability via a ca
Read at Debian Security Advisories
- Vendor
- Debian
- Product
- dnsmasq / Unbound / PowerDNS
- EPSS
- 0.003 (p27)
- Exposure class
- Edge / VPN / firewall
Why it ranks 32 (Notable)
- Exposed product class: edge / VPN / firewall
- Widely deployed vendor product (Debian)
- Covered by 2 independent sources
- Vendor security advisory
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Debian Security Advisories (lists.debian.org)
- CVE-2026-35501 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-50106 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-96405 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-97206 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-109125 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.