-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 17 Sep 2026 11:55:59 +0300 Source: unbound Binary: libunbound-dev libunbound8 libunbound8-dbgsym python3-unbound python3-unbound-dbgsym unbound unbound-anchor unbound-anchor-dbgsym unbound-dbgsym unbound-host unbound-host-dbgsym Architecture: s390x Version: 1.26.1-0+deb13u1 Distribution: trixie-security Urgency: medium Maintainer: s390x Build Daemon (zandonai) Changed-By: Michael Tokarev Description: libunbound-dev - static library, header files, and docs for libunbound libunbound8 - library implementing DNS resolution and validation python3-unbound - library implementing DNS resolution and validation (Python3 bindi unbound - validating, recursive, caching DNS resolver unbound-anchor - utility to securely fetch the root DNS trust anchor unbound-host - reimplementation of the 'host' command Closes: 1096189 1142539 Changes: unbound (1.26.1-0+deb13u1) trixie-security; urgency=medium . * New upstream release fixing numerous security and other issues and contains some enhancements. . Traditionally in Debian, bugs in stable versions are fixed by providing a back-port of a fix from later upstream version to the version in Debian stable. With unbound, fixes in subsequent versions can not be applied directly to the version in Debian stable, as there were multiple other code changes in these areas. Many of these changes fixes other issues (security or not). Some changes are in areas with complex logic, hence requires creat care when back-porting to older releases. And the result of such back-porting becomes unique and rather unpredictable. So instead of trying to provide fixes for older version in Debian stable, we decided to provide current upstream version of unbound, - the same as currently available in Debian Sid. The packaging is made very similar too. . Recent security fixes: . o CVE-2026-81642 - severity: CRITICAL Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY o CVE-2026-81634 - severity: HIGH Possible heap buffer overflow during DNSSEC canonicalization o CVE-2026-82717 - severity: HIGH CNAME synthesis could lead to heap corruption o CVE-2026-77955 - severity: MEDIUM Possible ZONEMD verification bypass window o CVE-2026-78227 - severity: MEDIUM Use-after-free in DoQ stream output buffer on reset re-transmission o CVE-2026-80225 - severity: MEDIUM Possible degradation of service from continuous queries on the same TCP/DoT connection o CVE-2026-82720 - severity: MEDIUM Use-after-free in DoH stream cleanup code path o CVE-2026-85501 - severity: MEDIUM Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC o CVE-2026-77860 - severity: LOW 'serve-expired' can bypass Unbound 'wait-limit' o CVE-2026-32665 - severity: HIGH Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass o CVE-2026-40691 - severity: HIGH Packet of death for DNSCrypt over TCP o CVE-2026-44690 - severity: HIGH Cross-zone wildcard cache poisoning via RRSIG.labels manipulation o CVE-2026-55973 - severity: HIGH 'dns-error-reporting: yes' leads to stack buffer overflow o CVE-2026-14586 - severity: MEDIUM Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments o CVE-2026-44621 - severity: MEDIUM Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abruptly terminated o CVE-2026-50045 - severity: MEDIUM 'max-global-quota' reset by DNSSEC validation restarts o CVE-2026-50046 - severity: MEDIUM Possible heap use-after-free in an error path when a DoT forwarded query is jostled out o CVE-2026-50243 - severity: MEDIUM response-ip/rpz can rewrite BOGUS answers instead of returning SERVFAIL o CVE-2026-50248 - severity: MEDIUM BOGUS configured primary hostname accepted for XFR in auth/rpz zones o CVE-2026-50251 - severity: MEDIUM Attacker supplied 0.0.0.0/:: glue triggers defensive full-cache flush o CVE-2026-50252 - severity: MEDIUM Possible cache poisoning attack by mapping source port population per thread o CVE-2026-52863 - severity: MEDIUM Memory corruption could lead to crash and denial of service o CVE-2026-55717 - severity: MEDIUM 'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash o CVE-2026-55990 - severity: MEDIUM Packet of death for a DNSCrypt misconfigured Unbound o CVE-2026-55991 - severity: MEDIUM Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2 o CVE-2026-56416 - severity: MEDIUM Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name o CVE-2026-56444 - severity: MEDIUM Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration o CVE-2026-41637 - severity: LOW Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries o CVE-2026-42955 - severity: LOW Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records o CVE-2026-44687 - severity: LOW Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN o CVE-2026-46582 - severity: LOW A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path o CVE-2026-54478 - severity: LOW DNS Cookie bypass when combined with proxy-protocol use o CVE-2026-55708 - severity: LOW Privacy/configuration issue when adding local data in views through 'unbound-control' . Other notable user-visible changes and fixes. For complete list, please see /usr/share/doc/unbound/changelog.gz . o ICANN Bundle Update: Refreshed icannbundle.pem certificates in unbound-anchor to include public keys valid for 2009–2029 and 2025–2045 o Transfer Limits: Added max-transfer-size and max-transfer-time directives to limit authorization zone (auth-zone) and RPZ transfer sizes and times to harden against unbounded transfers. o New Zone Types: Introduced block_aaaa static zone type to suppress AAAA queries, plus block_a_wdata and block_aaaa_wdata to support custom local data fallback. o Management Improvements: Overloaded local_data_remove to allow the removal of precise records. o Fix for the Jiggle Attack. The server is fixed to answer with errors for error cases, and does not stay silent. In addition, the error replies do not contain parts of the incoming query. This is more conformant, stops reflection and stops it as a covert channel. o Fix EDNS extended RCODE reflection. This fixes that the server does not echo extended rcode values after class chaos queries. o Fix for iterator RCODE handling of YXDOMAIN. This fixes that the server only accepts YXDOMAIN answers that contain a DNAME record. This stops bad answers, and checks that the authoritative server gives correct replies. o Fix for missing bounds check for decompressing dnames for downloaded authority zones. This fixes that the server could end up with malformed zone content after receiving truncated packet contents from an AXFR. In addition, the domain names in the SOA rdata are checked before the authority code picks up the zone serial. o Fix that upstream TLS connections are not reused as TLS connections for a different name, at the same IP. This checks that the tls name is correct when reusing the upstream connections. o Fix that signatures are not allowed with revoked dnskeys. o Fix that a DNAME with an unsigned CNAME is checked for the correct match. This stops that for certain zone configurations an unchecked unsigned CNAME could get secure status. o Fix handling of wildcard CNAMEs in the chain of trust. An improper wildcard in the chain of trust would send the retries to the wrong upstream. Also it could label the step in the chain of trust as secure, when it was not. o Introduce new 'tls-protocols' configuration option that specifies which of the supported TLS protocols will be used. o Fix RFC7766 compliance when client sends EOF over TCP. It stops pending replies and closes. o Fix to shorten RRSIG count in scrubber, this protects against an overly large number of RRSIGs. It can be configured with `iter-scrub-rrsig: 8`, it has default 8. o Fix for EDNS client subnet so that it does not store SERVFAIL in the global cache after a failed lookup, such as timeouts. A failure entry is stored in the subnet cache, for the query name, for a couple of seconds. Queries can continue to use the subnet cache during that time. o Fix to allow the control-interface config to use ip@port notation. o Fix to check for invalid http content length and chunk size, and to check the RR rdata field lengths when decompressing and inserting RRs from an authority zone transfer. This stops large memory use and heap buffer-overflow read errors. o Fix to ignore out-of-zone DNAME records for CNAME synthesis. Fix so that a reload checks if the files have changed, and if so, reload the contexts. Also for DoH, DoQ and outgoing DoT. o Apply cache TTL policy to DNAME and synthesized CNAME on wire path. o Fix for DNS Rebinding Bypass via SVCB/HTTPS Records in Unbound. o Allow synthesized DNAME TTL=0 to be served from cache within grace period. The responses are served from cache within a 1-second grace period. Reduces recursion when authoritative servers return DNAME with TTL=0 (RFC 2308). Response still returns TTL=0 to clients. o On Linux systems log the system-wide unique thread ID instead of Unbound's internal thread counter. o Introduce the 'log-thread-id' configuration option to manage logging the system-wide Linux thread ID for easier debugging with system tools. o Mesh reply counters. This adds statistics num.queries.replyaddr_limit and requestlist.current.replies. o Add extra statistic to track the number of signature validation operations. Adds 'num.valops' to extended statistics. o Fix for cname chain length with qtype ANY and qname minimisation. o Change default for so-sndbuf to 4m, to mitigate a cross-layer issue where the UDP socket send buffers are exhausted waiting for ARP/NDP resolution. o Increase default to `num-queries-per-thread: 2048`, when unbound is compiled with libevent. It makes saturation of the task queue more resource intensive and less practical. o DNS Error Reporting (RFC 9567). Introduces new configuration option 'dns-error-reporting' and new statistics for 'num.dns_error_reports'. o Redis read-only replica support. Introduces new 'redis-replica-*' options for the Redis cache backend. o Exempt loopback addresses from wait-limit. o Fix wait-limit-netblock and wait-limit-cookie-netblock config parse to allow two arguments. o Fast Reload. The unbound-control fast_reload is added. It reads changed config in a thread, then only briefly pauses the service threads, that keep running. DNS service is only interrupted briefly. o Make the default value of module-config "validator iterator" regardless of compilation options. --enable-subnet would implicitly change the value to enable the subnetcache module by default in the past. o Add unbound members group access to control key. o Add resolver.arpa and service.arpa to the default locally served zones. o Use TCP_NODELAY on TLS sockets to speed up the TLS handshake. o Serve expired cache update fixes. Fixes a regression bug with serve-expired that appeared in 1.22.0 and would not allow the iterator to update the cache with not-yet-validated entries resulting in increased outgoing traffic. Closes: #1142539 o The default value of serve-expired-ttl is set to 86400 (1 day) as suggested by RFC8767. o Increase the default of max-global-quota to 200 from 128 after operational feedback. Still keeping the possible amplification factor (CAMP related issues) in the hundreds. o Fix for the serve expired DNSSEC information fix, it would not allow current delegation information be updated in cache. The fix allows current delegation and validation recursion information to be updated, but as a consequence no longer has certain expired information around for later dnssec valid expired responses. o Statistics for discard-timeout and wait-limit. . * Other packaging changes: - d/rules,d/libunbound-dev.install: drop static library and deps (Closes: #1096189) - unbound-helper: do not update resolvconf if it is systemd-resolved - d/unbound.service: set empty DAEMON_OPTS= to avoid warning from systemd - d/upstream/signing-key.asc: update with the new upstream key - d/unbound.conf.d/remote-control.conf: fix typo Checksums-Sha1: 8b66a3ac47ee30ebe10f5c55b5dc16d848ba886f 213576 libunbound-dev_1.26.1-0+deb13u1_s390x.deb c870169e5e6dd06a9c73f71f5e886e62960f38af 1391596 libunbound8-dbgsym_1.26.1-0+deb13u1_s390x.deb 2516d0a4c85cf78f4f7632b63908513883c2df96 617392 libunbound8_1.26.1-0+deb13u1_s390x.deb f46b432cdd0c198bf17cff6450409db4512fb1e3 163052 python3-unbound-dbgsym_1.26.1-0+deb13u1_s390x.deb c89526a985c044907de2cf68a013fa82f43b3134 244136 python3-unbound_1.26.1-0+deb13u1_s390x.deb 53701401c0fec34fb8a77e278cff305a79e30371 59644 unbound-anchor-dbgsym_1.26.1-0+deb13u1_s390x.deb 7cc26d4cfd476d4d45b39488b745f37bf50c297d 221840 unbound-anchor_1.26.1-0+deb13u1_s390x.deb c13d4a89fb0d3f3dcbb8321d34a31bbdff0a4e39 5086748 unbound-dbgsym_1.26.1-0+deb13u1_s390x.deb f9b89bf0ff598ddc42800fd89cfccbb0168e0dfd 135040 unbound-host-dbgsym_1.26.1-0+deb13u1_s390x.deb 2ece571bdfc0e932b0a75ba1cdab4c002fea04f3 242992 unbound-host_1.26.1-0+deb13u1_s390x.deb e3c97b6c9bb04837876d9d66144a376307e40292 10462 unbound_1.26.1-0+deb13u1_s390x-buildd.buildinfo 1b096e1a853357ac2de7d0b14df919fbdb80bbca 1060724 unbound_1.26.1-0+deb13u1_s390x.deb Checksums-Sha256: 1bea2e26993c536c0cc818f916d8ac8341fcb19f356e2d3e837d7405e56f5bae 213576 libunbound-dev_1.26.1-0+deb13u1_s390x.deb 0e3db6b6cbb11d444a403e27dc3d07a5ef5d1889f47dba34c1ff3bfdf4893e84 1391596 libunbound8-dbgsym_1.26.1-0+deb13u1_s390x.deb ec3953d9683cbaad3fd7e4fbcae5bcb0dde68bc62718c32c411ab1a827b7a45d 617392 libunbound8_1.26.1-0+deb13u1_s390x.deb 97ba3f94313ebaaa65c85475ba40f2d2716edc1aff52cf0707c799ebb868149a 163052 python3-unbound-dbgsym_1.26.1-0+deb13u1_s390x.deb 0c5b7c4a4dc4dd7c23b3c90f407f39cb0623ae0e5e59b1c4c4b8c80f0ed3b77b 244136 python3-unbound_1.26.1-0+deb13u1_s390x.deb 43f31dd2c292676fccb8a878d82e2b3ab7d2b98d63adec1591c8fc8ebce174ec 59644 unbound-anchor-dbgsym_1.26.1-0+deb13u1_s390x.deb 216e5fef5671392fb641cf45bf5d9b1fd5420abc1d82257c1287a10645d5fcf4 221840 unbound-anchor_1.26.1-0+deb13u1_s390x.deb 0f78e1ba910b8462a079cb58a7d39869671127a1c6fa07ee94888f5930acd115 5086748 unbound-dbgsym_1.26.1-0+deb13u1_s390x.deb 6a028b1c11b81bdea2de12a03b1f0305d06961756be354e308f92269988ef0dd 135040 unbound-host-dbgsym_1.26.1-0+deb13u1_s390x.deb 85cee47af1efdead2eeb7e257ae25e81aedb6e94118f280d3a6d26ac119131a3 242992 unbound-host_1.26.1-0+deb13u1_s390x.deb 34a312db4456086c850d5aed9011cdf65aa0d9f4a88e461b571ada86614ee03f 10462 unbound_1.26.1-0+deb13u1_s390x-buildd.buildinfo d8c3a24850797a3a1900ee08aa42a601bcb9f94552d40c8ef0a6e0c4672d5d9a 1060724 unbound_1.26.1-0+deb13u1_s390x.deb Files: 5f0b101d30de7361129b5ac6ba057ebb 213576 libdevel optional libunbound-dev_1.26.1-0+deb13u1_s390x.deb cdb3f75ac3cc32a7c0e663c58198bdb5 1391596 debug optional libunbound8-dbgsym_1.26.1-0+deb13u1_s390x.deb d3f69f7920fb276444b38f2c5b3c5489 617392 libs optional libunbound8_1.26.1-0+deb13u1_s390x.deb dd88e58a1612bb9e443ef3fd3c292e59 163052 debug optional python3-unbound-dbgsym_1.26.1-0+deb13u1_s390x.deb e7a72746f92d5285266cc11d99eb0ccd 244136 python optional python3-unbound_1.26.1-0+deb13u1_s390x.deb 4221a25ff0c5f0ccb080e1a444464b95 59644 debug optional unbound-anchor-dbgsym_1.26.1-0+deb13u1_s390x.deb 61a6927ed8202ddd1fe32ce3bc1587a3 221840 net optional unbound-anchor_1.26.1-0+deb13u1_s390x.deb 5c58f5b25f915a1d940915dcd4576bd5 5086748 debug optional unbound-dbgsym_1.26.1-0+deb13u1_s390x.deb 8ca8049712e6ab13a0b9d8abe28b67cd 135040 debug optional unbound-host-dbgsym_1.26.1-0+deb13u1_s390x.deb 0b7cb770138287b00926ebcd63a587ec 242992 net optional unbound-host_1.26.1-0+deb13u1_s390x.deb 5954d9f245b66b619c102ad2fd99744c 10462 net optional unbound_1.26.1-0+deb13u1_s390x-buildd.buildinfo 4d26b98c07af9a6bacd752fd55a6eeea 1060724 net optional unbound_1.26.1-0+deb13u1_s390x.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEENly2ANlpa4eeqnluvVOPI7pYNpgFAmqtwXMACgkQvVOPI7pY NpgxQxAAk2TRaRTL+rA2maW40UPB+1/WXXrqJ3K3yc/4+KIBI8LhrK/C10K214yd pfVj3AGxQZAuSMi9JT0fRF6c6MOvSnfneUlDF3c82+gqV1WFkAXDFS4ZH/bPPeHg Pf81E7rYdsbeQP4OtBsFn1nc6uBVjrkR+a4dE25y7yVOvzKxxhs8FC5Nz08pxmJv /i0LgC6Fpk/GcgdtSUcFJx2j2ICkcFJwyUuxXw9k/4a7di1oMoXIKXNy8HxlsY8d bX16TIC7hJgsL/CaoyKCtHqV2r24xzGIIaECyPEm56DtQqlLinvP30yJjxGdlPQj ESxyyqGP0fWpz5LQb1mrkz4lUuunZoz6NgJUT8OgqkWI7UcmroBmV5DvUR+8rk2t 2xinxJQKeoUwk2U252oXPeyjPJOGRe9kJFCNL6tidvV9DJrhE4inpG0lciLwFffz uJQJFRgjydLCwO+5S9AJWrn9+EMDxMXQ+vB+h+oo4cJKBe+qtfuxuTmc9+0zPFxN ofSB4Au0XQudzLmm0ZsOn5zOb6Um/lMYxxEoPZMgRevJI12h831aqDGoXqZxelXZ oZrtYrt/u6QNc2xd8WTPsVFuBvr8NztwAttHAOthdJK5JBu08W9O6Z9Od9zxfZ0+ cmqaZUlDj0NwjI6vsqGpl/XbGp1KBhdW7abLdSHBl5InxKofJe4= =/seX -----END PGP SIGNATURE-----