Unbound 1.26.2
This release has a number of security fixes.
The release is signed with the OpenPGP software signing key that is
in use since Jan 1st 2026:
User ID: NLnet Labs releases signing key G2 <releases@nlnetlabs.nl>
Key ID: A144 323D EAAC DF45
Fingerprint: 2310 1869 0C4D 903E F419 146A A144 323D EAAC DF45
The key is available from https://nlnetlabs.nl/signing-keys .
This release consolidates security fixes for issues reported over
a period of time. There are fixes for CVE-2026-35501, CVE-2026-50106,
CVE-2026-96405, CVE-2026-97206 and CVE-2026-109125.
Bug Fixes
- Fix CVE-2026-97206, DoQ path-migration can lead to use-after-free on
multi-threaded deployments. Thanks to Kunta Chu and Jianjun Chen
from Tsinghua University for the report. - Fix CVE-2026-50106, Possible insecure NXDOMAIN for non-existing
records under a configured island trust anchor underneath an
insecure parent. Thanks to Qifan Zhang from Palo Alto Networks
for the report. - Fix CVE-2026-96405, Aggregate DNS name chained pointer decompression
work leads to degradation of service. Thanks to Yuheng Zhang
(Tsinghua University and Jingxian Technology Co., Ltd.), Jianjun
Chen (Tsinghua University), Zihan Wang (Z.AI Co., Ltd.) and Kaiwen
Shen (CloudItera) for the report. - Fix CVE-2026-109125, Possible cache poisoning vulnerability via
a cache side-channel exposed by 'unwanted-reply-threshold'. Thanks
to TaoFei Guo (Peking University), and Yang Luo and JianJun Chen
(Tsinghua University) for the report. - Fix CVE-2026-35501, Bypass of a configured island trust anchor
underneath an insecure parent from an attacker-controlled NSEC
record. Thanks to Qifan Zhang from Palo Alto Networks for the
report.