{"id":"CLSA-2026-1785888218","summary":"unbound: Fix of 11 CVEs","details":"- CVE-2026-46582: mark a wildcard-expanded rrset bogus in the cache when the\n  wildcard proof fails, so a replayed wildcard rrset is not served as secure\n- CVE-2026-40691: bound the DNSCrypt reply length against the destination\n  buffer capacity on the TCP path\n- CVE-2026-42955: clamp the TTL of parent-side A/AAAA glue records to prevent\n  a one-time ghost domain delegation renewal\n- CVE-2026-44621: avoid abrupt termination of libunbound applications\n  configured with unwanted-reply-threshold\n- CVE-2026-44687: correct an off-by-one in harden-below-nxdomain that let a\n  parent NXDOMAIN shadow a stub or forward zone\n- CVE-2026-50046: fix a use-after-free on the error path when a DoT forwarded\n  query is jostled out\n- CVE-2026-50248: reject a DNSSEC bogus configured primary hostname as an XFR\n  endpoint for auth and rpz zones\n- CVE-2026-50251: do not let attacker supplied 0.0.0.0 or :: glue trigger a\n  defensive full cache flush\n- CVE-2026-55708: create view-specific local zone defaults when adding local\n  data to a view that has none\n- CVE-2026-55717: clear the partial reply after a successful response-ip CNAME\n  merge to prevent a crash with serve-expired\n- CVE-2026-55990: fail fast when dnscrypt-provider-cert files have no matching\n  dnscrypt-secret-key","modified":"2026-10-26T09:43:41.880263564Z","published":"2026-08-05T00:03:56Z","upstream":["CVE-2026-40691","CVE-2026-42955","CVE-2026-44621","CVE-2026-44687","CVE-2026-46582","CVE-2026-50046","CVE-2026-50248","CVE-2026-50251","CVE-2026-55708","CVE-2026-55717","CVE-2026-55990"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1785888218.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40691"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42955"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44621"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44687"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46582"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50046"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50248"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50251"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55708"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55717"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55990"}],"affected":[{"package":{"name":"python3-unbound","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/python3-unbound?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-19.el9_6.1.tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1785888218.json"}},{"package":{"name":"unbound","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/unbound?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-19.el9_6.1.tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1785888218.json"}},{"package":{"name":"unbound-devel","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/unbound-devel?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-19.el9_6.1.tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1785888218.json"}},{"package":{"name":"unbound-dracut","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/unbound-dracut?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-19.el9_6.1.tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1785888218.json"}},{"package":{"name":"unbound-libs","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/unbound-libs?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-19.el9_6.1.tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1785888218.json"}}],"schema_version":"1.9.0"}