{"id":"MGASA-2026-0571","summary":"Updated unbound package fixes security vulnerabilities","details":"Bypass of a configured island trust anchor underneath an insecure parent\nfrom an attacker-controlled NSEC record.\nPossible insecure NXDOMAIN for non-existing records under a configured\nisland trust anchor underneath an insecure parent.\nAggregate DNS name chained pointer decompression work leads to\ndegradation of service.\nDNS-over-QUIC path-migration can lead to use-after-free on\nmulti-threaded deployments.\nPossible cache poisoning vulnerability via a cache side-channel exposed\nby 'unwanted-reply-threshold'.\n","modified":"2026-11-02T16:27:56.070550968Z","published":"2026-11-02T16:03:56Z","upstream":["CVE-2026-109125","CVE-2026-35501","CVE-2026-50106","CVE-2026-96405","CVE-2026-97206"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2026-0571.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=36568"},{"type":"ADVISORY","url":"https://nlnetlabs.nl/projects/unbound/security-advisories/"}],"affected":[{"package":{"name":"unbound","ecosystem":"Mageia:10","purl":"pkg:rpm/mageia/unbound?arch=source&distro=mageia-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-1.mga10"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2026-0571.json"}}],"schema_version":"1.9.2","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}