{"id":"SUSE-SU-2026:24128-1","summary":"Security update for unbound","details":"This update for unbound fixes the following issues:\n\n- CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' (bsc#1280403).\n- CVE-2026-77955: Possible ZONEMD verification bypass window (bsc#1280404).\n- CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission (bsc#1280405).\n- CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection (bsc#1280406).\n- CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization (bsc#1280409).\n- CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (bsc#1280411).\n- CVE-2026-82717: CNAME synthesis could lead to heap corruption (bsc#1280412).\n- CVE-2026-82720: Use-after-free in DoH stream cleanup code path (bsc#1280413).\n- CVE-2026-85501: Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC (bsc#1280414).\n\nChanges for unbound:\n\n- Update to 1.26.1:\n * Update icannbundle.pem certificates in unbound-anchor, valid\n for 2009-2029 and 2025-2045\n * Add max-transfer-size and max-transfer-time options to limit\n auth-zone and rpz transfer size and time, default disabled\n * Overload local_data_remove in unbound-control to also remove\n specific records\n * Add local-zone types block_aaaa, block_a_wdata and\n block_aaaa_wdata; fix respip+dns64 to use original A records\n instead of ones already modified by respip\n * ipsecmod hook script now needs to start with '#!/bin/sh', it\n is executed with execv instead of system for security\n * Server now continues to start if a secondary zone fails to\n load from its zonefile, or if a primary zonefile is missing;\n $INCLUDE is no longer allowed in secondary zone zonefiles\n * Auth-zone and RPZ zones now drop out-of-zone content on load\n * Primary hostname for zone transfers can now use CNAME(s)\n * Fix windows 64bit build for libssp dependency\n * Update IANA portlist\n * Fix heap out-of-bounds write via size_t-to-int truncation in\n setup_if()/outside_network_create() for large num_ports values\n * Fix to clean up log ids after a failure to start a worker\n thread\n * Relax assertions after the TTL 0 handling change in cachedb\n and packet_rrset_copy_region\n * Fix val_find_DS to check the result of packet_rrset_copy_region\n before using it\n * Fix that dns64 answers check the AAAA query is DNSSEC\n validated, improving RFC6147 conformance\n * Fix allocation-failure hardening of rrset cache wildcard\n storage and canonical NSEC owner replacement\n * Fix DNSSEC validation and DNSKEY size calculation for\n noncanonical RSA DNSKEYs with leading zeroes\n * Fix mixed class referrals to use the query class\n * Fix serve-expired responses from cachedb to not store bogus\n data\n * Fix lame server detection for selfpointed glue records\n * Fix cleanup of DoH sessions when the same query is on multiple\n streams\n * Fix for signed same-owner CNAME and ordinary RRset responses\n * Fix mesh new client/callback to roll back added address, tcp\n mesh state and callback on initialization failure\n * Fix autotrust state-file line overflow that could give a\n hold-down bypass\n * Fix to limit the DSNS per-label walk in the iterator\n * Fix that the ratelimit is decremented on successful referrals\n * Fix msgencode insert_query assertion for a local_alias\n * Fix to reset the tcp-timeout before applying a load based\n reduction\n * Fix to correctly decrement per-netblock tcp connection limits\n * Fix, in depth, for respip rewrite of dns64 responses\n * Fix that dns64 with subnetcache does not write ECS scoped\n answers to the global cache\n * Fix ipset module name-too-long checks and race conditions on\n the local name buffer and socket close\n * Fix validator to cap the number of ANY RRsets it validates and\n shorten the wait timer\n * Fix race condition causing segfault when starting threads\n * Fix header_seen detection for trust anchor files to detect the\n id line\n * Fix heap use-after-free in class response processing when at\n least two distinct classes are configured\n * Fix negative cache to work with NSEC3 records without salt\n * Fix parse of svcbparam ech, it had an incorrect length\n * Fix that quotation and escaping works the same in auth-zone\n url content as in zonefile reads\n * Fix ipset module to use larger domain name buffers and check\n buffer lengths\n * Fix PROXYv2 header read and consume to check the header size\n * Fix negative cache NSEC3 nodata proof to use the correct\n message size\n * Fix fast_reload for when a ZONEMD lookup is in progress\n * Fix that validation canonicalization of domain names in rdata\n checks buffer bounds\n * Fix dump_cache to use a larger record buffer and check that an\n owner name does not collide with BADRR\n * Fix that dns64 cleans up the allocated message if the adjust\n routines fail, and checks for malformed A/AAAA in auth-zones\n * Fix pythonmod script read for numeric overflow\n * Fix configure to detect the correct QUIC early-data function\n and to check for the ngtcp2_crypto_ossl header\n * Fix compile with OpenSSL 4.0.1, and with OpenSSL 1.0.2 and\n earlier in server cleanup\n * Fix that auth-zone/rpz allow-notify addresses and netblocks\n are available from start, and fix the probe step skip\n * Fix to perform a full transfer periodically to stop increasing\n memory usage for rpz zones\n * Fix assertion failure for a long HTTP header that fills the\n buffer, and buffer overflow with lower than default size and\n http transfer\n * Fix that misconfigured iter-scrub-ns: 0 causes request failures\n * Fix fast_reload handling of in-progress ZONEMD lookups and of\n removing an auth zone while its lookups are in progress\n * Fix integer overflow in infra-cache-max-rtt calculation and for\n very high values of sock-queue-timeout\n * Fix erroneous DNS error report values after a bogus AAAA query\n * Fix fast_reload to not terminate the server on config errors\n for key files\n * Fix log of an aliased qname to not use freed region memory\n * Fix DNAME synthesis from cache to keep using 0TTL entries\n within a sliding window without surpassing RRSIG expiry\n * Fix that dns64 bypasses the rpz-passthru rule during synthesis\n * Fix to disallow $INCLUDE for secondary zones; failed loads now\n clear the zone data so there is no partial zone\n * Fix zone read to allow SVCB records in unknown format that\n cannot be written out\n * Fix that a half-written trust anchor file does not crash the\n server at runtime\n * Fix that auth-zone and RPZ zones drop out-of-zone records\n * Fix that dns64 honors the forward-no-cache and stub-no-cache\n options\n * Fix that a signed wildcard NSEC is checked before use, so it\n does not allow insecure DS proofs inappropriately\n * Fix several crashes after malloc failure: half-built\n local_alias, RPZ list, delegation point cleanup,\n dns64_inform_super, new_local_rrset for RPZ qname trigger, doq\n connection setup, ngtcp2_conn_server_new, TCP accept handling,\n rpz_strip_nsdname, edns subnet addrtree insert, and rpz\n response create\n * Fix that a zonefile-only zone continues server startup with a\n warning if the file is missing on start\n * Fix that dnscrypt configuration does not crash on a\n secret/public key mismatch, and duplicate files are skipped\n * Fix locking in libunbound ub_ctx_set_event\n * Fix that libunbound pipe functions fail with an error after an\n event base is set\n * Fix incorrect cleanup after an allocation failure for a\n delegation point\n * Fix that the server does not crash if shared memory cannot be\n created for shm-enable\n * Fix auth primary host name lookup to allow CNAMEs\n * Fix memory leak on DNAME 0TTL records\n * Fix that fast_reload disown of the auth zone transfer task\n cleans up the chunk list\n * Fix unbound-checkconf to check for auth-zone download filename\n collisions\n * Fix malloc failure in auth-zone insert rr to avoid an empty\n node and infinite loop\n * Fix that unbound-control auth_zone_reload stops answering from\n the zone after a read failure\n * Fix stats pipe draining after a malloc failure so internal\n messaging stays correct, and the server no longer exits on\n stats pipe communication failure\n * Fix that fast_reload does not terminate the server if random\n init for DNS cookies fails\n * Fix thread setname for dnstap and fast_reload thread start\n * Add libunbound/remote.h, a shared header with prototypes for\n remote control connections\n * Fix DEREF_AFTER_NULL on worker_init when stat_timer allocation\n fails with an out of memory error\n * Fix DoH POST requests missing content-length causing :status\n 400 from strict resolvers like Cloudflare and Mullvad\n * Fix randomness generation on macOS/iOS under chroot\n * Fix ipsecmod deref on null in ipsecmod-whitelist after OOM, and\n possible deref on null after reply_find_answer_rrset()\n * Fix that DoQ responses were never padded; pad-responses now\n applies to comm_doq per RFC 9250 section 5.4\n * Fix log printout error in the fix for CVE-2026-50248 when the\n primary name is bogus\n * Fix NSEC3 proofs to check the b32 name matches the signer name;\n RRSIGs are no longer valid when this does not match\n * Fix aggressive negative cache to not insert NSEC records with\n an overreaching next owner name outside the trust anchor's\n bailiwick\n * Fix mesh cycle detection for respip CNAME loop with tagged\n clients\n * Fix unbound-anchor to check the return value of\n X509_NAME_get_text_by_NID for the emailaddress\n * Fix locking of the shared_ports structure during\n initialisation, and of the anchor structure when a file is set\n during header parsing\n * Fix memory leak in xfer_set_masters() error path in authzone\n * Fix to use tls-port after a referral when tls-upstream is set\n * Fix pthread detection on Solaris 11.4\n * Fix to call OPENSSL_cleanup on exit when it is defined\n * pythonmod: check the return value after ftell()\n","modified":"2026-10-13T17:23:10.199361050Z","published":"2026-10-09T15:11:19Z","related":["CVE-2026-77860","CVE-2026-77955","CVE-2026-78227","CVE-2026-80225","CVE-2026-81634","CVE-2026-81642","CVE-2026-82717","CVE-2026-82720","CVE-2026-85501"],"upstream":["CVE-2026-77860","CVE-2026-77955","CVE-2026-78227","CVE-2026-80225","CVE-2026-81634","CVE-2026-81642","CVE-2026-82717","CVE-2026-82720","CVE-2026-85501"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624128-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1280403"},{"type":"REPORT","url":"https://bugzilla.suse.com/1280404"},{"type":"REPORT","url":"https://bugzilla.suse.com/1280405"},{"type":"REPORT","url":"https://bugzilla.suse.com/1280406"},{"type":"REPORT","url":"https://bugzilla.suse.com/1280409"},{"type":"REPORT","url":"https://bugzilla.suse.com/1280411"},{"type":"REPORT","url":"https://bugzilla.suse.com/1280412"},{"type":"REPORT","url":"https://bugzilla.suse.com/1280413"},{"type":"REPORT","url":"https://bugzilla.suse.com/1280414"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-77860"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-77955"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-78227"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-80225"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-81634"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-81642"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-82717"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-82720"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-85501"}],"affected":[{"package":{"name":"unbound","ecosystem":"SUSE:Linux Micro 6.2","purl":"pkg:rpm/suse/unbound&distro=SUSE%20Linux%20Micro%206.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"unbound-anchor":"1.26.1-160000.1.1","libunbound8":"1.26.1-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:24128-1.json"}}],"schema_version":"1.9.0"}