{"id":"USN-8946-2","summary":"unbound vulnerabilities","details":"USN-8946-1 fixed vulnerabilities in Unbound in Ubuntu 26.04 LTS, Ubuntu\n24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 LTS, Ubuntu\n16.04 LTS, and Ubuntu 14.04 LTS. This update provides the corresponding\nupdate for Ubuntu 26.10.\n\nOriginal advisory details:\n\n It was discovered that Unbound incorrectly handled certain TCP\nconnections.  A remote attacker could possibly use this issue to cause\nUnbound to consume  resources, leading to a denial of service. This issue\nonly affected Ubuntu  26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS and\nUbuntu 20.04 LTS.  (CVE-2026-80225)\n\n It was discovered that Unbound incorrectly handled certain DNS responses.\nA  remote attacker could possibly use this issue to crash Unbound,\nresulting  in a denial of service. (CVE-2026-81634)\n\n It was discovered that Unbound incorrectly handled certain DNS responses\nduring DNSSEC validation. A remote attacker could possibly use this issue\nto cause Unbound to consume resources, leading to a denial of service.\n(CVE-2026-85501)\n\n It was discovered that Unbound incorrectly handled outgoing network ports.\nA remote attacker could possibly use this issue to crash Unbound, resulting\nin a denial of service. (CVE-2026-50252)\n\n It was discovered that Unbound incorrectly handled certain DNSCrypt\npackets. A remote attacker could possibly use this issue to crash Unbound,\nresulting in a denial of service. This issue only affected Ubuntu 26.04\nLTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS and Ubuntu 18.04\nLTS. (CVE-2026-40691)\n\n It was discovered that Unbound incorrectly handled certain cached DNS\nresponses. A remote attacker could possibly use this issue to poison\nUnbound's cache. This issue only affected Ubuntu 26.04 LTS, Ubuntu 24.04\nLTS, Ubuntu 22.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-44690)\n\n It was discovered that Unbound incorrectly handled certain DNS-over-QUIC\nconnections. A remote attacker could possibly use this issue to cause\nUnbound to consume resources, leading to a denial of service. This issue\nonly affected Ubuntu 26.04 LTS. (CVE-2026-32665)\n\n It was discovered that Unbound incorrectly handled certain EDNS options. A\nremote attacker could possibly use this issue to crash Unbound, resulting\nin a denial of service. This issue only affected Ubuntu 26.04 LTS.\n(CVE-2026-55973)","modified":"2026-11-11T09:44:13.193075600Z","published":"2026-11-10T16:28:27Z","related":["UBUNTU-CVE-2026-32665","UBUNTU-CVE-2026-40691","UBUNTU-CVE-2026-44690","UBUNTU-CVE-2026-50252","UBUNTU-CVE-2026-55973","UBUNTU-CVE-2026-80225","UBUNTU-CVE-2026-81634","UBUNTU-CVE-2026-85501"],"upstream":["CVE-2026-32665","CVE-2026-40691","CVE-2026-44690","CVE-2026-50252","CVE-2026-55973","CVE-2026-80225","CVE-2026-81634","CVE-2026-85501","UBUNTU-CVE-2026-32665","UBUNTU-CVE-2026-40691","UBUNTU-CVE-2026-44690","UBUNTU-CVE-2026-50252","UBUNTU-CVE-2026-55973","UBUNTU-CVE-2026-80225","UBUNTU-CVE-2026-81634","UBUNTU-CVE-2026-85501"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-8946-2"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-32665"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-40691"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-44690"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-50252"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-55973"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-80225"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-81634"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-85501"}],"affected":[{"package":{"name":"unbound","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/unbound?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.1-1ubuntu3.1"}]}],"versions":["1.24.2-1ubuntu2","1.25.1-1ubuntu1","1.25.1-1ubuntu3"],"ecosystem_specific":{"binaries":[{"binary_name":"libunbound8","binary_version":"1.25.1-1ubuntu3.1"},{"binary_name":"python3-unbound","binary_version":"1.25.1-1ubuntu3.1"},{"binary_name":"unbound","binary_version":"1.25.1-1ubuntu3.1"},{"binary_name":"unbound-anchor","binary_version":"1.25.1-1ubuntu3.1"},{"binary_name":"unbound-host","binary_version":"1.25.1-1ubuntu3.1"}],"availability":"No subscription required"},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:26.10","cves":[{"id":"CVE-2026-32665","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}]},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-40691"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2026-44690"},{"id":"CVE-2026-50252","severity":[{"score":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:H/E:P/U:Amber","type":"CVSS_V4"},{"score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-55973","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}]},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","type":"CVSS_V3"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2026-80225"},{"id":"CVE-2026-81634","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-85501","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}]}]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8946-2.json"}}],"schema_version":"1.9.2"}