< back to search

gpp_maybe Security update for unbound
SUSE-SL-Micro-6.2-1446

This update for unbound fixes the following issues: Update to version 1.25.2. Security issues fixed: - CVE-2026-14586: DoS via assertion in `libngtcp2` for DNS-over-QUIC environments with high concurrency (bsc#1271879). - CVE-2026-32665: Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass (bsc#1271873). - CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875). - CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries (bsc#1271891). - CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records (bsc#1271892). - CVE-2026-44621: Libunbound applications configured with `unwanted-reply-threshold` could eventually be abruptly terminated (bsc#1271876). - CVE-2026-44687: Off-by-one error in `harden-below-nxdomain` logic can shadow a stub/forward zone by a legitimate parent's `NXDOMAIN` (bsc#1271893). - CVE-2026-44690: Cross-zone wildcard cache poisoning via `RRSIG.labels` manipulation (bsc#1271877). - CVE-2026-46582: Replay of a wildcard `rrset` as another piece of data triggers poisoning in the server expired reply path (bsc#1271894). - CVE-2026-50045: `max-global-quota` bypass via single client queries for a deeply nested name under a DNSSEC-signed parent (bsc#1271878). - CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882). - CVE-2026-50243: `response-ip`/`rpz` can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880). - CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881). - CVE-2026-50251: Attacker supplied `0.0.0.0`/`::` glue triggers defensive full-cache flush (bsc#1271883). - CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884). - CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with `answer-cookie:yes` is used (bsc#1271895). - CVE-2026-55708: Privacy/configuration issue when adding local data in views through `unbound-control` (bsc#1271896). - CVE-2026-55717: `serve-expired-client-timeout` and `response-ip` CNAME redirect could lead to a crash (bsc#1271886). - CVE-2026-55973: DoS due to stack overflow triggered crash when `dns-error-reporting: yes` is set (bsc#1271874). - CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887). - CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in `libngtcp2` (bsc#1271888). - CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name (bsc#1271889). - CVE-2026-56444: Degradation of resolution service when `discard-timeout` and `serve-expired-client-timeout` are combined in unusual configuration (bsc#1271890). Other updates and bugfixes: - Version 1.25.2: + Features: * TTL behavior changes: cached records reaching TTL 0 are expired; TTL 0 upstream answers are no longer cached by cachedb; serve-expired-reply-ttl is now capped by the original TTL value; TTL decoding updated to adhere to RFC 8767 section 4 * Add new statistics: num.queries.replyaddr_limit and requestlist.current.replies * Add 'log-thread-id' configuration option to log the system-wide Linux thread ID for easier debugging * Add ECC-GOST12 support per RFC 9558 (available as contrib/gost12.patch) * Allow synthesized DNAME TTL=0 to be served from cache within a 1-second grace period, reducing recursion for TTL=0 DNAMEs (RFC 2308) * Fix DoT/DoH/DoQ to reload certificates on config reload without requiring a full restart; fast_reload now supports changes to tls-service-key, tls-service-pem and tls-cert-bundle * Allow ip@port notation in control-interface configuration * Add iter-scrub-rrsig option (default: 8) to limit the number of RRSIGs processed by the scrubber * Add 'tls-protocols' configuration option to select which TLS protocol versions are used; TLSv1.2 is re-enabled by default * Add pthread_setname_np support for named threads + Bug Fixes: * Fix handle leak in pythonmod on pythonmod_init * Fix crash when mesh_detect_cycle_found() is called with no mesh state * Fix modstack_call_init to use the original string when it has changed * Fix fr_atomic_copy_cfg * Fix auth-zone empty label for $ORIGIN when downloading via HTTP * Fix respip and dns64 to be usable simultaneously; RPZ now works with DNS64 * Fix HTTPS and QUIC not being enabled when port is listed in interface-automatic-ports * Allow wait-limit-cookie: 0 to disable cookie-validated wait limits * Fix FIPS mode in OpenSSL causing unit test failure * Fix discard-timeout to only drop UDP, not stream connections * Reply with SERVFAIL when the wait-limit is exceeded * Add extended DNS error code for invalid query type * Replace deprecated SWIG $function with $action * Log a warning for possible circular dependency when using hostnames in stub/forward zones * Fix infra cache for NAT64 by moving NAT64 synthesis to the delegation point when adding target addresses * Fix discard-timeout packet accounting in the mesh area * Update IANA portlist * Copy DNSTAP configuration from daemon to workers after fast_reload * Fix HTTP/2 stream mesh state removal and drop handling for postpone_drop and send failures * Log THROWAWAY and (DNSSEC) LAME responses with clearer categorization in log output * Fix EDE removal logic consistency between encoding errors and encoding replies * Fix EDNS subnet scope-zero queries not being stored when forward-no-cache or stub-no-cache is set * Do not initialize quic_table unless QUIC is enabled * Fix fast_reload to copy iter_scrub_ns, iter_scrub_cname and max_global_quota options * Fix allow-notify entries with hostnames to be copied after IPv4/IPv6 lookup; fix skipping hostname lookups when only URLs are configured * Fix NAT64 inconsistency with do-not-query-address during retries * Fix cachedb aggressive negative responses not setting the RA flag * Fix root key priming failure after loading RPZ zones containing ZONEMD RRtype * Fix local-zone always_refuse to also block DS queries * Fix cache lookup/store in external cachedb when forwarder/stub uses the no-cache option * Fix cachedb returning expired bogus data as non-bogus * Fix validator unchecked state handling with validation recursion and EDNS subnet * Fix DNAME lookup flag and assertion in expired calculation debug routine * Fix DNS rebinding bypass via SVCB/HTTPS records; private-address now also elides SVCB and HTTPS records matching the filter * Warn for unused 'nodefault' local-zone configuration in unbound-checkconf * Fix lock/unlock for view in memory error handling * Apply cache TTL policy to DNAME and synthesized CNAME on the wire path * Fix detection of HTTP listening port in fast_reload * Fix ignoring out-of-zone DNAME records for CNAME synthesis * Fix invalid HTTP content length/chunk size checks and RR rdata field length validation in zone transfer, preventing heap buffer-overflow read errors * Fix defense in depth for service callback with empty packet * Fix shared memory statistics with threads * Fix EDNS client subnet to not store SERVFAIL in the global cache after a failed lookup; stores a short-lived failure entry in the subnet cache instead * Fix memory corruption related core dumps when alloc_reg_obtain encounters an empty list * Fix RFC 7766 compliance when client sends EOF over TCP * Fix DoH session cleanup when the same query appears on multiple streams * Fix TLS context setup for tls-service-pem * Fix TTL comparisons in rdata_copy for 32-bit signed/unsigned values * Fix memory leak in subnet SERVFAIL store * Fix for the Jiggle Attack: server now answers errors for error cases and no longer reflects parts of the incoming query * Fix EDNS extended RCODE reflection: server no longer echoes extended RCODE values after CHAOS class queries * Fix iterator RCODE handling of YXDOMAIN: only accept YXDOMAIN answers that contain a DNAME record * Fix missing bounds check when decompressing dnames for downloaded authority zones, preventing malformed content from truncated AXFR packets * Fix upstream TLS connections being reused for different names at the same IP address * Fix to disallow signatures with revoked DNSKEYs * Fix DNAME with unsigned CNAME to check for the correct match, preventing certain zone configurations from granting secure status to unchecked CNAMEs * Fix wildcard CNAME handling in the chain of trust * Fix buffer overrun in doq_repinfo_retrieve_localaddr() + Packaging changes: * Update keyring to new NLnet Labs release signing key

cloud_download Downloads

SUSE Linux Micro 6.2 ppc64le
  • Packages
    libunbound8
    Shared library from unbound
    1.25.2-160000.1.1 lock rpm
    unbound-anchor
    Unbound Anchor cert management tools
    1.25.2-160000.1.1 lock rpm
SUSE Linux Micro 6.2 aarch64
  • Packages
    libunbound8
    Shared library from unbound
    1.25.2-160000.1.1 lock rpm
    unbound-anchor
    Unbound Anchor cert management tools
    1.25.2-160000.1.1 lock rpm
SUSE Linux Micro 6.2 s390x
  • Packages
    libunbound8
    Shared library from unbound
    1.25.2-160000.1.1 lock rpm
    unbound-anchor
    Unbound Anchor cert management tools
    1.25.2-160000.1.1 lock rpm
SUSE Linux Micro 6.2 x86_64
  • Packages
    libunbound8
    Shared library from unbound
    1.25.2-160000.1.1 lock rpm
    unbound-anchor
    Unbound Anchor cert management tools
    1.25.2-160000.1.1 lock rpm