Unbound, the validating and caching DNS resolver from NLnet Labs, has had a heavy year. Debian released three updates for Debian 13 (trixie): DSA-6304-1 in May, DSA-6507-1 in September and DSA-6581-1 on 23 October 2026. Between them they fix 49 CVEs, including memory-safety bugs in the DNSSEC validator that NLnet Labs says could allow remote code execution.
Debian 12 (bookworm) has received no Unbound update for any of these rounds. As of 31 October 2026 the Debian security tracker lists bookworm's Unbound as vulnerable to all of them.
At a glance
| Advisory | Date | CVEs | Trixie fixed version |
|---|---|---|---|
| DSA-6304-1 | 27 May 2026 | 11 | 1.22.0-2+deb13u3 |
| DSA-6507-1 | 19 Sep 2026 | 34 | 1.26.1-0+deb13u1 |
| DSA-6581-1 | 23 Oct 2026 | 5 | 1.26.2-0+deb13u1 |
Source package unbound; binaries unbound, libunbound8, unbound-anchor, unbound-host, python3-unbound. Severity: Critical (NLnet Labs CVSS 4.0 score 9.1 for two CVEs). Bookworm: no fixed package.
What the vulnerabilities are
May: DSA-6304-1
Debian described the 11 issues as possible denial of service, cache poisoning or potentially arbitrary code execution. The most serious, CVE-2026-33278 (CVSS 4.0: 9.1), is a pointer bug in the DNSSEC validator: an attacker who controls a malicious signed zone and gets Unbound to query it can trigger a crash or potentially code execution. NLnet Labs lists it for Unbound 1.19.1 to 1.25.0. CVE-2026-42944 (8.7) is a heap overflow when a query carries several NSID, DNS Cookie or EDNS Padding options; padding of responses is enabled by default.
September: DSA-6507-1
The largest round, 34 CVEs, which Debian summarised as possible denial of service, cache poisoning, DNS cookie bypass or potentially arbitrary code execution. Two stand out:
- CVE-2026-81642 (CVSS 4.0: 9.1): a crafted DNSKEY can overflow a digest buffer in the validator. NLnet Labs says remote code execution is possible and that an attacker only needs to control a malicious zone and have Unbound query it. It affects all versions up to 1.26.0.
- CVE-2026-82717 (8.4): heap corruption triggered by CNAME synthesis combined with a compression pointer; it leads to crashes and, on some systems and builds, possibly code execution.
Several other issues in this round only apply when optional features are switched on, such as DNS-over-QUIC, DNS-over-HTTPS or DNSCrypt.
October: DSA-6581-1
Five fixes: two DNSSEC problems with an island trust anchor under an insecure parent (CVE-2026-35501, CVE-2026-50106), unbounded name-decompression work that degrades service (CVE-2026-96405), a DNS-over-QUIC use-after-free on multi-threaded setups (CVE-2026-97206), and a cache side channel that could enable poisoning when unwanted-reply-threshold is set, which is not the default (CVE-2026-109125).
None of the 49 CVEs is in the CISA Known Exploited Vulnerabilities catalog (30 October 2026 edition).
Are you affected?
dpkg-query -W -f='${Package} ${Version}\n' 'unbound*' libunbound8
apt policy unbound
systemctl is-active unbound
sudo grep -rnE 'interface:|access-control|quic-port|https-port|dnscrypt|unwanted-reply-threshold|trust-anchor' /etc/unbound/Trixie systems below 1.26.2-0+deb13u1 miss at least the October fixes. Every bookworm build is listed as vulnerable. NLnet Labs' version ranges show that not every CVE reaches bookworm's Unbound 1.17.1 (CVE-2026-33278 starts at 1.19.1, and the QUIC bugs at 1.22.0), but others, including CVE-2026-81642, cover all versions.
How to update
On Debian 13 (trixie):
sudo apt update
sudo apt install --only-upgrade unbound libunbound8 unbound-anchor unbound-host python3-unbound
sudo unbound-checkconf
apt policy unboundThe fixed packages move trixie from upstream 1.22.0 to 1.26.x, a bigger step than a usual stable update, so unbound-checkconf is worth running before you restart.
On Debian 12 (bookworm) there is no fixed package. Unbound only answers 127.0.0.0/8 by default; keep access-control that tight or limited to your own networks. That does not remove the risk, because a local resolver still looks up names that outsiders choose, for example sender domains on a mail server. Plan the move to trixie, and watch the tracker page for a DLA.
Restart or reboot?
No reboot. Restart the resolver, then restart any other service that loads libunbound8; needrestart lists them:
sudo systemctl restart unbound
unbound -V | head -1
sudo needrestart -r lSources
- security-tracker.debian.org/tracker/DSA-6581-1
- debian.org/security/2026/dsa-6581
- lists.debian.org/debian-security-announce/2026/msg00497.html
- security-tracker.debian.org/tracker/DSA-6507-1
- debian.org/security/2026/dsa-6507
- lists.debian.org/debian-security-announce/2026/msg00419.html
- security-tracker.debian.org/tracker/DSA-6304-1
- debian.org/security/2026/dsa-6304
- lists.debian.org/debian-security-announce/2026/msg00215.html
- security-tracker.debian.org/tracker/source-package/unbound
- nlnetlabs.nl/projects/unbound/security-advisories
- nlnetlabs.nl/downloads/unbound/CVE-2026-81642.txt
- nlnetlabs.nl/downloads/unbound/CVE-2026-33278.txt
- nlnetlabs.nl/downloads/unbound/CVE-2026-109125.txt
- cve.org/CVERecord?id=CVE-2026-81642
- cve.org/CVERecord?id=CVE-2026-33278
- cve.org/CVERecord?id=CVE-2026-82717
- cve.org/CVERecord?id=CVE-2026-42944
- cisa.gov/known-exploited-vulnerabilities-catalog
- packages.debian.org/source/trixie/unbound
- manpages.debian.org/trixie/unbound/unbound.conf.5.en.html
- manpages.debian.org/trixie/unbound/unbound.8.en.html
- manpages.debian.org/trixie/needrestart/needrestart.1.en.html
Comments
0 total · 0 threads