Latest security news
Wed, May 20
Unbound 1.25.1 released
We are pleased to announce the release of version 1.25.1 of the Unbound recursive DNS resolver. This release has a number of security fixes. The release is signed with the OpenPGP software signing key that is in use since Jan 1st 2026: User ID: NLnet Labs releases signing …
Wed, April 29
Unbound 1.25.0 released
We are pleased to announce the release of version 1.25.0 of the Unbound recursive DNS resolver. This release has some features and a number of bug fixes. The release is signed with the OpenPGP software signing key that is in use since Jan 1st 2026: User ID: NLnet …
Tue, December 9
New OpenPGP keys for release signing and vulnerability reporting
We are performing a routine roll of our software signing and vulnerability reporting OpenPGP keys. From January 1st 2026, releases of ldns, NSD and Unbound will be signed with the following OpenPGP key: User ID: NLnet Labs releases signing key G2 <releases@nlnetlabs.nl> Key ID: A144 323D EAAC DF45 …
Wed, November 26
Unbound 1.24.2 released
We are pleased to announce the release of version 1.24.2 of the Unbound recursive DNS resolver. This security release provides an additional fix for CVE-2025-11411. Promiscuous NS RRSets that complement DNS replies in the authority section can be used to trick resolvers to update their delegation information for …
Wed, October 22
Unbound 1.24.1 released
We are pleased to announce the release of version 1.24.1 of the Unbound recursive DNS resolver. This security release fixes CVE-2025-11411. Several multi-vendor cache poisoning vulnerabilities have been discovered in caching resolvers for non-DNSSEC protected data. Unbound is vulnerable for some of these cases that could lead to …
Thu, September 18
Unbound 1.24.0 released
We are pleased to announce the release of version 1.24.0 of the Unbound recursive DNS resolver. This release features increased defaults, num.valops statistic, unbound-control cache_lookup , and bug fixes. The default value increase for num-queries-per-thread is to make saturation of the task queue more resource intensive and less …
Wed, July 16
Unbound 1.23.1 released
We are pleased to announce the release of version 1.23.1 of the Unbound recursive DNS resolver. This security release fixes CVE-2025-5994. A multi-vendor cache poisoning vulnerability named "Rebirthday Attack" has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with …
Thu, April 24
Unbound 1.23.0 released
We are pleased to announce the release of version 1.23.0 of the Unbound recursive DNS resolver. This release features changed defaults, fast reload, redis replica, DNS Error Reporting, and bug fixes. The fast reload is a feature that is listed as experimental. With unbound-control fast_reload the server can …
Thu, October 17
Unbound 1.22.0 released
We are pleased to announce the release of version 1.22.0 of the Unbound recursive DNS resolver. This release has an option to harden against unverified glue, it is enabled with harden-unverified-glue: yes . It was contributed by Karthik Umashankar from Microsoft. This protects Unbound against bad glue, that is …
Thu, October 3
Unbound 1.21.1 released
We are pleased to announce the release of version 1.21.1 of the Unbound recursive DNS resolver. This security release fixes CVE-2024-8508. A vulnerability has been discovered in Unbound when handling replies with very large RRsets that Unbound needs to perform name compression for. Malicious upstreams responses with very …
Thu, August 15
Unbound 1.21.0 released
We are pleased to announce the release of version 1.21.0 of the Unbound recursive DNS resolver. This release has a fix for the CAMP and CacheFlush issues. They have a low severity for Unbound, since it does not affect Unbound so much. The Compositional Amplification (CAMP) type of …
Wed, May 8
Unbound 1.20.0 released
We are pleased to announce the release of version 1.20.0 of the Unbound recursive DNS resolver. This release has a fix for the DNSBomb issue CVE-2024-33655. This has a low severity for Unbound, since it makes Unbound complicit in targeting others, but does not affect Unbound so much …
Thu, March 14
Unbound 1.19.3 released
We are pleased to announce the release of version 1.19.3 of the Unbound recursive DNS resolver. This release has a number of bug fixes. The CNAME synthesized for a DNAME record uses the original TTL, of the DNAME record, and that means it can be cached for the …
Thu, March 7
Unbound 1.19.2 released
We are pleased to announce the release of version 1.19.2 of the Unbound recursive DNS resolver. This security release fixes CVE-2024-1931. NLnet Labs Unbound version 1.18.0 up to and including version 1.19.1 contain a vulnerability that can cause denial of service by a certain …
Tue, February 13
Unbound 1.19.1 released
We are pleased to announce the release of version 1.19.1 of the Unbound recursive DNS resolver. This security release fixes two DNSSEC validation vulnerabilities: CVE-2023-50387 (referred here as the KeyTrap vulnerability) and CVE-2023-50868 (referred here as the NSEC3 vulnerability). The KeyTrap vulnerability works by using a combination of …
Wed, November 8
Unbound 1.19.0 released
We are pleased to announce the release of version 1.19.0 of the Unbound recursive DNS resolver. This release fixes a number of bugs, and adds some smaller features. The redis-logical-db option and cachedb-no-store option can be used for cachedb configuration. The disable-edns-do option can be used for working …
Wed, August 30
Unbound 1.18.0 released
We are pleased to announce the release of version 1.18.0 of the Unbound recursive DNS resolver. This release adds DNS cookies downstream, support to respond with EDE error codes from cache, NAT64 support, and the capability to use a socket queue timeout to discard old packets, and other …
Thu, January 12
Unbound 1.17.1 released
We are pleased to announce the release of version 1.17.1 of the Unbound recursive DNS resolver. This release fixes a number of bugs. There are also new configuration options that by default do not change the existing behaviour of Unbound. With statistics-inhibit-zero the printout of zero values by …
Thu, October 13
Unbound 1.17.0 released
We are pleased to announce the release of version 1.17.0 of the Unbound recursive DNS resolver. This release has new interface acl configuration options. These allow access-control actions, per interface. Also tags, and views can be configured per interface, queries over the interface are answered with these tags …
Wed, September 21
Unbound 1.16.3 released
We are pleased to announce the release of version 1.16.3 of the Unbound recursive DNS resolver. This release fixes CVE-2022-3204 'Non-Responsive Delegation Attack'. It was reported by Yehuda Afek from Tel-Aviv University and Anat Bremler-Barr and Shani Stajnrod from Reichman University. This fixes for better performance when under …
Mon, August 1
Unbound 1.16.2 released
We are pleased to announce the release of version 1.16.2 of the Unbound recursive DNS resolver. This release fixes the novel ghost domain issues CVE-2022-30698 and CVE-2022-30699. They were reported by Xiang Li from the Network and Information Security Lab of Tsinghua University. Other than that there are …
Mon, July 11
Unbound 1.16.1 released
We are pleased to announce the release of version 1.16.1 of the Unbound recursive DNS resolver. This release fixes a number of bugs. The number of nxdomains encountered when looking up a nameserver is not counted as such when the lookup was from cache. Also parent side queries …
Thu, June 2
Unbound 1.16.0 released
We are pleased to announce the release of version 1.16.0 of the Unbound recursive DNS resolver. This release has EDE support, for extended EDNS error reporting, it fixes unsupported ZONEMD algorithms to load, and has more bug fixes. The EDE errors can be turned on by ede: yes …
Thu, February 10
Unbound 1.15.0 released
We are pleased to announce the release of version 1.15.0 of the Unbound recursive DNS resolver. This release has bug fixes for crashes that happened on heavy network usage. The default for the aggressive-nsec option has changed, it is now enabled. The ratelimit logic had to be reworked …
Thu, December 9
Unbound 1.14.0 released
We are pleased to announce the release of version 1.14.0 of the Unbound recursive DNS resolver. This release contains bug fixes and a full set of RPZ triggers and actions that are supported. This works with RPZ zones, configured with rpz: . It is possible to selectively enable use …
Thu, August 12
Unbound 1.13.2 released
We are pleased to announce the release of version 1.13.2 of the Unbound recursive DNS resolver. The release contains a bugfix to fix the make install of the python module after build changes introduced in this release rc1. This release contains a number of bug fixes. There is …
Tue, May 11
tsuNAME vulnerability and Unbound
Last week, SIDN Labs, InternetNZ and USC/ISI researchers announced the vulnerability called tsuNAME [1] . With the analysis of the impact of tsuNAME, the researchers have also evaluated a number of open source DNS software, including Unbound. In their research they have assessed that Unbound is not vulnerable to the …
Tue, February 9
Unbound 1.13.1 released
We are pleased to announce the release of version 1.13.1 of the Unbound recursive DNS resolver. This release contains a number of bug fixes. There is added support for the EDNS Padding option (RFC7830 and RFC8467), and the EDNS NSID option (RFC 5001). Unbound control has added commands …
Thu, December 3
Unbound 1.13.0 released
We are pleased to announce the release of version 1.13.0 of the Unbound recursive DNS resolver. This version has fixes to connect for UDP sockets, slowing down potential ICMP side channel leakage. The fix can be controlled with the option udp-connect: yes , it is enabled by default. Additionally …
Thu, October 8
Unbound 1.12.0 released
We are pleased to announce the release of version 1.12.0 of the Unbound recursive DNS resolver. This release contains the DNS Flag Day 2020 changes. This sets the default EDNS buffer size to 1232, that should reduce fragmentation. https://dnsflagday.net/2020/ There is inclusive language in the …
Mon, July 27
Unbound 1.11.0 released
We are pleased to announce the release of version 1.11.0 of the Unbound recursive DNS resolver. This release contains a number of bug fixes. Also new features are introduced. The configure --with-dynlibmodule enables dynamic library support that can have code modules function like the python library scripts. It …
Tue, May 19
Unbound 1.10.1 released
We are pleased to announce the release of version 1.10.1 of the Unbound recursive DNS resolver. This release fixes CVE-2020-12662 and CVE-2020-12663. For a full list of changes and binary and source packages, see the download page . Related links: Unbound project page Directly download the source package
Thu, February 20
Unbound 1.10.0 released
We are pleased to announce the release of version 1.10.0 of the Unbound recursive DNS resolver. The 1.10.0 release has RPZ support and serve stale functionality according to draft draft-ietf-dnsop-serve-stale-10. And a number of other, smaller, features, and bug fixes. The DNS Response Policy Zones (RPZ …
Sun, January 26
In Memory of Bill Manning
We have just learned from friends that Bill Manning died last night. Bill was a member of the original Unbound design team in 2006, and as such instrumental for the success of Unbound resolver. From the doc/requirements.txt document that is distributed with the Unbound source code: The Unbound …
Thu, December 12
Unbound 1.9.6 released
We are pleased to announce the release of version 1.9.6 of the Unbound recursive DNS resolver. This release contains a number of security related fixes, contributed by X41 D-Sec. They have conducted a security audit of Unbound, funded by OSTIF. The previous CVEs fixed in 1.9.4 …
Tue, November 19
Unbound 1.9.5 released
We are pleased to announce the release of version 1.9.5 of the Unbound recursive DNS resolver. This release is a fix for vulnerability CVE-2019-18934 that can cause shell code execution after receiving a specially crafted answer. This issue can only be triggered when all of the below conditions …
Thu, October 3
Unbound 1.9.4 released
We are pleased to announce the release of version 1.9.4 of the Unbound recursive DNS resolver. This release is a fix for vulnerability CVE-2019-16866 that causes a failure when a specially crafted query is received. We would like to thank X41 D-Sec for notifying us about this vulnerability …
Tue, August 27
Unbound 1.9.3 released
We are pleased to announce the release of version 1.9.3 of the Unbound recursive DNS resolver. This release has a number of bug fixes. Added is the ipset module, that helps add ip-addresses that are looked up in a domain to a firewall ip-address filter. Also, the python …
Mon, June 17
Unbound 1.9.2 released
We are pleased to announce the release of version 1.9.2 of the Unbound recursive DNS resolver. This release contains a number of bug fixes for crashes introduced in 1.9, session ticket code, stream pipeline code, auth zone code and it also fixes qname minimisation packet scrub failures …
Fri, April 19
NSD and Unbound repositories moving to GitHub on 1 May 2019
We are excited to announce that on the 1st of May 2019, we will migrate the NSD and Unbound repositories to git and use GitHub for maintaining them. We are also going to use the GitHub infrastructure to manage tasks and community contributions, collect user feedback and allow you to …
Mon, March 11
Unbound 1.9.1 released
We are pleased to announce the release of version 1.9.1 of the Unbound recursive DNS resolver. This release contains bug fixes for two issues in the out of order processing introduced in 1.9.0, one where the wrong answer was returned and a crash bug in file …
Tue, February 5
Unbound 1.9.0 released
We are pleased to announce the release of version 1.9.0 of the Unbound recursive DNS resolver. This release contains the DNS Flag Day changes for Unbound. See the reference here, https://dnsflagday.net/ . Or this presentation: EDNS Flag Day - OARC29.pdf . The EDNS timeouts are not used to …
Tue, December 11
Unbound 1.8.3 released
We are pleased to announce the release of version 1.8.3 of the Unbound recursive DNS resolver. This release fixes crash bug introduced in 1.8.2 in the dns64 processing. For a full list of changes and binary and source packages, see the download page . Related links: Unbound …
Tue, December 4
Unbound 1.8.2 released
We are pleased to announce the release of version 1.8.2 of the Unbound recursive DNS resolver. The option so-reuseport is by default disabled on FreeBSD, but it has support to work on FreeBSD 12 with the REUSEPORT_LB variant, if enabled in unbound.conf. The python code in unbound …
Mon, October 8
Unbound 1.8.1 released
We are pleased to announce the release of version 1.8.1 of the Unbound recursive DNS resolver. This release of Unbound contains a number of bug fixes. A memory leak in the TLS lookup code is fixed. Leaked requests in the requestlist are fixed. Lookup failure due to qname …
Mon, September 10
Unbound 1.8.0 released
We are pleased to announce the release of version 1.8.0 of the Unbound recursive DNS resolver. This release has a number of bug fixes, a list of features added and some defaults changed. The defaults that are changed enable options that have been introduced in the past with …
Thu, June 21
Unbound 1.7.3 released
We are pleased to announce the release of version 1.7.3 of the Unbound recursive DNS resolver. This release fixes a bug in qname minimisation, from 1.7.1, that double counts CNAMEs and this causes resolution failures because the maximum CNAME count is hit. This caught attention because …
Mon, June 11
Unbound 1.7.2 released
We are pleased to announce the release of version 1.7.2 of the Unbound recursive DNS resolver. There are a number of bug fixes, but also some features. This release fixes bugs in DNS-over-TLS for windows, and adds the option for Windows users to use the CA certificates from …
Thu, May 3
Unbound 1.7.1 released
We are pleased to announce the release of version 1.7.1 of the Unbound recursive DNS resolver. There are a number of bug fixes, but also some features. This release has root key sentinel support, default on, from draft draft-ietf-dnsop-kskroll-sentinel . The root key sentinel helps the root key rollover …
Thu, March 15
Unbound 1.7.0 released
We are pleased to announce the release of version 1.7.0 of the Unbound recursive DNS resolver. Apart from numerous big fixes, this version introduces some important new features. Authority zones is an option that makes it possible to transfer an authoritative zone to Unbound. These transfers can happen …