最新のセキュリティ情報

Unboundの脆弱性情報が公開されました（CVE-2026-81642、他8件）

Unbound 1.26.1 がリリースされました。(NLnet Labsのリリース日は9月16日です)

Unbound 1.25.1 released

We are pleased to announce the release of version 1.25.1 of the Unbound recursive DNS resolver. This release has a number of security fixes. The release is signed with the OpenPGP software signing key that is in use since Jan 1st 2026: User ID: NLnet Labs releases signing …

New OpenPGP keys for release signing and vulnerability reporting

We are performing a routine roll of our software signing and vulnerability reporting OpenPGP keys. From January 1st 2026, releases of ldns, NSD and Unbound will be signed with the following OpenPGP key: User ID: NLnet Labs releases signing key G2 <releases@nlnetlabs.nl> Key ID: A144 323D EAAC DF45 …

Unbound 1.24.2 released

We are pleased to announce the release of version 1.24.2 of the Unbound recursive DNS resolver. This security release provides an additional fix for CVE-2025-11411. Promiscuous NS RRSets that complement DNS replies in the authority section can be used to trick resolvers to update their delegation information for …

Unbound 1.24.1 released

We are pleased to announce the release of version 1.24.1 of the Unbound recursive DNS resolver. This security release fixes CVE-2025-11411. Several multi-vendor cache poisoning vulnerabilities have been discovered in caching resolvers for non-DNSSEC protected data. Unbound is vulnerable for some of these cases that could lead to …

Unbound 1.23.1 released

We are pleased to announce the release of version 1.23.1 of the Unbound recursive DNS resolver. This security release fixes CVE-2025-5994. A multi-vendor cache poisoning vulnerability named "Rebirthday Attack" has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with …

Unbound 1.21.1 released

We are pleased to announce the release of version 1.21.1 of the Unbound recursive DNS resolver. This security release fixes CVE-2024-8508. A vulnerability has been discovered in Unbound when handling replies with very large RRsets that Unbound needs to perform name compression for. Malicious upstreams responses with very …

Unbound 1.20.0 released

We are pleased to announce the release of version 1.20.0 of the Unbound recursive DNS resolver. This release has a fix for the DNSBomb issue CVE-2024-33655. This has a low severity for Unbound, since it makes Unbound complicit in targeting others, but does not affect Unbound so much …

Unbound 1.19.2 released

We are pleased to announce the release of version 1.19.2 of the Unbound recursive DNS resolver. This security release fixes CVE-2024-1931. NLnet Labs Unbound version 1.18.0 up to and including version 1.19.1 contain a vulnerability that can cause denial of service by a certain …

Unbound 1.19.1 released

We are pleased to announce the release of version 1.19.1 of the Unbound recursive DNS resolver. This security release fixes two DNSSEC validation vulnerabilities: CVE-2023-50387 (referred here as the KeyTrap vulnerability) and CVE-2023-50868 (referred here as the NSEC3 vulnerability). The KeyTrap vulnerability works by using a combination of …

Unbound 1.16.3 released

We are pleased to announce the release of version 1.16.3 of the Unbound recursive DNS resolver. This release fixes CVE-2022-3204 'Non-Responsive Delegation Attack'. It was reported by Yehuda Afek from Tel-Aviv University and Anat Bremler-Barr and Shani Stajnrod from Reichman University. This fixes for better performance when under …

Unbound 1.16.2 released

We are pleased to announce the release of version 1.16.2 of the Unbound recursive DNS resolver. This release fixes the novel ghost domain issues CVE-2022-30698 and CVE-2022-30699. They were reported by Xiang Li from the Network and Information Security Lab of Tsinghua University. Other than that there are …

tsuNAME vulnerability and Unbound

Last week, SIDN Labs, InternetNZ and USC/ISI researchers announced the vulnerability called tsuNAME [1] . With the analysis of the impact of tsuNAME, the researchers have also evaluated a number of open source DNS software, including Unbound. In their research they have assessed that Unbound is not vulnerable to the …

Unbound 1.10.1 released

We are pleased to announce the release of version 1.10.1 of the Unbound recursive DNS resolver. This release fixes CVE-2020-12662 and CVE-2020-12663. For a full list of changes and binary and source packages, see the download page . Related links: Unbound project page Directly download the source package

Unbound 1.9.6 released

We are pleased to announce the release of version 1.9.6 of the Unbound recursive DNS resolver. This release contains a number of security related fixes, contributed by X41 D-Sec. They have conducted a security audit of Unbound, funded by OSTIF. The previous CVEs fixed in 1.9.4 …

Unbound 1.9.5 released

We are pleased to announce the release of version 1.9.5 of the Unbound recursive DNS resolver. This release is a fix for vulnerability CVE-2019-18934 that can cause shell code execution after receiving a specially crafted answer. This issue can only be triggered when all of the below conditions …

Unbound 1.9.4 released

We are pleased to announce the release of version 1.9.4 of the Unbound recursive DNS resolver. This release is a fix for vulnerability CVE-2019-16866 that causes a failure when a specially crafted query is received. We would like to thank X41 D-Sec for notifying us about this vulnerability …

The peculiar case of NSEC processing using expanded wildcard records

We discovered a vulnerability in the processing of wildcard synthesized NSEC records. The result was Unbound, Google public DNS, PowerDNS and Dnsmasq contained a flaw that made it possible to downgrade secure connections. While synthesis of NSEC records is allowed by RFC 4592 , these synthesized owner names should not be used in the NSEC processing. This does, however, happen in Unbound 1.6.7 and earlier versions. Ralph Dolmans wrote a blog post about the discovery and findings.

Unbound 1.6.8 released

Unbound 1.6.8 fixes CVE-2017-15105 : vulnerability in the processing of wildcard synthesized NSEC records.

Unbound 1.5.1 released

CVE-2014-8602 denial of service fixed. Crash fix, compile fix. AAAA-filter patch.