最新のセキュリティ情報

Unboundの脆弱性情報が公開されました（CVE-2026-81642、他8件）

Unbound 1.26.1 がリリースされました。(NLnet Labsのリリース日は9月16日です)

Unbound 1.25.1 released

We are pleased to announce the release of version 1.25.1 of the Unbound recursive DNS resolver. This release has a number of security fixes. The release is signed with the OpenPGP software signing key that is in use since Jan 1st 2026: User ID: NLnet Labs releases signing …

Unbound 1.25.0 released

We are pleased to announce the release of version 1.25.0 of the Unbound recursive DNS resolver. This release has some features and a number of bug fixes. The release is signed with the OpenPGP software signing key that is in use since Jan 1st 2026: User ID: NLnet …

New OpenPGP keys for release signing and vulnerability reporting

We are performing a routine roll of our software signing and vulnerability reporting OpenPGP keys. From January 1st 2026, releases of ldns, NSD and Unbound will be signed with the following OpenPGP key: User ID: NLnet Labs releases signing key G2 <releases@nlnetlabs.nl> Key ID: A144 323D EAAC DF45 …

Unbound 1.24.2 released

We are pleased to announce the release of version 1.24.2 of the Unbound recursive DNS resolver. This security release provides an additional fix for CVE-2025-11411. Promiscuous NS RRSets that complement DNS replies in the authority section can be used to trick resolvers to update their delegation information for …

Unbound 1.24.1 released

We are pleased to announce the release of version 1.24.1 of the Unbound recursive DNS resolver. This security release fixes CVE-2025-11411. Several multi-vendor cache poisoning vulnerabilities have been discovered in caching resolvers for non-DNSSEC protected data. Unbound is vulnerable for some of these cases that could lead to …

Unbound 1.24.0 released

We are pleased to announce the release of version 1.24.0 of the Unbound recursive DNS resolver. This release features increased defaults, num.valops statistic, unbound-control cache_lookup , and bug fixes. The default value increase for num-queries-per-thread is to make saturation of the task queue more resource intensive and less …

Unbound 1.23.1 released

We are pleased to announce the release of version 1.23.1 of the Unbound recursive DNS resolver. This security release fixes CVE-2025-5994. A multi-vendor cache poisoning vulnerability named "Rebirthday Attack" has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with …

Unbound 1.23.0 released

We are pleased to announce the release of version 1.23.0 of the Unbound recursive DNS resolver. This release features changed defaults, fast reload, redis replica, DNS Error Reporting, and bug fixes. The fast reload is a feature that is listed as experimental. With unbound-control fast_reload the server can …

Unbound 1.22.0 released

We are pleased to announce the release of version 1.22.0 of the Unbound recursive DNS resolver. This release has an option to harden against unverified glue, it is enabled with harden-unverified-glue: yes . It was contributed by Karthik Umashankar from Microsoft. This protects Unbound against bad glue, that is …

Unbound 1.21.1 released

We are pleased to announce the release of version 1.21.1 of the Unbound recursive DNS resolver. This security release fixes CVE-2024-8508. A vulnerability has been discovered in Unbound when handling replies with very large RRsets that Unbound needs to perform name compression for. Malicious upstreams responses with very …

Unbound 1.21.0 released

We are pleased to announce the release of version 1.21.0 of the Unbound recursive DNS resolver. This release has a fix for the CAMP and CacheFlush issues. They have a low severity for Unbound, since it does not affect Unbound so much. The Compositional Amplification (CAMP) type of …

Unbound 1.20.0 released

We are pleased to announce the release of version 1.20.0 of the Unbound recursive DNS resolver. This release has a fix for the DNSBomb issue CVE-2024-33655. This has a low severity for Unbound, since it makes Unbound complicit in targeting others, but does not affect Unbound so much …

Unbound 1.19.3 released

We are pleased to announce the release of version 1.19.3 of the Unbound recursive DNS resolver. This release has a number of bug fixes. The CNAME synthesized for a DNAME record uses the original TTL, of the DNAME record, and that means it can be cached for the …

Unbound 1.19.2 released

We are pleased to announce the release of version 1.19.2 of the Unbound recursive DNS resolver. This security release fixes CVE-2024-1931. NLnet Labs Unbound version 1.18.0 up to and including version 1.19.1 contain a vulnerability that can cause denial of service by a certain …

Unbound 1.19.1 released

We are pleased to announce the release of version 1.19.1 of the Unbound recursive DNS resolver. This security release fixes two DNSSEC validation vulnerabilities: CVE-2023-50387 (referred here as the KeyTrap vulnerability) and CVE-2023-50868 (referred here as the NSEC3 vulnerability). The KeyTrap vulnerability works by using a combination of …

Unbound 1.19.0 released

We are pleased to announce the release of version 1.19.0 of the Unbound recursive DNS resolver. This release fixes a number of bugs, and adds some smaller features. The redis-logical-db option and cachedb-no-store option can be used for cachedb configuration. The disable-edns-do option can be used for working …

Unbound 1.18.0 released

We are pleased to announce the release of version 1.18.0 of the Unbound recursive DNS resolver. This release adds DNS cookies downstream, support to respond with EDE error codes from cache, NAT64 support, and the capability to use a socket queue timeout to discard old packets, and other …

Unbound 1.17.1 released

We are pleased to announce the release of version 1.17.1 of the Unbound recursive DNS resolver. This release fixes a number of bugs. There are also new configuration options that by default do not change the existing behaviour of Unbound. With statistics-inhibit-zero the printout of zero values by …

Unbound 1.17.0 released

We are pleased to announce the release of version 1.17.0 of the Unbound recursive DNS resolver. This release has new interface acl configuration options. These allow access-control actions, per interface. Also tags, and views can be configured per interface, queries over the interface are answered with these tags …

Unbound 1.16.3 released

We are pleased to announce the release of version 1.16.3 of the Unbound recursive DNS resolver. This release fixes CVE-2022-3204 'Non-Responsive Delegation Attack'. It was reported by Yehuda Afek from Tel-Aviv University and Anat Bremler-Barr and Shani Stajnrod from Reichman University. This fixes for better performance when under …

Unbound 1.16.2 released

We are pleased to announce the release of version 1.16.2 of the Unbound recursive DNS resolver. This release fixes the novel ghost domain issues CVE-2022-30698 and CVE-2022-30699. They were reported by Xiang Li from the Network and Information Security Lab of Tsinghua University. Other than that there are …

Unbound 1.16.1 released

We are pleased to announce the release of version 1.16.1 of the Unbound recursive DNS resolver. This release fixes a number of bugs. The number of nxdomains encountered when looking up a nameserver is not counted as such when the lookup was from cache. Also parent side queries …

Unbound 1.16.0 released

We are pleased to announce the release of version 1.16.0 of the Unbound recursive DNS resolver. This release has EDE support, for extended EDNS error reporting, it fixes unsupported ZONEMD algorithms to load, and has more bug fixes. The EDE errors can be turned on by ede: yes …

Unbound 1.15.0 released

We are pleased to announce the release of version 1.15.0 of the Unbound recursive DNS resolver. This release has bug fixes for crashes that happened on heavy network usage. The default for the aggressive-nsec option has changed, it is now enabled. The ratelimit logic had to be reworked …

Unbound 1.14.0 released

We are pleased to announce the release of version 1.14.0 of the Unbound recursive DNS resolver. This release contains bug fixes and a full set of RPZ triggers and actions that are supported. This works with RPZ zones, configured with rpz: . It is possible to selectively enable use …

Unbound 1.13.2 released

We are pleased to announce the release of version 1.13.2 of the Unbound recursive DNS resolver. The release contains a bugfix to fix the make install of the python module after build changes introduced in this release rc1. This release contains a number of bug fixes. There is …

tsuNAME vulnerability and Unbound

Last week, SIDN Labs, InternetNZ and USC/ISI researchers announced the vulnerability called tsuNAME [1] . With the analysis of the impact of tsuNAME, the researchers have also evaluated a number of open source DNS software, including Unbound. In their research they have assessed that Unbound is not vulnerable to the …

Unbound 1.13.1 released

We are pleased to announce the release of version 1.13.1 of the Unbound recursive DNS resolver. This release contains a number of bug fixes. There is added support for the EDNS Padding option (RFC7830 and RFC8467), and the EDNS NSID option (RFC 5001). Unbound control has added commands …

Unbound 1.13.0 released

We are pleased to announce the release of version 1.13.0 of the Unbound recursive DNS resolver. This version has fixes to connect for UDP sockets, slowing down potential ICMP side channel leakage. The fix can be controlled with the option udp-connect: yes , it is enabled by default. Additionally …

Unbound 1.12.0 released

We are pleased to announce the release of version 1.12.0 of the Unbound recursive DNS resolver. This release contains the DNS Flag Day 2020 changes. This sets the default EDNS buffer size to 1232, that should reduce fragmentation. https://dnsflagday.net/2020/ There is inclusive language in the …

Unbound 1.11.0 released

We are pleased to announce the release of version 1.11.0 of the Unbound recursive DNS resolver. This release contains a number of bug fixes. Also new features are introduced. The configure --with-dynlibmodule enables dynamic library support that can have code modules function like the python library scripts. It …

Unbound 1.10.1 released

We are pleased to announce the release of version 1.10.1 of the Unbound recursive DNS resolver. This release fixes CVE-2020-12662 and CVE-2020-12663. For a full list of changes and binary and source packages, see the download page . Related links: Unbound project page Directly download the source package

Unbound 1.10.0 released

We are pleased to announce the release of version 1.10.0 of the Unbound recursive DNS resolver. The 1.10.0 release has RPZ support and serve stale functionality according to draft draft-ietf-dnsop-serve-stale-10. And a number of other, smaller, features, and bug fixes. The DNS Response Policy Zones (RPZ …

In Memory of Bill Manning

We have just learned from friends that Bill Manning died last night. Bill was a member of the original Unbound design team in 2006, and as such instrumental for the success of Unbound resolver. From the doc/requirements.txt document that is distributed with the Unbound source code: The Unbound …

Unbound 1.9.6 released

We are pleased to announce the release of version 1.9.6 of the Unbound recursive DNS resolver. This release contains a number of security related fixes, contributed by X41 D-Sec. They have conducted a security audit of Unbound, funded by OSTIF. The previous CVEs fixed in 1.9.4 …

Unbound 1.9.5 released

We are pleased to announce the release of version 1.9.5 of the Unbound recursive DNS resolver. This release is a fix for vulnerability CVE-2019-18934 that can cause shell code execution after receiving a specially crafted answer. This issue can only be triggered when all of the below conditions …

Unbound 1.9.4 released

We are pleased to announce the release of version 1.9.4 of the Unbound recursive DNS resolver. This release is a fix for vulnerability CVE-2019-16866 that causes a failure when a specially crafted query is received. We would like to thank X41 D-Sec for notifying us about this vulnerability …

Unbound 1.9.3 released

We are pleased to announce the release of version 1.9.3 of the Unbound recursive DNS resolver. This release has a number of bug fixes. Added is the ipset module, that helps add ip-addresses that are looked up in a domain to a firewall ip-address filter. Also, the python …

Unbound 1.9.2 released

We are pleased to announce the release of version 1.9.2 of the Unbound recursive DNS resolver. This release contains a number of bug fixes for crashes introduced in 1.9, session ticket code, stream pipeline code, auth zone code and it also fixes qname minimisation packet scrub failures …

NSD and Unbound repositories moving to GitHub on 1 May 2019

We are excited to announce that on the 1st of May 2019, we will migrate the NSD and Unbound repositories to git and use GitHub for maintaining them. We are also going to use the GitHub infrastructure to manage tasks and community contributions, collect user feedback and allow you to …

Unbound 1.9.1 released

We are pleased to announce the release of version 1.9.1 of the Unbound recursive DNS resolver. This release contains bug fixes for two issues in the out of order processing introduced in 1.9.0, one where the wrong answer was returned and a crash bug in file …

Unbound 1.9.0 released

We are pleased to announce the release of version 1.9.0 of the Unbound recursive DNS resolver. This release contains the DNS Flag Day changes for Unbound. See the reference here, https://dnsflagday.net/ . Or this presentation: EDNS Flag Day - OARC29.pdf . The EDNS timeouts are not used to …

Unbound 1.8.3 released

We are pleased to announce the release of version 1.8.3 of the Unbound recursive DNS resolver. This release fixes crash bug introduced in 1.8.2 in the dns64 processing. For a full list of changes and binary and source packages, see the download page . Related links: Unbound …

Unbound 1.8.2 released

We are pleased to announce the release of version 1.8.2 of the Unbound recursive DNS resolver. The option so-reuseport is by default disabled on FreeBSD, but it has support to work on FreeBSD 12 with the REUSEPORT_LB variant, if enabled in unbound.conf. The python code in unbound …

Unbound 1.8.1 released

We are pleased to announce the release of version 1.8.1 of the Unbound recursive DNS resolver. This release of Unbound contains a number of bug fixes. A memory leak in the TLS lookup code is fixed. Leaked requests in the requestlist are fixed. Lookup failure due to qname …

Unbound 1.8.0 released

We are pleased to announce the release of version 1.8.0 of the Unbound recursive DNS resolver. This release has a number of bug fixes, a list of features added and some defaults changed. The defaults that are changed enable options that have been introduced in the past with …

Unbound 1.7.3 released

We are pleased to announce the release of version 1.7.3 of the Unbound recursive DNS resolver. This release fixes a bug in qname minimisation, from 1.7.1, that double counts CNAMEs and this causes resolution failures because the maximum CNAME count is hit. This caught attention because …

Unbound 1.7.2 released

We are pleased to announce the release of version 1.7.2 of the Unbound recursive DNS resolver. There are a number of bug fixes, but also some features. This release fixes bugs in DNS-over-TLS for windows, and adds the option for Windows users to use the CA certificates from …