unbound vulnerabilities and fixes

Recent CVEs affecting unbound, with upgrade or downgrade steps. 23 tracked.

unbound has 23 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 23. Most recent: 2026-07-22. Highest priority: CVE-2026-32665 (score 36/100).

• CVE-2026-32665 HIGH 7.5 UPGRADE In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the f
• CVE-2026-40691 HIGH 7.5 UPGRADE In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encr
• CVE-2026-55973 HIGH 7.5 UPGRADE In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Repo
• CVE-2026-50252 CRITICAL 9.3 UPGRADE In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve a
• CVE-2026-50045 MEDIUM 5.3 UPGRADE In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a single client query for a deeply nested name under
• CVE-2026-52863 MEDIUM 5.9 UPGRADE In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules wor
• CVE-2026-55991 MEDIUM 5.9 UPGRADE In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtc
• CVE-2026-56444 MEDIUM 5.9 UPGRADE In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with 'serve-expired: yes'
• CVE-2026-44690 HIGH 7.5 UPGRADE In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field comb
• CVE-2026-44621 MEDIUM 5.9 UPGRADE With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with
• CVE-2026-50046 MEDIUM 5.9 UPGRADE In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS (DoT) forwa
• CVE-2026-55717 MEDIUM 5.9 UPGRADE In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'res
• CVE-2026-55990 MEDIUM 5.9 UPGRADE In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt-provi
• CVE-2026-50248 MEDIUM 6.5 UPGRADE In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostnam
• CVE-2026-50251 MEDIUM 5.3 UPGRADE In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled (set to a
• CVE-2026-41637 LOW 3.7 UPGRADE In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not
• CVE-2026-54478 LOW 3.7 UPGRADE In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a 'proxy-protocol-port' inter
• CVE-2026-56416 MEDIUM 4.8 UPGRADE In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form f
• CVE-2026-44687 LOW 3.7 UPGRADE In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an inte
• CVE-2026-42955 LOW 3.7 UPGRADE In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the
• CVE-2026-46582 LOW 3.7 UPGRADE In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data,
• CVE-2026-50243 LOW 3.7 UPGRADE In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the 'respip' module in
• CVE-2026-55708 LOW 3.1 UPGRADE In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'view_local_data' and 'view_local_datas' commands

FAQ

How do I fix unbound vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is unbound being exploited right now?

None of the tracked unbound CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which unbound CVE should I patch first?

CVE-2026-32665 currently ranks highest (36/100): In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the f.

← Back to latest CVEs