Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| Unknown | n/a | DSA-6581-1 |
unbound security update
DebianDebian Linux, Debian unbound
|
Debian Security Advisories | |||
|
DSA-6581-1CVE-2026-109125CVE-2026-35501CVE-2026-50106CVE-2026-96405unbound security update
Executive summaryDebian has released a security update for the unbound DNS resolver package, which fixes five vulnerabilities. The advisory describes problems including DNSSEC trust bypasses, cache poisoning risk, and denial of service, and it recommends upgrading unbound packages. Technical summaryThe advisory covers five CVEs in Unbound: CVE-2026-35501 allows bypass of a configured island trust anchor underneath an insecure parent via an attacker-controlled NSEC record, and CVE-2026-50106 allows possible insecure NXDOMAIN responses for non-existing records under the same conditions. CVE-2026-96405 is a denial of service from aggregate DNS name chained pointer decompression work, and CVE-2026-97206 is a use-after-free on multi-threaded deployments triggered by DNS-over-QUIC path migration. CVE-2026-109125 is a possible cache poisoning issue via a cache side-channel exposed by 'unwanted-reply-threshold'. Fixed version for Debian trixie is 1.26.2-0+deb13u1. Attack vector details beyond those descriptions, CVSS scores, workarounds, and detection guidance are not stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: NLnet Labs Unbound Summarized from lists.debian.org/debian-security-announce/2026/msg00497.html ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||