Skip to content
← All tracked CVEs

Updated 18:00

last 30 days

910 fixed within SLA

CVEStatusSeveritySummaryReleaseClock startedDeadlineFixedTime to fix
Fixed within SLAMediumUnbound DoT TLS handshake use-after-free leads to daemon crash (1.15.0–1.25.1)secure-packages-26.05Jul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLAMediumUnbound 1.22–1.25.1 upstream packets per query exceed max-global-quota for deep DNSSEC namessecure-packages-26.05Jul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLALowDNSSEC wildcard replay cache poisoning in Unbound 1.6.0–1.25.1 serve-expired pathsecure-packages-26.05Jul 27, 2026Oct 25, 2026Jul 29, 20262 days
Fixed within SLAHighUnbound 1.7.0–1.25.1 RRSIG.Labels validation bug enables NSEC sibling zone cache poisoningsecure-packages-26.05Jul 27, 2026Aug 11, 2026Jul 29, 20262 days
Fixed within SLALowUnbound 1.13.2–1.25.1 harden-below-nxdomain off-by-one returns parent NXDOMAIN, shadowing stub/forward zonessecure-packages-26.05Jul 27, 2026Oct 25, 2026Jul 29, 20262 days
Fixed within SLAMediumlibunbound <=1.25.1 aborts when unwanted-reply-threshold invokes disallowed libworker_alloc_cleanupsecure-packages-26.05Jul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLALowUnbound 1.16.2–1.25.1 A/AAAA glue bug extends ghost-domain window; CVE-2026-40622 variantsecure-packages-26.05Jul 27, 2026Oct 25, 2026Jul 29, 20262 days
Fixed within SLALowUnbound 1.22–1.25.1 DoQ termination misaccounting inflates waiters, causing silent query dropssecure-packages-26.05Jul 27, 2026Oct 25, 2026Jul 29, 20262 days
Fixed within SLAHighUnbound 1.9.0–1.25.1 DNSCrypt TCP path overflow causes heap corruption and DoSsecure-packages-26.05Jul 27, 2026Aug 11, 2026Jul 29, 20262 days
Fixed within SLAHighUnbound downstream DoQ initial streams bypass quic-size, causing remote memory-accounting DoS (v1.22–1.25.1)secure-packages-26.05Jul 27, 2026Aug 11, 2026Jul 29, 20262 days