Unbound 1.26.0rc1 pre-release

Wouter · July 28, 2026, 7:40am

Hi,

Unbound 1.26.0rc1 pre-release is available:

https://nlnetlabs.nl/downloads/unbound/unbound-1.26.0rc1.tar.gz

sha256 f576991598a65ff4a645bd7c1faa0f8814652746eb0c3387588a899e168fb918
pgp https://nlnetlabs.nl/downloads/unbound/unbound-1.26.0rc1.tar.gz.asc

This release has some features and a number of bug fixes.

The release is signed with the OpenPGP software signing key that is
in use since Jan 1st 2026:

User ID: NLnet Labs releases signing key G2 <releases@nlnetlabs.nl>
Key ID: A144 323D EAAC DF45
Fingerprint: 2310 1869 0C4D 903E F419  146A A144 323D EAAC DF45

The key is available from NLnet Labs - Software Signing Keys .

The certificates for the root key are updated. The icannbundle.pem
file is updated with the public keys for 2009 to 2029 and for 2025
to 2045. This is available in the unbound-anchor tool. With the
-l option unbound-anchor lists the builtin key and cert that it
has. The updated certificates are valid for a longer time. With
-c the icannbundle.pem file can be given from the commandline.
Then unbound-anchor does not use the builtin certificates. And
this allows the update of the certificate file without a change
in unbound-anchor.

The ipsecmod module is changed, that the script, for the hook, has
to start with a line like #!/bin/sh. The file is executed with
execv, and not any longer with system, so that it is better for
security. It is an in-depth protection against possible quotation
and buffer failures.

The server continues to start if secondary zones, for auth zones,
fail to load from zonefile. To protects against malformed content
in the zonefiles, and the server continues to serve, and attempt
to fetch new updates for the zone. Also for primary auth zones, if
the zonefile does not exist, the server continues to start up. This
makes the server start more easily. Secondary zones are no longer
allowed to have a $INCLUDE in the zonefile. That is for safety,
for what file is chosen. The server drops out-of-zone content from
auth zones when they are read, those records are not supposed to be
part of the auth zone. The primary hostname that is transferred from,
can now be a name that uses CNAME(s).

The options max-transfer-size and max-transfer-time can be used
to limit the amount of size and time that auth-zone transfers use. The
default is disabled, that is backwards compatible.

The unbound-control command local_data_remove is overloaded to also
work to be able to remove specific records. Specify the record with
its details to remove it.

Apart from the local-zone type block_a, that denies A lookups,
there is now also block_aaaa, it denies AAAA lookups. The local zone
types block_a_wdata and block_aaaa_wdata can be used to also have
local-data, that is served, if it is not there, like transparent, it
lookups recursively, or denies the particular type from lookup. These
are helpful in IPv4 with IPv6 deployment situations, as it forces
applications to not use a particular transport. With the changes to
respip and RPZ processing that make the filters apply equally after
dns64, so that dns64 does not bypass the filter, the new local-zone
types can be used to apply denial of a particular transport.

Features

Update icannbundle.pem certificates in unbound-anchor. It
has the public keys for 2009 to 2029 and for 2025 to 2045.
Fix to add max-transfer-size and max-transfer-time that
limit auth-zone and rpz transfer amount and time taken.
Default is disabled. This hardens against unbounded
transfers. Thanks to Qifan Zhang, Palo Alto Networks,
for the report.
Merge #1087: Overload local_data_remove to support removing
specific records.
Merge #1433 from jisakiel: Add new static zone type
block_aaaa to suppress AAAA queries.
Fix #1477: respip + dns64: dns64 uses A records modified by
respip instead of original A records. Adds local-zone types
block_a_wdata and block_aaaa_wdata, that are like block_a
and block_aaaa, and uses local-data if present.

Bug Fixes

Fix windows 64bit build for libssp dependency.
iana portlist updated.
Fix for Heap Out-of-Bounds Write via size_t-to-int Truncation
in setup_if() - outside_network_create(). This fixes that
large values for num_ports do not overflow and create
invalid references after integer truncation. Thanks
to Ka@karnakarreddinakar Reddy (@karnakarreddi) for the report.
Fix to clean up log ids after a failure to start a worker thread.
Fix to relax assertions after the TTL 0 handling change.
This relaxes an assertion in cachedb (it fails instead),
and for packet_rrset_copy_region.
Fix comment and verbose logging for EDNS fallback buffer size.
Fix man page entry for so-sndbuf, it is for responses sent out.
Fix val_find_DS for robustness, to check the result of
packet_rrset_copy_region before using it. Thanks to Xin Wang
and Jiajia Liu, Northwestern Polytechnical University, for
the report.
Fix that for dns64 answers, the AAAA query is checked to be
DNSSEC validated, when DNSSEC is enabled. This improves
the RFC6147 conformance of Unbound. Thanks to Xin Wang
and Jiajia Liu, Northwestern Polytechnical University, for
the report. In addition, thanks to Qifan Zhang, Palo Alto
Networks, for reporting it.
Fix for allocation-failure hardening of rrset cache wildcard
storage and canonical NSEC owner replacement. Thanks to Xin
Wang and Jiajia Liu, Northwestern Polytechnical University,
for the report.
Fix DNSSEC validation with libnettle for noncanonical RSA
DNSKEYs with leading zeroes for n. Thanks to Xin Wang and
Jiajia Liu, Northwestern Polytechnical University, for
the report.
Fix DNSKEY size calculation for noncanonical RSA DNSKEYs
with leading zeroes for n. Thanks to Xin Wang and Jiajia Liu,
Northwestern Polytechnical University, for the report.
Fix for mixed class referrals, the resolver uses the query
class. Thanks to Xin Wang and Jiajia Liu, Northwestern
Polytechnical University, for the report.
Unit test for CVE-2026-33278.
Unit test for CVE-2026-42944.
Unit test for CVE-2026-42959.
Unit test for CVE-2026-40622.
Unit test for CVE-2026-42960.
Fix in depth for serve-expired responses from cachedb, that it
does not store bogus. Thanks to Qifan Zhang, Palo Alto Networks,
for the report.
Fix lame server detection, for selfpointed glue records.
Thanks to Shuhan Zhang, Dan Li, and Baojun Liu from Tsinghua
University for the report.
Fix cleaning up DoH session. The same query can be on multiple
streams in a session. Thanks to Qifan Zhang, Palo Alto Networks,
for the report.
Fix for signed same-owner CNAME and ordinary RRset responses.
Thanks to Xin Wang and Jiajia Liu, Northwestern Polytechnical
University, for the report.
Fix for mesh new client and mesh new callback to rollback the
added address, tcp mesh state and callback when there is a failure
to initialize. This fixes the mesh accounting of reply addresses.
Thanks to Xin Wang, Jiapeng Li, and Jiajia Liu, Northwestern
Polytechnical University, for the report
Fix for autotrust state-file line overflow, that can give
hold-down bypass. Thanks to Qifan Zhang, Palo Alto Networks,
for the report.
Fix to limit the DSNS per-label walk in the iterator. Thanks
to Qifan Zhang, Palo Alto Networks, for the report.
Fix that the ratelimit is decremented on successful
referrals. Thanks to Qifan Zhang, Palo Alto Networks, for
the report.
Fix that msgencode insert_query has the correct assertion,
for a local_alias. Thanks to Qifan Zhang, Palo Alto Networks,
for the report.
Fix to reset the tcp-timeout before applying a load based
reduction. Thanks to Qifan Zhang, Palo Alto Networks, for the
report.
Fix to decrement the per-netblock tcp connection limits, so
it keeps usable. Thanks to Qifan Zhang, Palo Alto Networks,
for the report.
Fix manual to document ratelimit, that it is for target
nameservers for a domain, and keeps queries limited. Thanks
to Qifan Zhang, Palo Alto Networks, for the report.
Fix, in depth, for respip rewrite of dns64 responses. Thanks
to Qifan Zhang, Palo Alto Networks, for the report.
Fix that dns64 with subnetcache does not write ECS scoped
answers to global cache. Thanks to Qifan Zhang, Palo Alto
Networks, for the report.
Fix ipset module for name too long checks, race conditions
on local name buffer, and for socket close race condition.
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix that validator caps number of ANY RRsets it can
validate, and the wait timer is shortened. Thanks to Qifan
Zhang, Palo Alto Networks, for the report.
Fix analyzer warning in mesh_new_client.
Fix #1457: race condition causes segfault when starting
threads.
Fix header_seen detection for trust anchor files, so that it
detects the id line.
Fix unit test to check for new icannbundle.pem.
Fix const as reported by newest compiler warnings.
Fix that the processing of class responses does not have
a heap use-after-free. That could happen if at least two
distinct classes are configured for resolution. Thanks
to Qifan Zhang, Palo Alto Networks for the report.
In addition, thanks to Xin Wang, Jiapeng Li, and Jiajia
Liu, Northwestern Polytechnical University, for also
reporting this.
Fix negative cache to work with NSEC3 records without salt.
Thanks to Xin Wang, Jiapeng Li, and Jiajia Liu, Northwestern
Polytechnical University, for the report.
Fix parse of svcbparam ech, it had incorrect length. Thanks
to Qifan Zhang, Palo Alto Networks for the report.
Fix that quotation and escaping works the same in auth-zone
url content, as in the zonefile read. Thanks to Qifan Zhang,
Palo Alto Networks for the report.
Fix ipset module to use larger domain name buffers, and
check buffer lengths. Thanks to Qifan Zhang, Palo Alto
Networks for the report.
Fix PROXYv2 header read and consume, it checks the header
size. Thanks to Qifan Zhang, Palo Alto Networks for
the report.
Fix negative cache NSEC3 nodata proof, to use the correct
message size. Thanks to Qifan Zhang, Palo Alto Networks,
for the report.
Fix fast_reload for when a ZONEMD lookup is in progress.
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix that validation canonicalization of domain names
in rdata checks for buffer bounds. Thanks to Qifan Zhang,
Palo Alto Networks, for the report.
Fix that dump_cache has a larger buffer for records,
and it checks that an owner name does not collide with BADRR
on the input, and changes verbosity on the log of failure in
rrset to string. Thanks to Qifan Zhang, Palo Alto Networks,
for the report.
Fix that dns64 cleans up the allocated message if the adjust
routines fail, and checks if there is a reply before cache
store, also unbound checks if A and AAAA are malformed
for auth-zones. Thanks to Qifan Zhang, Palo Alto Networks,
for the report.
Fix unit test for ecs to check for malloc success.
Fix pythonmod script read for numeric overflow.
Fix warnings with gcc in compat/inet_pton.c.
Fix for #1306: configure detects specifically the call to
SSL_set_quic_tls_early_data_enabled and
SSL_set_quic_early_data_enabled, so the correct one is used.
Fix for #1306: configure checks if the ngtcp2_crypto_ossl
header file is available, and prints an error otherwise.
Fix #1437: Fix compile with OpenSSL 4.0.1.
Fix compile for OpenSSL 1.0.2 and before in server cleanup.
Fix that for auth-zone and rpz zones the allow-notify
addresses and netblocks are available from start, and
fix the probe step skip.
Fix perform a full transfer every number of incremental
transfers, to stop increasing memory usage, for rpz
zones. Thanks to Qifan Zhang, Palo Alto Networks, for
the report.
Fix assertion failure for long HTTP header that fills
buffer. Thanks to Qifan Zhang, Palo Alto Networks, for
the report.
Fix buffer overflow when configured with lower than
default size and http transfer. Thanks to Qifan Zhang,
Palo Alto Networks, for the report.
Fix that misconfigured iter-scrub-ns: 0 causes request
failures. Thanks to Qifan Zhang, Palo Alto Networks,
for the report.
Fix that fast_reload when a zonemd verification lookup
it in progress with subnet loaded, deregisters the
callback. Thanks to Qifan Zhang, Palo Alto Networks,
for the report.
Fix for fast_reload that removes an auth zone while its
lookups are in progress, for a primary name. Also after the
change, it no longer picks up the old results. Thanks to
Qifan Zhang, Palo Alto Networks, for the report.
Fix integer overflow in infra-cache-max-rtt calculation.
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix erroneous DNS error report values after bogus AAAA
query caused error information that was not cleared by
a successful A subquery. Thanks to Qifan Zhang, Palo Alto
Networks, for the report.
Fix integer overflow for very high values of
sock-queue-timeout. Thanks to Qifan Zhang, Palo Alto
Networks, for the report.
Fix that fast_reload does not terminate the server for
errors in config, for key files. Thanks to Qifan Zhang,
Palo Alto Networks, for the report.
Fix log of an aliased qname, to not use freed region
memory. Thanks to Qifan Zhang, Palo Alto Networks, for
the report.
Fix DNAME synthesis from cache that keeps use of 0TTL
entries in a sliding window. It did not surpass RRSIG
expiry. Thanks to Qifan Zhang, Palo Alto Networks, for
the report.
Fix misconfigured ipsecmod hook causing path name
similarity with other file. The ipsecmod is changed for
exec of the hook. The ipsecmod hook, if a script, has to
start now with a line like #!/bin/sh. Thanks to Qifan
Zhang, Palo Alto Networks, for the report.
Fix that dns64 bypasses rpz-passthru rule during
synthesis. This restricted more than necessary. Thanks to
Qifan Zhang, Palo Alto Networks, for the report.
Fix to disallow $INCLUDE for secondary zones. Start up
of server continues if a secondary zone fails to load.
Failed loads clear the zone data, so there is no partial
zone. Thanks to Qifan Zhang, Palo Alto Networks, for
the report.
Fix that when SVCB records cannot be written out, and
are written in unknown format, that the zone read allows
such unknown format SVCB records. Thanks to Qifan Zhang,
Palo Alto Networks, for the report.
Fix that a half-written trust anchor file does not crash
the server at runtime. It unlinks a wrong file from the list.
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix that auth-zone, and RPZ zones, do not allow out-of-zone
records. These are records that are not under the zone apex.
The out-of-zone records are dropped from the zone contents.
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix that dns64 does not ignore the forward-no-cache and
stub-no-cache options. Thanks to Qifan Zhang, Palo Alto
Networks, for the report.
Fix that a signed wildcard NSEC, is checked before use,
so it does not allow insecure DS proofs inappropriately.
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix that after malloc failure a half-built local_alias does
not crash the server. Thanks to Qifan Zhang, Palo Alto
Networks, for the report.
Fix that for a zonefile only zone, if that file does not
exist on server start, the server continues to start with
a warning log message. Thanks to Qifan Zhang, Palo Alto
Networks, for the report.
Fix that after malloc failure in RPZ load a half built
list does not crash later. The newly created RRset is
linked after creation has succeeded. Thanks to Qifan Zhang,
Palo Alto Networks, for the report.
Fix that dnscrypt configuration does not crash, due to
inconsistency between secret and public keys. Also
duplicate files are skipped. Thanks to Qifan Zhang, Palo
Alto Networks, for the report.
Fix locking in libunbound ub_ctx_set_event call.
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix that libunbound pipe functions fail with error after
an event base is set. Thanks to Qifan Zhang, Palo Alto
Networks, for the report.
Fix for neater solution to clear log thread id after
worker init failure. Thanks to Qifan Zhang, Palo Alto
Networks, for the report.
Fix incorrect cleanup after an allocation failure for
a delegation point. Thanks to Qifan Zhang, Palo Alto
Networks, for the report.
Fix that after malloc failure in find_tag_datas, the
local_alias is cleaned up. Thanks to Qifan Zhang, Palo
Alto Networks, for the report.
Fix that after shared memory cannot be created, from
shm-enable, the server does not crash. Thanks to Qifan
Zhang, Palo Alto Networks, for the report.
Fix incorrect cleanup after an allocation failure for
a delegation point in a region. Thanks to Qifan Zhang,
Palo Alto Networks, for the report.
Fix after malloc failure the rrset_insert_rr in
localzone processing, during RPZ qname trigger processing,
the RRset retains its previous data correcly. Thanks to
Qifan Zhang, Palo Alto Networks, for the report.
Fix for #1462: Fix that auth primary host name lookup
allows CNAMEs.
Fix memory leak on DNAME 0TTL records.
Fix that after fast_reload the disown of the auth zone
transfer task cleans the chunk list. Also fix the
auth_transfer_limit test to use a forwarder for each type
of failure, so the one is not blocked by the other waiting.
Fix to remove debug from auth_transfer_limit test.
Fix that unbound-checkconf checks if an auth-zone download
can overwrite another file, by filename collision.
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix that malloc failure in auth-zone insert rr does
not create an empty node and does not cause an infinite
loop. Thanks to Qifan Zhang, Palo Alto Networks, for
the report.
Fix that unbound-control auth_zone_reload stops the
server answering from the zone after a failure to read.
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix that malloc failure in dns64_inform_super does
not set up a half-built reply for cache store, that could
lead to a crash. Thanks to Qifan Zhang, Palo Alto Networks,
for the report.
Fix that malloc failure for new_local_rrset for RPZ qname
trigger RR insert does not crash. It does not link a
partial RRset, and logs an error on failure, and cleans
up the dname allocation. Thanks to Qifan Zhang, Palo Alto
Networks, for the report.
Fix that malloc failure in doq connection setup, does
not crash in doq connection delete later. Thanks to Qifan
Zhang, Palo Alto Networks, for the report.
Fix that malloc failure for ngtcp2_conn_server_new
cleans up reference that older ngtcp2 versions can leave.
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix that on malloc failure during accept of TCP, the
socket is not left to cause a read event loop. It uses
slow-accept to delay accepting new connections, if
that fails it drops the new connections. When the tcp
connection usage is full, it waits for 50msec, to allow
existing queries to be resolved. Thanks to Qifan Zhang,
Palo Alto Networks, for the report.
Fix that malloc failure for rpz_strip_nsdname is
checked and handled, so that it does not crash later.
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix that malloc failure during edns subnet addrtree
insert is checked, so it does not crash later. Thanks to
Qifan Zhang, Palo Alto Networks, for the report.
Fix to check the return value of auth_xfer_create
during fast_reload auth-zone add and change processing.
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix to check for malloc failure in rpz response create,
for nodata and nxdomain, so it does not crash later.
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix that fast_reload does not terminate the server
on malloc failure for dnstap, or if gethostname fails.
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix after malloc failure for stats, then it drains the pipe
so the internal messaging stays correct. Also it does
not exit the server if stats pipe communication fails.
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix that fast_reload does not terminate the server
on config read failure after malloc failure. Thanks to
Qifan Zhang, Palo Alto Networks, for the report.
Fix that fast_reload does not terminate the server if
random init for DNS cookies fails. The data is only random
generated if cookies are enabled, and the random data
is necessary. Thanks to Qifan Zhang, Palo Alto Networks,
for the report.
Fix for #1457: fix thread setname for thread start of
dnstap, and fast_reload.
Fix to update github ci actions/checkout to v7.
Fix warning about file_string_matches in unbound-checkconf.
Merge #1465 from dag-erling: Add libunbound/remote.h. Add
a shared header containing prototypes for functions that
both ends of a remote control connection need to implement.
Merge #1467: daemon: fix DEREF_AFTER_NULL.EX.COND on
worker_init. This fixes error handling if the worker
stat_timer allocation has an out of memory error. That
makes the server not crash later, attempting to use it.
Fix #1469: dohclient: DoH POST missing content-length → :status
400 from strict resolvers (Cloudflare, Mullvad).
Merge #1383 from jdek: Fix randomness generation on
macOS/iOS under chroot.
Fix unit test for malformed svcb for test on Windows.
Merge #1475 from petrvaganoff: ipsecmod: fix deref on null
in ipsecmod-whitelist after OOM.
Fix #1474: DoQ responses are never padded - pad-responses
does not apply to comm_doq (RFC 9250 §5.4 MUST).
Merge #1476 from petrvaganoff: ipsecmod: fix possible deref
on null after reply_find_answer_rrset().
Unit test for CVE-2026-42955.
Unit test for CVE-2026-44687.
Unit test for CVE-2026-44690.
Unit test for CVE-2026-46582.
Unit test for CVE-2026-50045.
Unit test for CVE-2026-50243.
Unit test for CVE-2026-50248.
Unit test for CVE-2026-55717.
Unit test for CVE-2026-55973.
Unit test for CVE-2026-56416.
Fix error in log printout in fix for CVE-2026-50248, when the
primary name is bogus.
Updated credits for Xuanchao Xie in 22 july changelog.
Merge #1478 from petrvaganoff: pythonmod: add check return
value after ftell().
Fix that for NSEC3 proofs the NSEC3 zone, as the b32.name is
checked to be the same as the signer name. Also RRSIGs are
not considered valid when an NSEC3 is not b32.signerzone.
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix that the aggressive negative cache does not insert NSEC
records with overreaching next owner name. Also the result
is not above the trust anchor’s bailiwick. Also RRSIGS are
not considered valid when an NSEC next owner name is not
under the signer zone name. Thanks to Qifan Zhang, Palo
Alto Networks, for the report.
Fix mesh cycle detection for configuration with respip CNAME
loop and tagged clients. Thanks to Qifan Zhang, Palo Alto
Networks, for the report.
Unit test for block_a and block_aaaa.
Fix to allow test fake sha1 on systems with possible sha1
support.
Fix to use sha256 for unbound-anchor unit test.
Fix unbound-anchor check for return value of
X509_NAME_get_text_by_NID of the emailaddress.
Fix lock test protect for auth zone change.
Fix to lock shared_ports structure during initialisation.
Fix to lock anchor structure when file is set for it in
parse of the header.
Merge #1480 from petrvaganoff: authzone: fix memory leak in
xfer_set_masters() error path.
Fix unused variable warnings in shared_ports_fetch_random
and shared_ports_return_port when compiled without threads.
Fix to guard access to shared ports interface array during
set up, for analyzer.
Fix sign of comparison warning in shared ports setup.
Fix #1481: Fix to use tls-port after referral if
tls-upstream is set.
Merge #1479 from psumbera: Fix pthread detection on
Solaris 11.4.
Fix to call OPENSSL_cleanup on exit when that is defined.