Unbound 1.26.1 released

Unbound
1

Hi,

Unbound 1.26.1 is available:

https://nlnetlabs.nl/downloads/unbound/unbound-1.26.1.tar.gz

sha256 35a6dc0e425a9282c3426d9a3043144011bf0534aed4b73ab62c52aee0af1503
pgp https://nlnetlabs.nl/downloads/unbound/unbound-1.26.1.tar.gz.asc

This release has a number of security fixes.

The release is signed with the OpenPGP software signing key that is
in use since Jan 1st 2026:

User ID: NLnet Labs releases signing key G2 <releases@nlnetlabs.nl>
Key ID: A144 323D EAAC DF45
Fingerprint: 2310 1869 0C4D 903E F419  146A A144 323D EAAC DF45

The key is available from NLnet Labs - Software Signing Keys .

This release consolidates security fixes for issues reported over
a period of time. There are fixes for CVE-2026-77860, CVE-2026-77955,
CVE-2026-78227, CVE-2026-80225, CVE-2026-81634, CVE-2026-81642,
CVE-2026-82717, CVE-2026-82720 and CVE-2026-85501.

Bug Fixes

  • Fix CVE-2026-81642, Heap buffer overflow and possible Remote Code
    Execution when digesting DNSKEY. Thanks to Yuqi Qiu and Xiang Li
    from Nankai University, AOSP Lab for the report.
  • Fix CVE-2026-81634, Possible heap buffer overflow during DNSSEC
    canonicalization. Thanks to Vlatko Kosturjak with Marlink Cyber,
    for the report.
  • Fix CVE-2026-82717, CNAME synthesis could lead to heap corruption.
    Thanks to Ben Morris from Anthropic for the report.
  • Fix CVE-2026-77955, Possible ZONEMD verification bypass window.
    Thanks to Yuqi Qiu and Xiang Li from Nankai University, AOSP Lab,
    for the report. In addition, thanks to Qifan Zhang from Palo Alto
    Networks for also reporting this issue.
  • Fix CVE-2026-78227, Use-after-free in DoQ stream output buffer on
    reset re-transmission. Thanks to Yuqi Qiu and Xiang Li from Nankai
    University, AOSP Lab for the report.
  • Fix CVE-2026-80225, Possible degradation of service from continuous
    queries on the same TCP/DoT connection. Thanks to Qifan Zhang from
    Palo Alto Networks for the report.
  • Fix CVE-2026-82720, Use-after-free in DoH stream cleanup code path.
    Thanks to Yuqi Qiu and Xiang Li from Nankai University, AOSP Lab,
    for the report.
  • Fix CVE-2026-85501, Retrap: Novel Vulnerabilities to launch
    Algorithmic Complexity Attacks on DNSSEC. Thanks to Zuyao Xu and
    Xiang Li from Nankai University, AOSP Lab for the report. In
    addition, thanks to Qifan Zhang from Palo Alto Networks for a
    complimentary report.
  • Fix CVE-2026-77860, ‘serve-expired’ can bypass Unbound ‘wait-limit’.
    Thanks to Xuanchao Xie, Lutong Chen, and Kaiping Xue from the
    University of Science and Technology of China (USTC) for the
    report.