UN
Product
Unbound
55
CVEs
0
On KEV
10.0
Max CVSS
5
New 30D
Severity mix
Critical 5High 14Medium 27Low 9
Watch
Add Unbound to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-46582 | 3.7 | Jul 22 | A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path Affected: 1.6.0 before 1.25.2 |
| CVE-2026-44687 | 3.7 | Jul 22 | Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN Affected: 1.13.2 before 1.25.2 |
| CVE-2026-42955 | 3.7 | Jul 22 | Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records Affected: 1.16.2 before 1.25.2 |
| CVE-2026-41637 | 3.7 | Jul 22 | Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries Affected: 1.22.0 before 1.25.2 |
| CVE-2026-55708 | 3.1 | Jul 22 | Privacy/configuration issue when adding local data in views through 'unbound-control' Affected: 1.6.0 before 1.25.2 |