UN
Product
Unbound
54
CVEs
0
On KEV
10.0
Max CVSS
5
New 30D
Severity mix
Critical 5High 13Medium 27Low 9
Watch
Add Unbound to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-5994 | 8.7 | Jul 16 | Cache poisoning via the ECS-enabled Rebirthday Attack Affected: 1.6.2 before 1.23.0 |
| CVE-2026-97206 | 7.5 | Oct 21 | DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments. Affected: 1.22.0 before 1.26.2 |
| CVE-2026-85501 | 7.5 | Sep 16 | Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC Affected: before 1.26.1 |
| CVE-2026-81634 | 7.5 | Sep 16 | Possible heap buffer overflow during DNSSEC canonicalization Affected: before 1.26.1 |
| CVE-2026-80225 | 7.5 | Sep 16 | Possible degradation of service from continuous queries on the same TCP/DoT connection Affected: before 1.26.1 |
| CVE-2026-55973 | 7.5 | Jul 22 | 'dns-error-reporting: yes' leads to stack buffer overflow Affected: 1.23.0 before 1.25.2 |
| CVE-2026-44690 | 7.5 | Jul 22 | Cross-zone wildcard cache poisoning via RRSIG.labels manipulation Affected: 1.7.0 before 1.25.2 |
| CVE-2026-40691 | 7.5 | Jul 22 | Packet of death for DNSCrypt over TCP Affected: 1.9.0 before 1.25.2 |
| CVE-2026-32665 | 7.5 | Jul 22 | Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass Affected: 1.22.0 before 1.25.2 |
| CVE-2026-42959 | 7.5 | May 20 | Crash during DNSSEC validation of malicious content Affected: before 1.25.1 |
| CVE-2026-42944 | 7.5 | May 20 | Heap overflow with multiple NSID, COOKIE, PADDING EDNS options Affected: 1.14.0 before 1.25.1 |
| CVE-2026-41292 | 7.5 | May 20 | Long list of incoming EDNS options degrades performance Affected: before 1.25.1 |
| CVE-2026-40622 | 7.5 | May 20 | Another 'ghost domain names' attack variant Affected: 1.16.2 before 1.25.1 |
Showing 13