Loading story…
NLnet Labs released Unbound 1.25.2 as a security update to address multiple vulnerabilities in the Unbound DNS resolver, according to an advisory published on the oss-sec mailing list. The fixes cover a broad set of issues across high-, medium-, and low-severity CVEs, including denial-of-service conditions affecting DNS-over-QUIC and DNSCrypt, cache-poisoning risks, memory corruption, buffer overflows, assertion failures, and bugs that could degrade resolver availability.
The advisory says several flaws are tied to specific Unbound features and configurations, including dns-error-reporting, response-ip/rpz, serve-expired-client-timeout, discard-timeout, and unwanted-reply-threshold. NLnet Labs also addressed problems involving libngtcp2 behavior under DNS-over-QUIC conditions and added hardening related to an earlier fix for CVE-2026-40622, making the release a significant security update for operators running exposed or feature-rich Unbound deployments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
On July 22, 2026, NLnet Labs announced Unbound 1.25.2 as a security release addressing multiple vulnerabilities in the Unbound DNS resolver. The fixes cover issues including denial of service, cache poisoning risk, memory corruption, buffer overflows, assertion failures, service degradation bugs, and additional hardening related to a prior CVE-2026-40622 fix.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
community.nlnetlabs.nl
Open sourceseclists.org
Open sourcegithub.com
Open sourcenlnetlabs.nl
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
NLnet Labs has addressed multiple vulnerabilities in the **Unbound** DNS resolver, including **`CVE-2026-33278`**, a high-severity flaw in the DNSSEC validator that can cause denial of service and potentially **remote code execution**. The bug affects Unbound versions **`1.19.1` through `1.25.0`** and stems from a deep-copy error that overwrites a destination pointer, later triggering a dangling-pointer dereference. The issue is tracked under **`CWE-416`** and **`CWE-672`** and carries high potential impact to confidentiality, integrity, and availability. Exploitation requires an attacker to control a malicious signed DNS zone and induce a vulnerable Unbound instance to query it while a **DS sub-query** is suspended because of **NSEC3 computational budget exhaustion**. Belgium's Centre for Cybersecurity warned that the Unbound vulnerabilities could enable denial-of-service and urged organizations to patch immediately. The vendor has fixed the issue in **Unbound `1.25.1`**, making upgrade a priority for operators using affected resolver versions.
Jun 29, 2026
A remotely triggerable heap buffer overflow in **Knot Resolver 6.3.0** allows unauthenticated remote code execution through the `kresd` DNS-over-QUIC listener. The flaw stems from incorrect size tracking during inbound QUIC `STREAM` frame reassembly, causing a later `memcpy()` to write past an allocated heap buffer. Public reporting said a single QUIC connection carrying six crafted `STREAM` frames can produce a controlled out-of-bounds write and, with heap grooming, overwrite a `libgnutls` cleanup handler to seize control of a function pointer and argument. Researchers classified the issue as **`CWE-787`** and demonstrated end-to-end RCE in a Debian 12 lab environment with ASLR disabled; failed attempts can also crash worker processes and cause denial of service. CZ.NIC fixed the vulnerability in **Knot Resolver 6.4.1**, and full technical details plus working proof-of-concept exploit code were disclosed publicly shortly after the patch release. No in-the-wild exploitation has been confirmed, but the exposure is significant because Knot Resolver is deployed by major ISPs and handles untrusted network traffic, raising the risk of resolver compromise and forged DNS responses for downstream users. Organizations are being urged to upgrade to **6.4.1** immediately; if patching cannot be completed at once, defenders should disable DNS-over-QUIC, restrict access to the DoQ service, and monitor for repeated `kresd` worker crashes that could indicate exploitation attempts.
Jul 26, 2026
Internet Systems Consortium disclosed **nine vulnerabilities** in **BIND 9** and released patched versions **9.20.26** and **9.21.24**. The most severe issue, **`CVE-2026-13321`** (CVSS **8.6**), allows a remotely exploitable **DNSSEC validation bypass** by accepting signed **NSEC** records whose `Next Domain Name` points outside the signer’s zone, enabling cross-zone cache poisoning with authenticated denial responses. ISC also disclosed **`CVE-2026-11721`**, a high-severity **cache poisoning** flaw tied to label-count discrepancies in **RRSIG** and wildcard synthesis, and **`CVE-2026-10723`**, which can let attackers forge authenticated **NXDOMAIN** responses for sibling zones through incorrect acceptance of child-zone **NSEC3** records. ISC said no active exploitation was known at disclosure time and reported no workaround for the affected releases. The remaining flaws include several remotely exploitable **denial-of-service** and **resource exhaustion** bugs affecting DNSSEC-validating resolvers and other BIND components. **`CVE-2026-11622`** can drive memory consumption far beyond configured limits during random-subdomain attacks against DNSSEC-signed zones, while **`CVE-2026-11605`** can force excessive CPU use by making BIND validate unnecessary but valid **RRSIG** records. **`CVE-2026-13204`**, **`CVE-2026-12617`**, and **`CVE-2026-10822`** can cause **`named`** to exit unexpectedly under specific malformed or specially ordered DNS responses, and **`CVE-2026-11331`** can bypass wildcard **RPZ CNAME** policies and also trigger a crash with overly long query names. ISC advised users of affected **9.11**, **9.18**, **9.20**, **9.21**, and Supported Preview Edition branches to upgrade to the nearest patched supported release.
Jul 23, 2026