MGASA-2026-0571: Updated unbound package fixes security vulnerabilities
Bypass of a configured island trust anchor underneath an insecure parent from an attacker-controlled NSEC record. Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent. Aggregate DNS name chained pointer decompression work leads to degradation of service. DNS-over-QUIC path-migration can lead to use-after-free on multi-threaded deployments. Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'.
Affected Software
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which deployments are exposed to the use-after-free issue?
The use-after-free condition is associated with DNS-over-QUIC path migration in multi-threaded deployments. Deployments that do not use DNS-over-QUIC path migration or are not multi-threaded are not identified as affected by this specific issue.
What configuration makes the insecure NXDOMAIN behavior relevant?
It is relevant where a configured island trust anchor exists beneath an insecure parent. In that arrangement, an attacker-controlled NSEC record may enable an insecure NXDOMAIN response for names that do not exist below the trust anchor.
What should administrators review when assessing cache-poisoning exposure?
Review whether the 'unwanted-reply-threshold' setting is in use, since the advisory identifies a cache side channel exposed through that setting. Also assess whether the resolver configuration uses the affected trust-anchor arrangement or DNS-over-QUIC in a multi-threaded deployment.