Findings

SUSE-SU-2026:24135-1

Security update for unbound

Published Oct 9, 2026 · updated Oct 15, 2026

This update for unbound fixes the following issues: - CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' (bsc#1280403). - CVE-2026-77955: Possible ZONEMD verification bypass window (bsc#1280404). - CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission (bsc#1280405). - CVE-2026-80225: Possible degradation of service from continuous queries on the same TCP/DoT connection (bsc#1280406). - CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization (bsc#1280409). - CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (bsc#1280411). - CVE-2026-82717: CNAME synthesis could lead to heap corruption (bsc#1280412). - CVE-2026-82720: Use-after-free in DoH stream cleanup code path (bsc#1280413). - CVE-2026-85501: Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC (bsc#1280414). Changes for unbound: - Update to 1.26.1: * Update icannbundle.pem certificates in unbound-anchor, valid for 2009-2029 and 2025-2045 * Add max-transfer-size and max-transfer-time options to limit auth-zone and rpz transfer size and time, default disabled * Overload local_data_remove in unbound-control to also remove specific records * Add local-zone types block_aaaa, block_a_wdata and block_aaaa_wdata; fix respip+dns64 to use original A records instead of ones already modified by respip * ipsecmod hook script now needs to start with '#!/bin/sh', it is executed with execv instead of system for security * Server now continues to start if a secondary zone fails to load from its zonefile, or if a primary zonefile is missing; $INCLUDE is no longer allowed in secondary zone zonefiles * Auth-zone and RPZ zones now drop out-of-zone content on load * Primary hostname for zone transfers can now use CNAME(s) * Fix windows 64bit build for libssp dependency * Update IANA portlist * Fix heap out-of-bounds write via size_t-to-int truncation in setup_if()/outside_network_create() for large nu