Linux · SUSE Linux Enterprise · Security advisory · August 31, 2026
SUSE-SU-2026:3885-1: unbound security update
SUSE-SU-2026:3885-1, released August 31, 2026, fixes 17 CVEs in unbound (version 1.25.2-150600.23.19.1). None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
17
None rated Critical
Exploited
0
None reported
Highest CVSS
9.3
Base score, 0 to 10
Highest EPSS
0.0037
30th percentile
Priority of the 17 CVEs
Patch now 0
Urgent 0
High 4
Routine 13
Fixed package versions
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| High | CVE-2026-40691 | Packet of death for DNSCrypt over TCP | 7.5 | 0.0029 | None reported |
| High | CVE-2026-50252 | Possible cache poisoning attack by mapping source port population per thread | 9.3 | 0.0017 | None reported |
| High | CVE-2026-44690 | Cross-zone wildcard cache poisoning via RRSIG.labels manipulation | 8.6 | 0.0015 | None reported |
| High | CVE-2026-40622 | Another 'ghost domain names' attack variant | 7.5 | 0.0014 | None reported |
| Routine | CVE-2026-56444 | Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration | 5.9 | 0.0037 | None reported |
| Routine | CVE-2026-50251 | Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush | 5.3 | 0.0025 | None reported |
| Routine | CVE-2026-44621 | Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abruptly terminated | 5.9 | 0.0025 | None reported |
| Routine | CVE-2026-55990 | Packet of death for a DNSCrypt misconfigured Unbound | 5.9 | 0.0025 | None reported |
| Routine | CVE-2026-54478 | DNS Cookie bypass when combined with proxy-protocol use | 3.7 | 0.0024 | None reported |
| Routine | CVE-2026-50046 | Possible heap use-after-free in an error path when a DoT forwarded query is jostled out | 5.9 | 0.0024 | None reported |
| Routine | CVE-2026-55717 | 'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash | 5.9 | 0.0024 | None reported |
| Routine | CVE-2026-44687 | Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN | 3.7 | 0.0022 | None reported |
| Routine | CVE-2026-42955 | Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records | 3.7 | 0.0020 | None reported |
| Routine | CVE-2026-46582 | A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path | 3.7 | 0.0019 | None reported |
| Routine | CVE-2026-55708 | Privacy/configuration issue when adding local data in views through 'unbound-control' | 3.1 | 0.0016 | None reported |
| Routine | CVE-2026-56416 | Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name | 4.8 | 0.0012 | None reported |
| Routine | CVE-2026-50243 | 'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL | 3.7 | 0.0011 | None reported |
Showing 1 to 17 of 17
1
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.