From d0619dfc6bb21e6b43fe75b19ee164521a59367e Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Wed, 26 Aug 2026 22:22:07 +0200 Subject: [PATCH] package/unbound: security bump to v1.25.2 See the changelog: - https://nlnetlabs.nl/projects/unbound/download/#unbound-1-25-2 It fixes the following vulnerabilities: - CVE-2026-14586: Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments. - CVE-2026-32665: Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass. - CVE-2026-40691: Packet of death for DNSCrypt over TCP. - CVE-2026-41637 Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries. - CVE-2026-42955: Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records. - CVE-2026-44621: Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abruptly terminated. - CVE-2026-44687: Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN. - CVE-2026-44690: Cross-zone wildcard cache poisoning via RRSIG.labels manipulation. - CVE-2026-46582: A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path. - CVE-2026-50045: 'max-global-quota' reset by DNSSEC validation restarts. - CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out. - CVE-2026-50243: 'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL. - CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones. - CVE-2026-50251: Attacker supplied `0.0.0.0`/`::` glue triggers defensive full-cache flush. - CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread. - CVE-2026-52863: Memory corruption could lead to crash and denial of service. - CVE-2026-54478: DNS Cookie bypass when combined with proxy-protocol use. - CVE-2026-55708: Privacy/configuration issue when adding local data in views through 'unbound-control'. - CVE-2026-55717: 'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash. - CVE-2026-55973: 'dns-error-reporting: yes' leads to stack buffer overflow. - CVE-2026-55990: Packet of death for a DNSCrypt misconfigured Unbound. - CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2. - CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name. - CVE-2026-56444: Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration. Signed-off-by: Thomas Perale Signed-off-by: Julien Olivain --- package/unbound/unbound.hash | 6 +++--- package/unbound/unbound.mk | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package/unbound/unbound.hash b/package/unbound/unbound.hash index 46b88900e6..85724ca243 100644 --- a/package/unbound/unbound.hash +++ b/package/unbound/unbound.hash @@ -1,8 +1,8 @@ -# From https://nlnetlabs.nl/downloads/unbound/unbound-1.25.1.tar.gz.sha256 +# From https://nlnetlabs.nl/downloads/unbound/unbound-1.25.2.tar.gz.sha256 # After checking pgp signature from: -# https://nlnetlabs.nl/downloads/unbound/unbound-1.25.1.tar.gz.asc +# https://nlnetlabs.nl/downloads/unbound/unbound-1.25.2.tar.gz.asc # with key: 231018690C4D903EF419146AA144323DEAACDF45 -sha256 0fe8b6277b0959cfd17562debac0aa5f71e0b02dc4ffa9c60271c583edab586f unbound-1.25.1.tar.gz +sha256 0d92275c703d5f5f8baba3dab22117dd8c29b495588a5c229768ed6581566600 unbound-1.25.2.tar.gz # Locally calculated sha256 8eb9a16cbfb8703090bbfa3a2028fd46bb351509a2f90dc1001e51fbe6fd45db LICENSE diff --git a/package/unbound/unbound.mk b/package/unbound/unbound.mk index fab6e67455..46fca5e2d2 100644 --- a/package/unbound/unbound.mk +++ b/package/unbound/unbound.mk @@ -4,7 +4,7 @@ # ################################################################################ -UNBOUND_VERSION = 1.25.1 +UNBOUND_VERSION = 1.25.2 UNBOUND_SITE = https://nlnetlabs.nl/downloads/unbound UNBOUND_INSTALL_STAGING = YES UNBOUND_DEPENDENCIES = host-pkgconf expat libevent openssl