-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 16 Sep 2026 18:31:09 +0300
Source: unbound
Architecture: source
Version: 1.26.1-1
Distribution: unstable
Urgency: medium
Maintainer: unbound packagers <unbound@packages.debian.org>
Changed-By: Michael Tokarev <mjt@tls.msk.ru>
Changes:
unbound (1.26.1-1) unstable; urgency=medium
.
* new upstream security/bugfx release, including the following fixes:
- CVE-2026-81642 - severity: CRITICAL
Heap buffer overflow and possible Remote Code Execution
when digesting DNSKEY
- CVE-2026-81634 - severity: HIGH
Possible heap buffer overflow during DNSSEC canonicalization
- CVE-2026-82717 - severity: HIGH
CNAME synthesis could lead to heap corruption
- CVE-2026-77955 - severity: MEDIUM
Possible ZONEMD verification bypass window
- CVE-2026-78227 - severity: MEDIUM
Use-after-free in DoQ stream output buffer on reset re-transmission
- CVE-2026-80225 - severity: MEDIUM
Possible degradation of service from continuous queries
on the same TCP/DoT connection
- CVE-2026-82720 - severity: MEDIUM
Use-after-free in DoH stream cleanup code path
- CVE-2026-85501 - severity: MEDIUM
Retrap: Novel Vulnerabilities to launch
Algorithmic Complexity Attacks on DNSSEC
- CVE-2026-77860 - severity: LOW
'serve-expired' can bypass Unbound 'wait-limit'
Checksums-Sha1:
4f6ce6cb5c92d0e1db765b2fe1e4c5d2098f0685 3221 unbound_1.26.1-1.dsc
e4554010d4349038c7de117779b65a4d8b35a663 6948585 unbound_1.26.1.orig.tar.gz
daabbe2a34dfe39a1e0b86cd3a6671e3da37c4e3 659 unbound_1.26.1.orig.tar.gz.asc
d884ed437fa1d4874ec4056cfc96fe35c4f5fcd4 31500 unbound_1.26.1-1.debian.tar.xz
11a209beb89596128466efc0dbd7a2e826a7b265 5835 unbound_1.26.1-1_source.buildinfo
Checksums-Sha256:
a7e647ac082bb9895d3bd059778a25497a3613ef558bbe8a08494a2818bd22c6 3221 unbound_1.26.1-1.dsc
35a6dc0e425a9282c3426d9a3043144011bf0534aed4b73ab62c52aee0af1503 6948585 unbound_1.26.1.orig.tar.gz
c52227c2a6918f991443c72709313fcd8530c41ea61268dbe820278a1c60a996 659 unbound_1.26.1.orig.tar.gz.asc
f42d337c4bc28d5c091bf767b4ff50285dc66f86ed84c0c6b0396b397f250951 31500 unbound_1.26.1-1.debian.tar.xz
4684222b6bdc27fd73b328147d2a2c2a14a18ca5cfb01c7032a7bf1c8f5d39e3 5835 unbound_1.26.1-1_source.buildinfo
Files:
12b1b54519dd97e47cd03349a90a47c7 3221 net optional unbound_1.26.1-1.dsc
249968d910bcf13232fbecef8db17124 6948585 net optional unbound_1.26.1.orig.tar.gz
8d8aa9bfcadded4e7d2ac0e8c67be654 659 net optional unbound_1.26.1.orig.tar.gz.asc
f50980ba81eaf412cc8ae85b2ef74dd9 31500 net optional unbound_1.26.1-1.debian.tar.xz
e3bd182468876ee678e5a4b4f75dec13 5835 net optional unbound_1.26.1-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEZKoqtTHVaQM2a/75gqpKJDselHgFAmqqtqsACgkQgqpKJDse
lHjk6g//e11/h6RIhhcP7lAQ2ROSoykaVS9j3ET7mfAIXlbYR3zWTbk8zM2LwSux
6gB480FbditTzVtvX90A6GQpGCdBSH1Rm4ONbyr69ZiVa3hGqg3gtwIYc21u+Nm7
67cn+Azjx3FmTsVcsWLwbQLMRh9y1gIU/Pn4uXQNwgdfcuuUq7IwzUzG5ipWs0jD
caY+5/w8GT5famyqMzqL80f3KMhY7KWL2gx77sGNmTYsvfPAXf9WlVluu79VxRpV
CHDKI0RjL7FqiuCys8RvnVobXJdHnsCmIFxilussBaSHy1X65qxBl63wzhJENduO
oL3b0YB4Yv14RxL+zpyY0j/MBFVp+d20Fsy0VsLFk4qBKdtsKai0ZidBGcivrgdt
owlsrq1hDL1n0WY10YuDnz984iZWHdfbE2z2AtmKD6zHfKNqEDC6O1f7pTYGckVi
4dWmLwCcPu/zc7tMiI1Chu7fU6XD66tdJAzqscY7VgVTxKTZuWsi3nqs7EIH+rES
8w7nbqLeC+aBtlTc3z8fTlBqY4vLWl3yGyPVemRnuSxhmAtHV67VBbdiry8Har+a
QgCYdvdI7w+9eZI/gHX9wQ5SQSsrUfRLDEqXlbJ6w4hzaAYO1sKUXtRytCYZ949r
4TnuB7962qV/H6bp1qSTvbicj4qWbcDX9Y//nhNT6WTVTYM2I40=
=Ea5F
-----END PGP SIGNATURE-----
