BSD PortsUnbound -- Multiple vulnerabilities
· CVE-2026-97206, CVE-2026-50106, CVE-2026-96405, CVE-2026-109125, CVE-2026-35501 · VuXML entry
NLNetLabs reports: This release consolidates security fixes for issues reported over a period of time. CVE-2026-97206, DoQ path-migration can lead to use-after-free on multi-threaded deployments. CVE-2026-50106, Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent. CVE-2026-96405, Aggregate DNS name chained pointer decompression work leads to …
Affected versions
- unbound < 1.26.2
By system
1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| FreeBSD | dns/unbound | 1.26.2 | fixed | (1 days after) |
| MidnightBSD | dns/unbound | 1.26.1 | in range, by version | |
| DragonFly | dns/unbound | 1.22.0_1 | vulnerable since 2026-10-21 |