BSD PortsUnbound -- multiple vulnerabilities
· CVE-2026-81642, CVE-2026-81634, CVE-2026-82717, CVE-2026-77955, CVE-2026-78227, CVE-2026-80225, CVE-2026-82720, CVE-2026-85501, CVE-2026-77860 · VuXML entry
NLnet Labs reports: This release consolidates security fixes for issues reported over a period of time. There are fixes for: CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY. CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization. CVE-2026-82717: CNAME synthesis could lead to heap corruption. CVE-2026-77955: Possible ZONEMD verification bypass …
Affected versions
- unbound < 1.26.1
By system
1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| FreeBSD | dns/unbound | 1.26.2 | fixed | |
| MidnightBSD | dns/unbound | 1.26.1 | out of range, by version | |
| DragonFly | dns/unbound | 1.22.0_1 | vulnerable since 2026-09-16 |