BSD PortsUnbound -- Multiple vulnerabilities
· CVE-2026-32792, CVE-2026-33278, CVE-2026-40622, CVE-2026-41292, CVE-2026-42534, CVE-2026-42923, CVE-2026-42944, CVE-2026-42959, CVE-2026-42960, CVE-2026-44390, CVE-2026-44608 · VuXML entry
NLnet Labs reports: This release consolidates security fixes for issues reported over a period of time. There are fixes for: CVE-2026-33278: Possible remote code execution during DNSSEC validation. CVE-2026-42944: Heap overflow and crash with multiple nsid, cookie, padding EDNS options. CVE-2026-42959: Crash during DNSSEC validation of malicious content. CVE-2026-32792: Packet of death with DNSCrypt. CVE-2026-40622: …
Affected versions
- unbound < 1.25.1
By system
1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| FreeBSD | dns/unbound | 1.26.2 | fixed | (47 days after) |
| MidnightBSD | dns/unbound | 1.26.1 | out of range, by version | |
| DragonFly | dns/unbound | 1.22.0_1 | vulnerable since 2026-06-08 |