Unbound
83 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Unbound, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.
Unbound CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 1 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 1 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 1 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 11 |
| 2026-06 | 0 |
| 2026-07 | 24 |
| 2026-08 | 0 |
| 2026-09 | 9 |
Severity
How the 83 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical12
- High27
- Medium35
- Low9
Latest CVEs
The 15 most recently published vulnerabilities affecting Unbound.
- CVE-2026-85501Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC5.3
- CVE-2026-82720Use-after-free in DoH stream cleanup code path5.9
- CVE-2026-82717CNAME synthesis could lead to heap corruption9.8
- CVE-2026-81642Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY9.8
- CVE-2026-81634Possible heap buffer overflow during DNSSEC canonicalization7.5
- CVE-2026-80225Possible degradation of service from continuous queries on the same TCP/DoT connection5.3
- CVE-2026-78227Use-after-free in DoQ stream output buffer on reset re-transmission6.5
- CVE-2026-77955Possible ZONEMD verification bypass window4.4
- CVE-2026-77860'serve-expired' can bypass Unbound 'wait-limit'3.7
- CVE-2026-56444Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration5.9
- CVE-2026-56416Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name4.8
- CVE-2026-55991Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp25.9
- CVE-2026-55990Packet of death for a DNSCrypt misconfigured Unbound5.9
- CVE-2026-55973'dns-error-reporting: yes' leads to stack buffer overflow7.5
- CVE-2026-55717'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash5.9
Product grouping is registry-driven, with AI assist and human review. How it works