CVE catalog

CVE-2026-42534

NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could defeat its purpose and degrade resolution performance. Retransmits of the same query could rene

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.60% · Oct 25, 2026

NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could defeat its purpose and degrade resolution performance. Retransmits of the same query could renew the age of slow running queries and not allow the jostle logic to see them as aged and potential targets for replacement with new queries. An adversary who can query a vulnerable Unbound and who can control a domain name server that replies slowly and/or maliciously to Unbound's queries can exploit the vulnerability and degrade the resolution performance of Unbound. When Unbound's 'num-queries-per-thread' reaches its limit, the jostle logic kicks in. When a new query comes in, half of the available queries that are also slow to resolve are candidates for replacement. The vulnerability then happens because duplicate queries that need resolution would skew the aging result by using the timestamp of the latest duplicate query instead of the original one that started the resolution effort. Cache and local data response performance remains unaffected. Coordinated attacks could raise this to a denial of resolution service. Unbound 1.25.1 contains a patch with a fix to attach an initial, non-updatable start time for incoming queries that allow the jostle logic to work as intended.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianunboundsid1.26.2-1fixed
Debianunboundforky1.26.2-1fixed
Debianunboundtrixie1.22.0-2+deb13u3fixed
Debianunboundtrixie-security1.26.2-0+deb13u1fixed
Debianunboundbookworm1.17.1-2+deb12u4vulnerable
Debianunboundbookworm-security1.17.1-2+deb12u3vulnerable
CpeunboundNot reported1.19.2-1ubuntu3.8fixed
Cpelibunbound-devNot reported1.19.2-1ubuntu3.8fixed
Cpelibunbound8Not reported1.19.2-1ubuntu3.8fixed
Cpepython3-unboundNot reported1.19.2-1ubuntu3.8fixed
Cpeunbound-anchorNot reported1.19.2-1ubuntu3.8fixed
Cpeunbound-hostNot reported1.19.2-1ubuntu3.8fixed
CpeunboundNot reportedNot reportedvulnerable
CpeunboundNot reported1.25.1fixed
CpeunboundNot reported1.25.1fixed
Ubuntuunboundpro1.9.0-2ubuntu1vulnerable
Ubuntuunboundpro1.9.0-2ubuntu2vulnerable
Ubuntuunboundpro1.9.4-2vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.1vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.2vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.3vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.4vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.5vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.6vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.8vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.9vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.11vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.11+esm1vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.11+esm2vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.11+esm3vulnerable
Ubuntuunbound22.041.13.1-1ubuntu1vulnerable
Ubuntuunbound22.041.13.1-1ubuntu3vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.1vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.2vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.3vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.4vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.5vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.7vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.8vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.10vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.11vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.12vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.13vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.14vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.15fixed
Ubuntuunbound24.041.17.1-2vulnerable
Ubuntuunbound24.041.18.0-2ubuntu1vulnerable
Ubuntuunbound24.041.18.0-2ubuntu2vulnerable
Ubuntuunbound24.041.19.1-1ubuntu1vulnerable
Ubuntuunbound24.041.19.2-1ubuntu1vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.1vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.2vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.3vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.4vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.5vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.6vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.7vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.8fixed
Ubuntuunbound25.101.22.0-1ubuntu1vulnerable
Ubuntuunbound25.101.22.0-2ubuntu1vulnerable
Ubuntuunbound25.101.22.0-2ubuntu2vulnerable
Ubuntuunbound25.101.22.0-2ubuntu2.1vulnerable
Ubuntuunbound25.101.22.0-2ubuntu2.2vulnerable
Ubuntuunbound25.101.22.0-2ubuntu2.3fixed
Ubuntuunbound26.041.22.0-2ubuntu2vulnerable
Ubuntuunbound26.041.22.0-2ubuntu4vulnerable
Ubuntuunbound26.041.24.2-1ubuntu1vulnerable
Ubuntuunbound26.041.24.2-1ubuntu2vulnerable
Ubuntuunbound26.041.24.2-1ubuntu2.1fixed
Alpineunbound3.221.25.2-r0fixed
Alpineunbound3.231.25.2-r0fixed
Alpineunbound3.241.25.1-r0fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianunboundsourcesid1.25.1-1not yet assignedNot reported[1137187]
Debianunboundsourceforky1.25.1-1not yet assignedNot reported[1137187]
Debianunboundsourcetrixie1.22.0-2+deb13u3not yet assignedNot reported[1137187]
Debianunboundsourcebookworm(unfixed)not yet assignedNot reported[1137187]
CpeunboundcpeNot reported1.19.2-1ubuntu3.8Not reportedNot reportedNot reported
Cpelibunbound-devcpeNot reported1.19.2-1ubuntu3.8Not reportedNot reportedNot reported
Cpelibunbound8cpeNot reported1.19.2-1ubuntu3.8Not reportedNot reportedNot reported
Cpepython3-unboundcpeNot reported1.19.2-1ubuntu3.8Not reportedNot reportedNot reported
Cpeunbound-anchorcpeNot reported1.19.2-1ubuntu3.8Not reportedNot reportedNot reported
Cpeunbound-hostcpeNot reported1.19.2-1ubuntu3.8Not reportedNot reportedNot reported
CpeunboundcpeNot reported1.25.1Not reportedNot reportedNot reported
CpeunboundcpeNot reported1.25.1Not reportedNVD-CVE-2026-42534Not reported
Ubuntuunbounddeb22.041.13.1-1ubuntu5.15Not reportedUBUNTU-CVE-2026-42534Not reported
Ubuntuunbounddeb24.041.19.2-1ubuntu3.8Not reportedUBUNTU-CVE-2026-42534Not reported
Ubuntuunbounddeb25.101.22.0-2ubuntu2.3Not reportedUBUNTU-CVE-2026-42534Not reported
Ubuntuunbounddeb26.041.24.2-1ubuntu2.1Not reportedUBUNTU-CVE-2026-42534Not reported
Alpineunboundapk3.221.25.2-r0Not reportedALPINE-CVE-2026-42534Not reported
Alpineunboundapk3.231.25.2-r0Not reportedALPINE-CVE-2026-42534Not reported
Alpineunboundapk3.241.25.1-r0Not reportedALPINE-CVE-2026-42534Not reported

[Debian bug #1137187]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libunbound8]Affected

    Source package: [unbound]

    Details (4)

    • 1.17.1-2+deb12u4 · amd64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u4 · arm64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

  • [libunbound-dev]Affected

    Source package: [unbound]

    Details (4)

    • 1.17.1-2+deb12u4 · amd64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u4 · arm64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

  • [python3-unbound]Affected

    Source package: [unbound]

    Details (4)

    • 1.17.1-2+deb12u4 · amd64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u4 · arm64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

  • [unbound]Affected
    Details (4)

    • 1.17.1-2+deb12u4 · amd64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u4 · arm64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

  • [unbound-anchor]Affected

    Source package: [unbound]

    Details (4)

    • 1.17.1-2+deb12u4 · amd64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u4 · arm64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

  • [unbound-host]Affected

    Source package: [unbound]

    Details (4)

    • 1.17.1-2+deb12u4 · amd64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u4 · arm64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

[Debian 13 (Trixie)]

  • [libunbound8]Fixed

    Source package: [unbound]

    Details (6)

    • 1.22.0-2+deb13u3 · amd64 · trixie

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie-security

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

    • 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

    • 1.26.2-0+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

  • [libunbound-dev]Fixed

    Source package: [unbound]

    Details (6)

    • 1.22.0-2+deb13u3 · amd64 · trixie

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie-security

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

    • 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

    • 1.26.2-0+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

  • [python3-unbound]Fixed

    Source package: [unbound]

    Details (6)

    • 1.22.0-2+deb13u3 · amd64 · trixie

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie-security

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

    • 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

    • 1.26.2-0+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

  • [unbound]Fixed
    Details (6)

    • 1.22.0-2+deb13u3 · amd64 · trixie

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie-security

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

    • 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

    • 1.26.2-0+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

  • [unbound-anchor]Fixed

    Source package: [unbound]

    Details (6)

    • 1.22.0-2+deb13u3 · amd64 · trixie

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie-security

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

    • 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

    • 1.26.2-0+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

  • [unbound-host]Fixed

    Source package: [unbound]

    Details (6)

    • 1.22.0-2+deb13u3 · amd64 · trixie

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie-security

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

    • 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

    • 1.26.2-0+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.22.0-2+deb13u3

      nvd · unbound · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]