CVE catalog

CVE-2026-50046

In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS (DoT) forwarded queries is tied to a struct's ('serviced_query') lifetime but also referenced by anot

[CVE catalog]

Severity
Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.24% · Oct 25, 2026

In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS (DoT) forwarded queries is tied to a struct's ('serviced_query') lifetime but also referenced by another struct ('waiting_tcp'). When the owning struct is jostled out of the mesh while the DoT TCP stream is still handshaking it frees the storage behind the referenced string and if the TLS stream then errors out, it dereferences the freed pointer. The dereference is read-only and the practical impact is a daemon crash resulting in denial of service. A malicious actor that knows a DoT forwarding/stub Unbound's configuration could exploit the vulnerability by quering records in the appropriate zone while keeping Unbound uder pressure so that the jostle logic kicks in. If answers for the vulnerable zone are slow, the likelihood of jostling such queries is higher, although the timing of the jostle needs to be precise. Requirements for a vulnerable Unbound is the existence of a stub/forward zone configured for DoT together with a configured '#authname' suffix on the server identification. The connectivity to the server needs to exhibit a transient failure at the correct time in order to kick off the vulnerable error path.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianunboundsid1.26.2-1fixed
Debianunboundforky1.26.2-1fixed
Debianunboundtrixie1.22.0-2+deb13u3vulnerable
Debianunboundtrixie-security1.26.2-0+deb13u1fixed
Debianunboundbookworm1.17.1-2+deb12u4vulnerable
Debianunboundbookworm-security1.17.1-2+deb12u3vulnerable
Alpineunbound3.221.25.2-r0fixed
Alpineunbound3.231.25.2-r0fixed
Alpineunbound3.241.25.2-r0fixed
Ubuntuunboundpro1.9.0-2ubuntu1vulnerable
Ubuntuunboundpro1.9.0-2ubuntu2vulnerable
Ubuntuunboundpro1.9.4-2vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.1vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.2vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.3vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.4vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.5vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.6vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.8vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.9vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.11vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.11+esm1vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.11+esm2vulnerable
Ubuntuunboundpro1.9.4-2ubuntu1.11+esm3vulnerable
Ubuntuunbound22.041.13.1-1ubuntu1vulnerable
Ubuntuunbound22.041.13.1-1ubuntu3vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.1vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.2vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.3vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.4vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.5vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.7vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.8vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.10vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.11vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.12vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.13vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.14vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.15vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.16vulnerable
Ubuntuunbound22.041.13.1-1ubuntu5.17vulnerable
Ubuntuunbound24.041.17.1-2vulnerable
Ubuntuunbound24.041.18.0-2ubuntu1vulnerable
Ubuntuunbound24.041.18.0-2ubuntu2vulnerable
Ubuntuunbound24.041.19.1-1ubuntu1vulnerable
Ubuntuunbound24.041.19.2-1ubuntu1vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.1vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.2vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.3vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.4vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.5vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.6vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.7vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.8vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.9vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.10vulnerable
Ubuntuunbound24.041.19.2-1ubuntu3.12vulnerable
Ubuntuunbound26.101.24.2-1ubuntu2vulnerable
Ubuntuunbound26.101.25.1-1ubuntu1vulnerable
Ubuntuunbound26.101.25.1-1ubuntu3vulnerable
Ubuntuunbound26.041.22.0-2ubuntu2vulnerable
Ubuntuunbound26.041.22.0-2ubuntu4vulnerable
Ubuntuunbound26.041.24.2-1ubuntu1vulnerable
Ubuntuunbound26.041.24.2-1ubuntu2vulnerable
Ubuntuunbound26.041.24.2-1ubuntu2.1vulnerable
Ubuntuunbound26.041.24.2-1ubuntu2.2vulnerable
Ubuntuunbound26.041.24.2-1ubuntu2.3vulnerable
Ubuntuunbound26.041.24.2-1ubuntu2.4vulnerable
CpeunboundNot reported1.25.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianunboundsourcesid1.25.2-1not yet assignedNot reportedNot reported
Debianunboundsourceforky1.25.2-1not yet assignedNot reportedNot reported
Debianunboundsourcetrixie1.26.1-0+deb13u1not yet assignedNot reportedNot reported
Debianunboundsourcebookworm(unfixed)not yet assignedNot reportedNot reported
Alpineunboundapk3.221.25.2-r0Not reportedALPINE-CVE-2026-50046Not reported
Alpineunboundapk3.231.25.2-r0Not reportedALPINE-CVE-2026-50046Not reported
Alpineunboundapk3.241.25.2-r0Not reportedALPINE-CVE-2026-50046Not reported
CpeunboundcpeNot reported1.25.2Not reportedNVD-CVE-2026-50046Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libunbound8]Affected

    Source package: [unbound]

    Details (4)

    • 1.17.1-2+deb12u4 · amd64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u4 · arm64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

  • [libunbound-dev]Affected

    Source package: [unbound]

    Details (4)

    • 1.17.1-2+deb12u4 · amd64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u4 · arm64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

  • [python3-unbound]Affected

    Source package: [unbound]

    Details (4)

    • 1.17.1-2+deb12u4 · amd64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u4 · arm64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

  • [unbound]Affected
    Details (4)

    • 1.17.1-2+deb12u4 · amd64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u4 · arm64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

  • [unbound-anchor]Affected

    Source package: [unbound]

    Details (4)

    • 1.17.1-2+deb12u4 · amd64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u4 · arm64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

  • [unbound-host]Affected

    Source package: [unbound]

    Details (4)

    • 1.17.1-2+deb12u4 · amd64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u4 · arm64 · bookworm

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

    • 1.17.1-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

[Debian 13 (Trixie)]

  • [libunbound8]Affected

    Source package: [unbound]

    Details (6)

    • 1.22.0-2+deb13u3 · amd64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie-security

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.2-0+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

  • [libunbound-dev]Affected

    Source package: [unbound]

    Details (6)

    • 1.22.0-2+deb13u3 · amd64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie-security

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.2-0+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

  • [python3-unbound]Affected

    Source package: [unbound]

    Details (6)

    • 1.22.0-2+deb13u3 · amd64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie-security

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.2-0+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

  • [unbound]Affected
    Details (6)

    • 1.22.0-2+deb13u3 · amd64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie-security

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.2-0+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

  • [unbound-anchor]Affected

    Source package: [unbound]

    Details (6)

    • 1.22.0-2+deb13u3 · amd64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie-security

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.2-0+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

  • [unbound-host]Affected

    Source package: [unbound]

    Details (6)

    • 1.22.0-2+deb13u3 · amd64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.22.0-2+deb13u3 · arm64 · trixie-security

      Affected · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

    • 1.26.2-0+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.26.1-0+deb13u1

      nvd · unbound · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]