CVE catalog

CVE-2026-52863

Severity: Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: Jul 22, 2026, 1:09:06 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.36% · Oct 25, 2026

In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of the view name in effect that could lead to memory corruption if the owner of the original view name is jostled out when Unbound is under pressure. Unbound needs to be configured with one of 'respip'/'rpz' modules, together with a module that can attach subqueries (respip CNAME redirection, dns64, subnetcache) and a configured 'access-control-view' while Unbound is under pressure so that joslte logic kicks in and starts dropping slow queries. The subquery is getting a shallow copy of the view name and if the super query which owns the view name is jostled out, memory corruption can occur. Likelihood of a crash is low, since it relies heavily on the underlying memory allocator and the memory layout. Debug memory builds (e.g., ASAN) that catch the free terminate the server.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	unbound	sid	`1.26.2-1`	fixed
Debian	unbound	forky	`1.26.2-1`	fixed
Debian	unbound	trixie	`1.22.0-2+deb13u3`	vulnerable
Debian	unbound	trixie-security	`1.26.2-0+deb13u1`	fixed
Debian	unbound	bookworm	`1.17.1-2+deb12u4`	vulnerable
Debian	unbound	bookworm-security	`1.17.1-2+deb12u3`	vulnerable
Alpine	unbound	3.22	`1.25.2-r0`	fixed
Alpine	unbound	3.23	`1.25.2-r0`	fixed
Alpine	unbound	3.24	`1.25.2-r0`	fixed
Ubuntu	unbound	pro	`1.9.0-2ubuntu1`	vulnerable
Ubuntu	unbound	pro	`1.9.0-2ubuntu2`	vulnerable
Ubuntu	unbound	pro	`1.9.4-2`	vulnerable
Ubuntu	unbound	pro	`1.9.4-2ubuntu1`	vulnerable
Ubuntu	unbound	pro	`1.9.4-2ubuntu1.1`	vulnerable
Ubuntu	unbound	pro	`1.9.4-2ubuntu1.2`	vulnerable
Ubuntu	unbound	pro	`1.9.4-2ubuntu1.3`	vulnerable
Ubuntu	unbound	pro	`1.9.4-2ubuntu1.4`	vulnerable
Ubuntu	unbound	pro	`1.9.4-2ubuntu1.5`	vulnerable
Ubuntu	unbound	pro	`1.9.4-2ubuntu1.6`	vulnerable
Ubuntu	unbound	pro	`1.9.4-2ubuntu1.8`	vulnerable
Ubuntu	unbound	pro	`1.9.4-2ubuntu1.9`	vulnerable
Ubuntu	unbound	pro	`1.9.4-2ubuntu1.11`	vulnerable
Ubuntu	unbound	pro	`1.9.4-2ubuntu1.11+esm1`	vulnerable
Ubuntu	unbound	pro	`1.9.4-2ubuntu1.11+esm2`	vulnerable
Ubuntu	unbound	pro	`1.9.4-2ubuntu1.11+esm3`	vulnerable
Ubuntu	unbound	22.04	`1.13.1-1ubuntu1`	vulnerable
Ubuntu	unbound	22.04	`1.13.1-1ubuntu3`	vulnerable
Ubuntu	unbound	22.04	`1.13.1-1ubuntu5`	vulnerable
Ubuntu	unbound	22.04	`1.13.1-1ubuntu5.1`	vulnerable
Ubuntu	unbound	22.04	`1.13.1-1ubuntu5.2`	vulnerable
Ubuntu	unbound	22.04	`1.13.1-1ubuntu5.3`	vulnerable
Ubuntu	unbound	22.04	`1.13.1-1ubuntu5.4`	vulnerable
Ubuntu	unbound	22.04	`1.13.1-1ubuntu5.5`	vulnerable
Ubuntu	unbound	22.04	`1.13.1-1ubuntu5.7`	vulnerable
Ubuntu	unbound	22.04	`1.13.1-1ubuntu5.8`	vulnerable
Ubuntu	unbound	22.04	`1.13.1-1ubuntu5.10`	vulnerable
Ubuntu	unbound	22.04	`1.13.1-1ubuntu5.11`	vulnerable
Ubuntu	unbound	22.04	`1.13.1-1ubuntu5.12`	vulnerable
Ubuntu	unbound	22.04	`1.13.1-1ubuntu5.13`	vulnerable
Ubuntu	unbound	22.04	`1.13.1-1ubuntu5.14`	vulnerable
Ubuntu	unbound	22.04	`1.13.1-1ubuntu5.15`	vulnerable
Ubuntu	unbound	22.04	`1.13.1-1ubuntu5.16`	vulnerable
Ubuntu	unbound	22.04	`1.13.1-1ubuntu5.17`	vulnerable
Ubuntu	unbound	24.04	`1.17.1-2`	vulnerable
Ubuntu	unbound	24.04	`1.18.0-2ubuntu1`	vulnerable
Ubuntu	unbound	24.04	`1.18.0-2ubuntu2`	vulnerable
Ubuntu	unbound	24.04	`1.19.1-1ubuntu1`	vulnerable
Ubuntu	unbound	24.04	`1.19.2-1ubuntu1`	vulnerable
Ubuntu	unbound	24.04	`1.19.2-1ubuntu3`	vulnerable
Ubuntu	unbound	24.04	`1.19.2-1ubuntu3.1`	vulnerable
Ubuntu	unbound	24.04	`1.19.2-1ubuntu3.2`	vulnerable
Ubuntu	unbound	24.04	`1.19.2-1ubuntu3.3`	vulnerable
Ubuntu	unbound	24.04	`1.19.2-1ubuntu3.4`	vulnerable
Ubuntu	unbound	24.04	`1.19.2-1ubuntu3.5`	vulnerable
Ubuntu	unbound	24.04	`1.19.2-1ubuntu3.6`	vulnerable
Ubuntu	unbound	24.04	`1.19.2-1ubuntu3.7`	vulnerable
Ubuntu	unbound	24.04	`1.19.2-1ubuntu3.8`	vulnerable
Ubuntu	unbound	24.04	`1.19.2-1ubuntu3.9`	vulnerable
Ubuntu	unbound	24.04	`1.19.2-1ubuntu3.10`	vulnerable
Ubuntu	unbound	24.04	`1.19.2-1ubuntu3.12`	vulnerable
Ubuntu	unbound	26.10	`1.24.2-1ubuntu2`	vulnerable
Ubuntu	unbound	26.10	`1.25.1-1ubuntu1`	vulnerable
Ubuntu	unbound	26.10	`1.25.1-1ubuntu3`	vulnerable
Ubuntu	unbound	26.04	`1.22.0-2ubuntu2`	vulnerable
Ubuntu	unbound	26.04	`1.22.0-2ubuntu4`	vulnerable
Ubuntu	unbound	26.04	`1.24.2-1ubuntu1`	vulnerable
Ubuntu	unbound	26.04	`1.24.2-1ubuntu2`	vulnerable
Ubuntu	unbound	26.04	`1.24.2-1ubuntu2.1`	vulnerable
Ubuntu	unbound	26.04	`1.24.2-1ubuntu2.2`	vulnerable
Ubuntu	unbound	26.04	`1.24.2-1ubuntu2.3`	vulnerable
Ubuntu	unbound	26.04	`1.24.2-1ubuntu2.4`	vulnerable
Cpe	unbound	Not reported	`1.25.2`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	unbound	source	sid	`1.25.2-1`	not yet assigned	Not reported	Not reported
Debian	unbound	source	forky	`1.25.2-1`	not yet assigned	Not reported	Not reported
Debian	unbound	source	trixie	`1.26.1-0+deb13u1`	not yet assigned	Not reported	Not reported
Debian	unbound	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported
Alpine	unbound	apk	3.22	`1.25.2-r0`	Not reported	ALPINE-CVE-2026-52863	Not reported
Alpine	unbound	apk	3.23	`1.25.2-r0`	Not reported	ALPINE-CVE-2026-52863	Not reported
Alpine	unbound	apk	3.24	`1.25.2-r0`	Not reported	ALPINE-CVE-2026-52863	Not reported
Cpe	unbound	cpe	Not reported	`1.25.2`	Not reported	NVD-CVE-2026-52863	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libunbound8]Affected
Source package: [unbound]
Details (4)
- 1.17.1-2+deb12u4 · amd64 · bookworm
  Affected
  nvd · unbound · debian · bookworm; nvd · unbound · debian · 12
- 1.17.1-2+deb12u4 · arm64 · bookworm
  Affected
  nvd · unbound · debian · bookworm; nvd · unbound · debian · 12
- 1.17.1-2+deb12u3 · amd64 · bookworm-security
  Affected
  nvd · unbound · debian · bookworm; nvd · unbound · debian · 12
- 1.17.1-2+deb12u3 · arm64 · bookworm-security
  Affected
  nvd · unbound · debian · bookworm; nvd · unbound · debian · 12
[libunbound-dev]Affected
Source package: [unbound]
Details (4)
- 1.17.1-2+deb12u4 · amd64 · bookworm
  Affected
  nvd · unbound · debian · bookworm; nvd · unbound · debian · 12
- 1.17.1-2+deb12u4 · arm64 · bookworm
  Affected
  nvd · unbound · debian · bookworm; nvd · unbound · debian · 12
- 1.17.1-2+deb12u3 · amd64 · bookworm-security
  Affected
  nvd · unbound · debian · bookworm; nvd · unbound · debian · 12
- 1.17.1-2+deb12u3 · arm64 · bookworm-security
  Affected
  nvd · unbound · debian · bookworm; nvd · unbound · debian · 12
[python3-unbound]Affected
Source package: [unbound]
Details (4)
- 1.17.1-2+deb12u4 · amd64 · bookworm
  Affected
  nvd · unbound · debian · bookworm; nvd · unbound · debian · 12
- 1.17.1-2+deb12u4 · arm64 · bookworm
  Affected
  nvd · unbound · debian · bookworm; nvd · unbound · debian · 12
- 1.17.1-2+deb12u3 · amd64 · bookworm-security
  Affected
  nvd · unbound · debian · bookworm; nvd · unbound · debian · 12
- 1.17.1-2+deb12u3 · arm64 · bookworm-security
  Affected
  nvd · unbound · debian · bookworm; nvd · unbound · debian · 12
[unbound]Affected
Details (4)
- 1.17.1-2+deb12u4 · amd64 · bookworm
  Affected
  nvd · unbound · debian · bookworm; nvd · unbound · debian · 12
- 1.17.1-2+deb12u4 · arm64 · bookworm
  Affected
  nvd · unbound · debian · bookworm; nvd · unbound · debian · 12
- 1.17.1-2+deb12u3 · amd64 · bookworm-security
  Affected
  nvd · unbound · debian · bookworm; nvd · unbound · debian · 12
- 1.17.1-2+deb12u3 · arm64 · bookworm-security
  Affected
  nvd · unbound · debian · bookworm; nvd · unbound · debian · 12
[unbound-anchor]Affected
Source package: [unbound]
Details (4)
- 1.17.1-2+deb12u4 · amd64 · bookworm
  Affected
  nvd · unbound · debian · bookworm; nvd · unbound · debian · 12
- 1.17.1-2+deb12u4 · arm64 · bookworm
  Affected
  nvd · unbound · debian · bookworm; nvd · unbound · debian · 12
- 1.17.1-2+deb12u3 · amd64 · bookworm-security
  Affected
  nvd · unbound · debian · bookworm; nvd · unbound · debian · 12
- 1.17.1-2+deb12u3 · arm64 · bookworm-security
  Affected
  nvd · unbound · debian · bookworm; nvd · unbound · debian · 12
[unbound-host]Affected
Source package: [unbound]
Details (4)
- 1.17.1-2+deb12u4 · amd64 · bookworm
  Affected
  nvd · unbound · debian · bookworm; nvd · unbound · debian · 12
- 1.17.1-2+deb12u4 · arm64 · bookworm
  Affected
  nvd · unbound · debian · bookworm; nvd · unbound · debian · 12
- 1.17.1-2+deb12u3 · amd64 · bookworm-security
  Affected
  nvd · unbound · debian · bookworm; nvd · unbound · debian · 12
- 1.17.1-2+deb12u3 · arm64 · bookworm-security
  Affected
  nvd · unbound · debian · bookworm; nvd · unbound · debian · 12

[Debian 13 (Trixie)]

[libunbound8]Affected
Source package: [unbound]
Details (6)
- 1.22.0-2+deb13u3 · amd64 · trixie
  Affected · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
- 1.22.0-2+deb13u3 · arm64 · trixie
  Affected · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
- 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version
  Affected · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
- 1.22.0-2+deb13u3 · arm64 · trixie-security
  Affected · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
- 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
- 1.26.2-0+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
[libunbound-dev]Affected
Source package: [unbound]
Details (6)
- 1.22.0-2+deb13u3 · amd64 · trixie
  Affected · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
- 1.22.0-2+deb13u3 · arm64 · trixie
  Affected · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
- 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version
  Affected · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
- 1.22.0-2+deb13u3 · arm64 · trixie-security
  Affected · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
- 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
- 1.26.2-0+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
[python3-unbound]Affected
Source package: [unbound]
Details (6)
- 1.22.0-2+deb13u3 · amd64 · trixie
  Affected · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
- 1.22.0-2+deb13u3 · arm64 · trixie
  Affected · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
- 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version
  Affected · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
- 1.22.0-2+deb13u3 · arm64 · trixie-security
  Affected · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
- 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
- 1.26.2-0+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
[unbound]Affected
Details (6)
- 1.22.0-2+deb13u3 · amd64 · trixie
  Affected · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
- 1.22.0-2+deb13u3 · arm64 · trixie
  Affected · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
- 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version
  Affected · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
- 1.22.0-2+deb13u3 · arm64 · trixie-security
  Affected · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
- 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
- 1.26.2-0+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
[unbound-anchor]Affected
Source package: [unbound]
Details (6)
- 1.22.0-2+deb13u3 · amd64 · trixie
  Affected · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
- 1.22.0-2+deb13u3 · arm64 · trixie
  Affected · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
- 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version
  Affected · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
- 1.22.0-2+deb13u3 · arm64 · trixie-security
  Affected · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
- 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
- 1.26.2-0+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
[unbound-host]Affected
Source package: [unbound]
Details (6)
- 1.22.0-2+deb13u3 · amd64 · trixie
  Affected · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
- 1.22.0-2+deb13u3 · arm64 · trixie
  Affected · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
- 1.22.0-2+deb13u3 · amd64 · trixie-security · Historical version
  Affected · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
- 1.22.0-2+deb13u3 · arm64 · trixie-security
  Affected · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
- 1.26.1-0+deb13u1 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13
- 1.26.2-0+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 1.26.1-0+deb13u1
  nvd · unbound · debian · 13

Observed: Oct 27, 2026, 7:12:15 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]