UbuntuUpdates.org

Package "python3-unbound"

Name: python3-unbound

Description:

library implementing DNS resolution and validation (Python3 bindings)
Latest version: 1.25.1-1ubuntu3.1
Release: stonking (26.10)
Level: security
Repository: universe
Head package: unbound
Homepage: https://www.unbound.net/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "python3-unbound"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "python3-unbound" in Stonking

Repository Area Version
base universe 1.25.1-1ubuntu3

Changelog

Version: 1.25.1-1ubuntu3.1 2026-11-10 16:12:22 UTC

unbound (1.25.1-1ubuntu3.1) stonking-security; urgency=medium

  * SECURITY UPDATE: Allocation of Resources Without Limits
    - debian/patches/CVE-2026-80225.patch: cap reads per event loop turn
      in util/netevent.c and services/listen_dnsport.c, deferring the rest
      with a zero-delay timer.
    - CVE-2026-80225
  * SECURITY UPDATE: Heap Buffer Overflow
    - debian/patches/CVE-2026-50252.patch: replace the per-worker outgoing
      port arrays with one shared per-interface port structure in daemon,
      worker, libunbound and outside_network.
    - CVE-2026-50252
  * SECURITY UPDATE: Out-of-bounds Write
    - debian/patches/CVE-2026-44690.patch: add a lower-bound check on the
      RRSIG label count, move the cache write after validation and add a
      bailiwick check on wildcard updates in validator/val_sigcrypt.c and
      services/cache/rrset.c.
    - CVE-2026-44690
  * SECURITY UPDATE: Allocation of Resources Without Limits
    - debian/patches/CVE-2026-32665.patch: apply the quic-size budget check
      to all DoQ streams in services/listen_dnsport.c. DoQ is not built
      in the Ubuntu package (no --with-libngtcp2), so the shipped binaries
      are not exploitable.
    - CVE-2026-32665
  * SECURITY UPDATE: Out-of-bounds Write
    - debian/patches/CVE-2026-55973.patch: stop walking past the root
      label in find_closest_of_type() in services/cache/dns.c.
    - CVE-2026-55973
  * SECURITY UPDATE: Heap Buffer Overflow
    - debian/patches/CVE-2026-40691.patch: bound the DNSCrypt reply length
      against the buffer capacity in dnscrypt/dnscrypt.c and clamp the
      TCP edns.udp_size.
    - CVE-2026-40691
  * SECURITY UPDATE: Allocation of Resources Without Limits
    - debian/patches/CVE-2026-85501.patch: add MAX_TAG_MATCHES,
      MAX_VALIDATE_NSECS, the val-validation-attempts and val-hash-attempts
      limits, val_can_restart() and DS rrset scrubbing. The
      val-clean-additional option now defaults to off.
    - CVE-2026-85501
  * SECURITY UPDATE: Heap Buffer Overflow
    - debian/patches/CVE-2026-81634.patch: include the first owner name in
      the buffer length check in rrset_canonicalize_to_buffer() in
      validator/val_sigcrypt.c.
    - CVE-2026-81634
  * d/p/replace-removed-Python-2-C-API-macros.patch: upstream fix for FTBFS
    with SWIG 4.5.0+ (LP: #2169795)

 -- Allen Huang Mon, 09 Nov 2026 14:57:41 +0000
2169795 FTBFS: unbound 1.25.1-1ubuntu3 fails to build from source in stonking because SWIG 4.5.0 removed Python 2 compatibility macros
CVE-2026-80225 In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no
CVE-2026-50252 In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the ent
CVE-2026-44690 In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during
CVE-2026-32665 In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streams on a new
CVE-2026-55973 In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from the la
CVE-2026-40691 In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound
CVE-2026-85501 Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of
CVE-2026-81634 In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRS


About   -   Send Feedback to @ubuntu_updates