CVE-2026-97206 — Unbound 1.26.2 security release (5 CVEs)

Summary

Advisories

NLnet Labs is both the upstream project and the CNA: its advisory texts give the vulnerable ranges, and its CVE records the scores.

Not vulnerable: 1.26.2 and later. The release notes credit Kunta Chu and Jianjun Chen (Tsinghua University) for CVE-2026-97206; Qifan Zhang (Palo Alto Networks) for CVE-2026-50106 and CVE-2026-35501; Yuheng Zhang (Tsinghua University and Jingxian Technology), Jianjun Chen, Zihan Wang (Z.AI), and Kaiwen Shen (CloudItera) for CVE-2026-96405; and TaoFei Guo (Peking University) with Yang Luo and JianJun Chen (Tsinghua University) for CVE-2026-109125.

What each bug needs

• CVE-2026-97206 — a build with DNS-over-QUIC support (configured --with-libngtcp2), serving DoQ to clients, and running more than one thread. A client-triggered path migration frees the DoQ stream while a pending reply still points to it; the reply then crashes the resolver. NLnet Labs scores it as denial of service only.
• CVE-2026-50106 — a resolver configured with the root trust anchor and a trust-anchor: for an island-of-security zone whose parent is provably insecure. One forged NXDOMAIN for a name inside the island makes the validator treat it as insecure, so records in the island can be denied.
• CVE-2026-35501 — the same island configuration. A forged NSEC with the SOA bit cleared, accepted at the trust anchor apex without signature validation, makes the island insecure. The code path dates from an old fix and is removed in 1.26.2.
• CVE-2026-96405 — any resolver. An attacker who can send it queries and controls an ordinarily delegated zone serves replies with long chains of compression pointers, which costs CPU to follow; zone transfers are affected too. 1.26.2 caps the total work per packet.
• CVE-2026-109125 — unwanted-reply-threshold set above its default of 0. Unbound clears its cache when the threshold trips, so an observer can tell which upstream source port a query is using. An attacker who can also keep a concurrent query window open can then guess the query ID and poison the cache. NLnet Labs rates it an adjacent-network attack of high complexity, unreliable against a public resolver at the suggested threshold of 10 million.

Patch status

A row is Fixed once its Unbound carries the fix for every one of the five CVEs that applies to its version — 1.26.2 or later, or a distribution package with the patches backported. Releases before 1.22.0 are outside CVE-2026-97206’s range, so four apply to them. A package with only some of the fixes stays vulnerable.

Current version is what the release ships today; First fixed is the first build that carried the fixes, and Fixed since the date it became available.

Unbound

Unbound has a single release track, and NLnet Labs fixes only the newest release: a host on an older Unbound gets no further upstream release and has to move to 1.26.2 or rely on its distribution’s backports.

For operators building from source, NLnet Labs publishes a patch per CVE, tested against 1.26.1 and linked from each advisory. For CVE-2026-97206, CVE-2026-50106, and CVE-2026-96405 there is a minimal patch and one with the surrounding code improvements (_with); CVE-2026-109125 and CVE-2026-35501 have a single patch each.

Debian

The Debian security tracker is the authoritative source for per-suite status; it carries a page per CVE, and the five agree suite for suite. sid took the 1.26.2 release, whose changelog names all five CVEs; trixie followed via a DSA-6581-1 security upload; forky inherited sid’s fix through the normal testing migration. bookworm needs a security upload of its own.

bookworm’s 1.17 predates CVE-2026-97206’s range, but the security tracker still lists the suite as vulnerable to it. Either way, the other four apply to bookworm.

Debian’s packages are built without DNS-over-QUIC support, so CVE-2026-97206 cannot be reached on a Debian package.

A default Debian install validates against the root trust anchor only; the two trust-island bugs need an island anchor the operator added.

pkgsrc

The pkgsrc tree (NetBSD’s package collection, also used on SmartOS, macOS via pkgin, and elsewhere) ships Unbound as net/unbound. pkgsrc-2026Q3, the current quarterly branch, receives fixes by pull-up from pkgsrc-current.

The package has no DNS-over-QUIC option, so CVE-2026-97206 cannot be reached on a pkgsrc build. It ships no trust anchor configuration of its own either: whether a host validates, and against which anchors, is up to its operator.

The identifier carries an nbN suffix when the package’s PKGREVISION is set. That revision bumps for many reasons besides security patches — recursive bumps for shared-library ABI changes, dependency and build-system tweaks — so an nbN suffix on its own says nothing about these CVEs.

NixOS

nixpkgs builds Unbound from a single expression, pkgs/by-name/un/unbound/package.nix; the unbound, unbound-with-systemd, and unbound-full attributes all take their version from it, so one row per channel covers every variant.

Only unbound-full is built with DNS-over-QUIC support. The NixOS services.unbound module runs unbound-with-systemd by default, so CVE-2026-97206 reaches a NixOS host only when services.unbound.package is a DoQ-enabled build such as unbound-full, and the configuration serves DoQ with more than one thread.

The module enables the root trust anchor by default (enableRootTrustAnchor = true); the two trust-island bugs need an additional anchor in services.unbound.settings.

nixpkgs-unstable is the channel for Nix users outside NixOS — on macOS or another Linux distribution. A channel row’s Fixed since is the date that channel published its first release containing the fix; a branch row’s is the date the fix was merged into that branch.

Flake users

A flake input such as github:NixOS/nixpkgs/nixos-unstable follows the branch of that name, which moves with the channel — so the channel’s row answers for it. An input on master or release-26.05 gets the fix as soon as it lands there, before any channel publishes it.

Detection

First check the version. A build at or past 1.26.2 is fixed; a distribution build is fixed only once the table above says so.

unbound -V

The first line is the version. The same output’s Configure line shows whether the build has DNS-over-QUIC support: CVE-2026-97206 needs --with-libngtcp2 there.

unbound -V | grep -c -- --with-libngtcp2

A count of 0 means no DoQ support and no exposure to CVE-2026-97206. A DoQ-capable build is exposed only while it serves DoQ to clients and runs more than one thread. DoQ is served on the interfaces configured with the quic-port as their @port (853 unless changed); a quic-port of 0 disables it:

unbound-checkconf -o quic-port

num-threads defaults to 1, so exposure also needs an explicit setting above 1:

unbound-checkconf -o num-threads

CVE-2026-109125 needs unwanted-reply-threshold above 0, which is not the default:

unbound-checkconf -o unwanted-reply-threshold

CVE-2026-50106 and CVE-2026-35501 need a trust anchor for a zone other than the root: a trust-anchor:, trust-anchor-file:, auto-trust-anchor-file:, or trusted-keys-file: line in the configuration naming some zone below .. A resolver that validates against the root anchor alone is not exposed to either.

CVE-2026-96405 needs no particular configuration: every recursive resolver follows compression pointers in the replies it fetches, and an attacker needs only to make it query a zone they control.

Distribution packages keep the upstream version and bump their own revision for a backport. The installed package version is what to compare against the table — on Debian:

dpkg-query -W -f='${Version}\n' unbound

On pkgsrc, where the identifier is unbound-<version> plus an nb<PKGREVISION> suffix when one is set:

pkg_info -e unbound

On NixOS, unbound -V above reports the version built into the system closure; compare it with the channel’s row.

Mitigation

The real fix is Unbound 1.26.2, or a distribution package with the patches. NLnet Labs lists no configuration workaround for any of the five; until a fixed build is installed:

• CVE-2026-97206 — a resolver that does not serve DoQ (quic-port: 0, or no interface on the QUIC port) is not reachable, and neither is one running a single thread. Both are configuration choices with their own costs, not fixes.
• CVE-2026-109125 — exposure exists only while unwanted-reply-threshold is set; the default is off.
• CVE-2026-96405 — limiting who can query the resolver (access-control) narrows who can start a lookup of an attacker’s zone. It does not remove the risk: any client, and anything that makes a client resolve a name, still can.
• CVE-2026-50106 and CVE-2026-35501 — no workaround short of dropping the island trust anchor, which gives up the protection it was configured for.

A configuration change does not change a row’s status above: only an Unbound build with the fixes does.

Verification log

Every verdict in the table above is backed by a checkable source. This log records the provenance — the advisory, repository index, or git reference that established each fact — so any row can be audited or reproduced. Most readers never need it.

References