Ubuntu patches ten Unbound DNS resolver vulnerabilities across all LTS releases
Ubuntu has released security updates for Unbound addressing ten CVEs, including denial-of-service flaws and a cache poisoning vulnerability, affecting all supported LTS releases back to 14.04.
Summary
Ubuntu published USN-8946-1 to fix multiple vulnerabilities in Unbound, a validating recursive DNS resolver. The flaws range from denial-of-service conditions triggered by malformed TCP connections, DNS responses, DNSCrypt packets, EDNS options, and DNS-over-QUIC connections, to a cache poisoning issue and two older DNSSEC-related bugs. Affected releases span Ubuntu 26.04 LTS through 14.04 LTS, with fixes available in standard repositories for newer releases and via Ubuntu Pro for older ones.
Vulnerabilities and affected releases
- CVE-2026-80225: TCP connection handling flaw causing resource exhaustion; affects 26.04, 24.04, 22.04, 20.04
- CVE-2026-81634: DNS response handling crash
- CVE-2026-85501: DNSSEC validation resource exhaustion
- CVE-2026-50252: Outgoing network port handling crash
- CVE-2026-40691: DNSCrypt packet crash; affects 26.04 through 18.04
- CVE-2026-44690: Cache poisoning via cached DNS responses; affects 26.04 through 20.04
- CVE-2026-32665: DNS-over-QUIC resource exhaustion; 26.04 only
- CVE-2026-55973: EDNS options crash; 26.04 only
- CVE-2023-50387: DNSSEC validation DoS (KeyTrap); affects 18.04, 16.04, 14.04
- CVE-2023-50868: NSEC3 closest encloser proof DoS; affects 18.04, 16.04, 14.04
Why it matters
Unbound is widely deployed as a recursive resolver and DNSSEC validator; these flaws expose both public-facing and internal DNS infrastructure to remote denial-of-service and, in one case, cache poisoning. The broad LTS coverage, including end-of-life releases via Ubuntu Pro, reflects the resolver's long deployment tail in enterprise and ISP environments.
Original reference: ubuntu.com →