# Ubuntu patches ten Unbound DNS resolver vulnerabilities across all LTS releases

> **Key takeaway:** Ubuntu has released security updates for Unbound addressing ten CVEs, including denial-of-service flaws and a cache poisoning vulnerability, affecting all supported LTS releases back to 14.04.

**Published:** 2026-10-21T09:48:45+00:00 
**Source:** Ubuntu Security & Release Notices 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/ubuntu-patches-ten-unbound-dns-resolver-vulnerabilities-acro.html 

## Summary
Ubuntu published USN-8946-1 to fix multiple vulnerabilities in Unbound, a validating recursive DNS resolver. The flaws range from denial-of-service conditions triggered by malformed TCP connections, DNS responses, DNSCrypt packets, EDNS options, and DNS-over-QUIC connections, to a cache poisoning issue and two older DNSSEC-related bugs. Affected releases span Ubuntu 26.04 LTS through 14.04 LTS, with fixes available in standard repositories for newer releases and via Ubuntu Pro for older ones.

## Vulnerabilities and affected releases
- **CVE-2026-80225**: TCP connection handling flaw causing resource exhaustion; affects 26.04, 24.04, 22.04, 20.04
- **CVE-2026-81634**: DNS response handling crash
- **CVE-2026-85501**: DNSSEC validation resource exhaustion
- **CVE-2026-50252**: Outgoing network port handling crash
- **CVE-2026-40691**: DNSCrypt packet crash; affects 26.04 through 18.04
- **CVE-2026-44690**: Cache poisoning via cached DNS responses; affects 26.04 through 20.04
- **CVE-2026-32665**: DNS-over-QUIC resource exhaustion; 26.04 only
- **CVE-2026-55973**: EDNS options crash; 26.04 only
- **CVE-2023-50387**: DNSSEC validation DoS (KeyTrap); affects 18.04, 16.04, 14.04
- **CVE-2023-50868**: NSEC3 closest encloser proof DoS; affects 18.04, 16.04, 14.04

## Why it matters
Unbound is widely deployed as a recursive resolver and DNSSEC validator; these flaws expose both public-facing and internal DNS infrastructure to remote denial-of-service and, in one case, cache poisoning. The broad LTS coverage, including end-of-life releases via Ubuntu Pro, reflects the resolver's long deployment tail in enterprise and ISP environments.