CVE Tools
Track your stack

Unbound

88 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Unbound, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.

Unbound CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Unbound CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-071
2025-080
2025-090
2025-101
2025-110
2025-120
2026-010
2026-020
2026-030
2026-040
2026-0511
2026-060
2026-0724
2026-080
2026-099
2026-105
2026-110

Severity

How the 88 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical1214%
  • High2832%
  • Medium3843%
  • Low1011%

Latest CVEs

The 15 most recently published vulnerabilities affecting Unbound.

  1. CVE-2026-97206DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.7.5
  2. CVE-2026-96405Aggregate DNS name chained pointer decompression work leads to degradation of service.5.3
  3. CVE-2026-50106Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent.6.5
  4. CVE-2026-35501Bypass of a configured island trust anchor underneath an insecure parent from an atacker-controlled NSEC record.3.7
  5. CVE-2026-109125Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'5.3
  6. CVE-2026-85501Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC5.3
  7. CVE-2026-82720Use-after-free in DoH stream cleanup code path5.9
  8. CVE-2026-82717CNAME synthesis could lead to heap corruption9.8
  9. CVE-2026-81642Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY9.8
  10. CVE-2026-81634Possible heap buffer overflow during DNSSEC canonicalization7.5
  11. CVE-2026-80225Possible degradation of service from continuous queries on the same TCP/DoT connection5.3
  12. CVE-2026-78227Use-after-free in DoQ stream output buffer on reset re-transmission6.5
  13. CVE-2026-77955Possible ZONEMD verification bypass window4.4
  14. CVE-2026-77860'serve-expired' can bypass Unbound 'wait-limit'3.7
  15. CVE-2026-56444Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration5.9

Product grouping is registry-driven, with AI assist and human review. How it works