An update for unbound is now available for openEuler-22.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-4151 Final 1.0 1.0 2026-09-30 Initial 2026-09-30 2026-09-30 openEuler SA Tool V1.0 2026-09-30 unbound security update An update for unbound is now available for openEuler-22.03-LTS-SP4 Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn't make custom builds or provide specific features to paying customers only. Security Fix(es): In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.(CVE-2026-80225) In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNSSEC validation), can trigger the vulnerability.(CVE-2026-81634) In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.(CVE-2026-82717) An update for unbound is now available for openEuler-22.03-LTS-SP4. openEuler Security has rated this update as having a security impact of critical. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Critical unbound https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4151 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-80225 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-81634 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-82717 https://nvd.nist.gov/vuln/detail/CVE-2026-80225 https://nvd.nist.gov/vuln/detail/CVE-2026-81634 https://nvd.nist.gov/vuln/detail/CVE-2026-82717 openEuler-22.03-LTS-SP4 python3-unbound-1.13.2-28.oe2203sp4.aarch64.rpm unbound-1.13.2-28.oe2203sp4.aarch64.rpm unbound-anchor-1.13.2-28.oe2203sp4.aarch64.rpm unbound-debuginfo-1.13.2-28.oe2203sp4.aarch64.rpm unbound-debugsource-1.13.2-28.oe2203sp4.aarch64.rpm unbound-devel-1.13.2-28.oe2203sp4.aarch64.rpm unbound-help-1.13.2-28.oe2203sp4.aarch64.rpm unbound-libs-1.13.2-28.oe2203sp4.aarch64.rpm python3-unbound-1.13.2-28.oe2203sp4.x86_64.rpm unbound-1.13.2-28.oe2203sp4.x86_64.rpm unbound-anchor-1.13.2-28.oe2203sp4.x86_64.rpm unbound-debuginfo-1.13.2-28.oe2203sp4.x86_64.rpm unbound-debugsource-1.13.2-28.oe2203sp4.x86_64.rpm unbound-devel-1.13.2-28.oe2203sp4.x86_64.rpm unbound-help-1.13.2-28.oe2203sp4.x86_64.rpm unbound-libs-1.13.2-28.oe2203sp4.x86_64.rpm unbound-1.13.2-28.oe2203sp4.src.rpm In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain. 2026-09-30 CVE-2026-80225 openEuler-22.03-LTS-SP4 Medium 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L unbound security update 2026-09-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4151 In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNSSEC validation), can trigger the vulnerability. 2026-09-30 CVE-2026-81634 openEuler-22.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H unbound security update 2026-09-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4151 In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution. 2026-09-30 CVE-2026-82717 openEuler-22.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H unbound security update 2026-09-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4151