NLnet Labs reports:
This release consolidates security fixes for issues reported
over a period of time. There are fixes for:
- CVE-2026-14586: Assertion in libngtcp2 when under pressure
in high concurrency DNS-over-QUIC environments.
- CVE-2026-32665: Remote DNS-over-QUIC denial of service due to
quic-size budget bypass.
- CVE-2026-40691: Packet of death for DNSCrypt over TCP.
- CVE-2026-41637: Degradation of resolution service from
improperly accounted client-terminated DNS-over-QUIC
queries.
- CVE-2026-42955: Extra fix for CVE-2026-40622 to also clamp the
TTL of A/AAAA records disallowing a one-time 'ghost domain'
delegation renewal via glue records.
- CVE-2026-44621: Libunbound applications configured with
'unwanted-reply-threshold' could eventually be abruptly
terminated.
- CVE-2026-44687: Off-by-one error in 'harden-below-nxdomain'
logic can shadow a stub/forward zone by a legitimate parent's
NXDOMAIN.
- CVE-2026-44690: Cross-zone wildcard cache poisoning via
RRSIG.labels manipulation.
- CVE-2026-46582: A wildcard replay, as another piece of data,
triggers poisoning in the serve expired reply path.
- CVE-2026-50045: 'max-global-quota' reset by DNSSEC validation
restarts.
- CVE-2026-50046: Possible heap use-after-free in an error path
when a DoT forwarded query is jostled out.
- CVE-2026-50243: 'response-ip'/'rpz' can rewrite BOGUS answers
instead of returning SERVFAIL.
- CVE-2026-50248: BOGUS configured primary hostname accepted for
XFR in auth/rpz zones.
- CVE-2026-50251: Attacker supplied 0.0.0.0/:: glue triggers
defensive full-cache flush.
- CVE-2026-50252: Possible cache poisoning attack by mapping
source port population per thread.
- CVE-2026-52863: Memory corruption could lead to crash and
denial of service.
- CVE-2026-54478: DNS Cookie bypass when combined with
proxy-protocol use.
- CVE-2026-55708: Privacy/configuration issue when adding local
data in views through 'unbound-control'.
- CVE-2026-55717: 'serve-expired-client-timeout' and 'response-ip'
CNAME redirect could lead to a crash.
- CVE-2026-55973: 'dns-error-reporting: yes' leads to stack
buffer overflow.
- CVE-2026-55990: Packet of death for a DNSCrypt misconfigured
Unbound.
- CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control
assertion failure in libngtcp2.
- CVE-2026-56416: Possible heap buffer overflow when validator
canonicalizes RDATA that contains domain name.
- CVE-2026-56444: Degradation of resolution service when
'discard-timeout' and 'serve-expired-client-timeout' are
combined in unusual configuration.