Advisories » MGASA-2026-0571

Updated unbound package fixes security vulnerabilities

Publication date: 02 Nov 2026
Modification date: 02 Nov 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-35501 , CVE-2026-50106 , CVE-2026-96405 , CVE-2026-97206 , CVE-2026-109125

Description

Bypass of a configured island trust anchor underneath an insecure parent
from an attacker-controlled NSEC record.
Possible insecure NXDOMAIN for non-existing records under a configured
island trust anchor underneath an insecure parent.
Aggregate DNS name chained pointer decompression work leads to
degradation of service.
DNS-over-QUIC path-migration can lead to use-after-free on
multi-threaded deployments.
Possible cache poisoning vulnerability via a cache side-channel exposed
by 'unwanted-reply-threshold'.
                

References

• https://bugs.mageia.org/show_bug.cgi?id=36568
• https://nlnetlabs.nl/projects/unbound/security-advisories/
• https://www.cve.org/CVERecord?id=CVE-2026-35501
• https://www.cve.org/CVERecord?id=CVE-2026-50106
• https://www.cve.org/CVERecord?id=CVE-2026-96405
• https://www.cve.org/CVERecord?id=CVE-2026-97206
• https://www.cve.org/CVERecord?id=CVE-2026-109125

SRPMS

10/core

• unbound-1.26.2-1.mga10