Software-update: Unbound 1.26.0

Als je een DNS-look-up uitvoert, begint een recursor in eerste instantie met het stellen van de look-upvraag aan een DNS-rootserver. Deze kan dan doorverwijzen naar andere servers, vanaf waar weer doorverwezen kan worden naar andere servers enzovoort, totdat uiteindelijk een server is bereikt die het antwoord weet, of weet dat de look-up niet mogelijk is. Van dit laatste kan sprake zijn als de naam niet bestaat of de servers niet reageren. Het proces van het langslopen van verschillende authoritative servers heet recursie. Unbound is een DNS-recursor met ondersteuning voor moderne standaarden, zoals Query Name Minimisation, Aggressive Use of Dnssec-Validated Cache en authority zones. Versie 1.26.0 is uitgebracht en hier zijn de volgende veranderingen en verbeteringen in aangebracht:

Features

• Update icannbundle.pem certificates in unbound-anchor. It has the public keys for 2009 to 2029 and for 2025 to 2045.
• Fix to add `max-transfer-size` and `max-transfer-time` that limit auth-zone and rpz transfer amount and time taken. Default is disabled. This hardens against unbounded transfers.
• Merge #1087: Overload `local_data_remove` to support removing specific records.
• Merge #1433 from jisakiel: Add new static zone type block_aaaa to suppress AAAA queries.
• Fix #1477: respip + dns64: dns64 uses A records modified by respip instead of original A records. Adds local-zone types block_a_wdata and block_aaaa_wdata, that are like block_a and block_aaaa, and uses local-data if present.

Bug Fixes

• Fix windows 64bit build for libssp dependency.
• iana portlist updated.
• Fix for Heap Out-of-Bounds Write via size_t-to-int Truncation in setup_if() - outside_network_create(). This fixes that large values for num_ports do not overflow and create invalid references after integer truncation.
• Fix to clean up log ids after a failure to start a worker thread.
• Fix to relax assertions after the TTL 0 handling change. This relaxes an assertion in cachedb (it fails instead), and for packet_rrset_copy_region.
• Fix comment and verbose logging for EDNS fallback buffer size.
• Fix man page entry for so-sndbuf, it is for responses sent out.
• Fix val_find_DS for robustness, to check the result of packet_rrset_copy_region before using it.
• Fix that for dns64 answers, the AAAA query is checked to be DNSSEC validated, when DNSSEC is enabled. This improves the RFC6147 conformance of Unbound.
• Fix for allocation-failure hardening of rrset cache wildcard storage and canonical NSEC owner replacement.
• Fix DNSSEC validation with libnettle for noncanonical RSA DNSKEYs with leading zeroes for n.
• Fix DNSKEY size calculation for noncanonical RSA DNSKEYs with leading zeroes for n.
• Fix for mixed class referrals, the resolver uses the query class.
• Unit test for CVE-2026-33278.
• Unit test for CVE-2026-42944.
• Unit test for CVE-2026-42959.
• Unit test for CVE-2026-40622.
• Unit test for CVE-2026-42960.
• Fix in depth for serve-expired responses from cachedb, that it does not store bogus.
• Fix lame server detection, for selfpointed glue records.
• Fix cleaning up DoH session. The same query can be on multiple streams in a session.
• Fix for signed same-owner CNAME and ordinary RRset responses.
• Fix for mesh new client and mesh new callback to rollback the added address, tcp mesh state and callback when there is a failure to initialize. This fixes the mesh accounting of reply addresses.
• Fix for autotrust state-file line overflow, that can give hold-down bypass.
• Fix to limit the DSNS per-label walk in the iterator.
• Fix that the ratelimit is decremented on successful referrals.
• Fix that msgencode insert_query has the correct assertion, for a local_alias.
• Fix to reset the tcp-timeout before applying a load based reduction.
• Fix to decrement the per-netblock tcp connection limits, so it keeps usable.
• Fix manual to document ratelimit, that it is for target nameservers for a domain, and keeps queries limited.
• Fix, in depth, for respip rewrite of dns64 responses.
• Fix that dns64 with subnetcache does not write ECS scoped answers to global cache.
• Fix ipset module for name too long checks, race conditions on local name buffer, and for socket close race condition.
• Fix that validator caps number of ANY RRsets it can validate, and the wait timer is shortened.
• Fix analyzer warning in mesh_new_client.
• Fix #1457: race condition causes segfault when starting threads.
• Fix header_seen detection for trust anchor files, so that it detects the id line.
• Fix unit test to check for new icannbundle.pem.
• Fix const as reported by newest compiler warnings.
• Fix that the processing of class responses does not have a heap use-after-free. That could happen if at least two distinct classes are configured for resolution.
• Fix negative cache to work with NSEC3 records without salt.
• Fix parse of svcbparam ech, it had incorrect length.
• Fix that quotation and escaping works the same in auth-zone url content, as in the zonefile read.
• Fix ipset module to use larger domain name buffers, and check buffer lengths.
• Fix PROXYv2 header read and consume, it checks the header size.
• Fix negative cache NSEC3 nodata proof, to use the correct message size.
• Fix fast_reload for when a ZONEMD lookup is in progress.
• Fix that validation canonicalization of domain names in rdata checks for buffer bounds.
• Fix that dump_cache has a larger buffer for records, and it checks that an owner name does not collide with BADRR on the input, and changes verbosity on the log of failure in rrset to string.
• Fix that dns64 cleans up the allocated message if the adjust routines fail, and checks if there is a reply before cache store, also unbound checks if A and AAAA are malformed for auth-zones.
• Fix unit test for ecs to check for malloc success.
• Fix pythonmod script read for numeric overflow.
• Fix warnings with gcc in compat/inet_pton.c.
• Fix for #1306: configure detects specifically the call to SSL_set_quic_tls_early_data_enabled and SSL_set_quic_early_data_enabled, so the correct one is used.
• Fix for #1306: configure checks if the ngtcp2_crypto_ossl header file is available, and prints an error otherwise.
• Fix #1437: Fix compile with OpenSSL 4.0.1.
• Fix compile for OpenSSL 1.0.2 and before in server cleanup.
• Fix that for auth-zone and rpz zones the allow-notify addresses and netblocks are available from start, and fix the probe step skip.
• Fix perform a full transfer every number of incremental transfers, to stop increasing memory usage, for rpz zones.
• Fix assertion failure for long HTTP header that fills buffer.
• Fix buffer overflow when configured with lower than default size and http transfer.
• Fix that misconfigured `iter-scrub-ns: 0` causes request failures.
• Fix that fast_reload when a zonemd verification lookup it in progress with subnet loaded, deregisters the callback.
• Fix for fast_reload that removes an auth zone while its lookups are in progress, for a primary name. Also after the change, it no longer picks up the old results.
• Fix integer overflow in infra-cache-max-rtt calculation.
• Fix erroneous DNS error report values after bogus AAAA query caused error information that was not cleared by a successful A subquery.
• Fix integer overflow for very high values of `sock-queue-timeout`.
• Fix that fast_reload does not terminate the server for errors in config, for key files.
• Fix log of an aliased qname, to not use freed region memory.
• Fix DNAME synthesis from cache that keeps use of 0TTL entries in a sliding window. It did not surpass RRSIG expiry.
• Fix misconfigured ipsecmod hook causing path name similarity with other file. The ipsecmod is changed for exec of the hook. The ipsecmod hook, if a script, has to start now with a line like `#!/bin/sh`.
• Fix that dns64 bypasses rpz-passthru rule during synthesis. This restricted more than necessary.
• Fix to disallow $INCLUDE for secondary zones. Start up of server continues if a secondary zone fails to load. Failed loads clear the zone data, so there is no partial zone.
• Fix that when SVCB records cannot be written out, and are written in unknown format, that the zone read allows such unknown format SVCB records.
• Fix that a half-written trust anchor file does not crash the server at runtime. It unlinks a wrong file from the list.
• Fix that auth-zone, and RPZ zones, do not allow out-of-zone records. These are records that are not under the zone apex. The out-of-zone records are dropped from the zone contents.
• Fix that dns64 does not ignore the `forward-no-cache` and `stub-no-cache` options.
• Fix that a signed wildcard NSEC, is checked before use, so it does not allow insecure DS proofs inappropriately.
• Fix that after malloc failure a half-built local_alias does not crash the server.
• Fix that for a zonefile only zone, if that file does not exist on server start, the server continues to start with a warning log message.
• Fix that after malloc failure in RPZ load a half built list does not crash later. The newly created RRset is linked after creation has succeeded.
• Fix that dnscrypt configuration does not crash, due to inconsistency between secret and public keys. Also duplicate files are skipped.
• Fix locking in libunbound ub_ctx_set_event call.
• Fix that libunbound pipe functions fail with error after an event base is set.
• Fix for neater solution to clear log thread id after worker init failure.
• Fix incorrect cleanup after an allocation failure for a delegation point.
• Fix that after malloc failure in find_tag_datas, the local_alias is cleaned up.
• Fix that after shared memory cannot be created, from `shm-enable`, the server does not crash.
• Fix incorrect cleanup after an allocation failure for a delegation point in a region.
• Fix after malloc failure the rrset_insert_rr in localzone processing, during RPZ qname trigger processing, the RRset retains its previous data correcly.
• Fix for #1462: Fix that auth primary host name lookup allows CNAMEs.
• Fix memory leak on DNAME 0TTL records.
• Fix that after fast_reload the disown of the auth zone transfer task cleans the chunk list. Also fix the auth_transfer_limit test to use a forwarder for each type of failure, so the one is not blocked by the other waiting.
• Fix to remove debug from auth_transfer_limit test.
• Fix that unbound-checkconf checks if an auth-zone download can overwrite another file, by filename collision.
• Fix that malloc failure in auth-zone insert rr does not create an empty node and does not cause an infinite loop.
• Fix that unbound-control auth_zone_reload stops the server answering from the zone after a failure to read.
• Fix that malloc failure in dns64_inform_super does not set up a half-built reply for cache store, that could lead to a crash.
• Fix that malloc failure for new_local_rrset for RPZ qname trigger RR insert does not crash. It does not link a partial RRset, and logs an error on failure, and cleans up the dname allocation.
• Fix that malloc failure in doq connection setup, does not crash in doq connection delete later.
• Fix that malloc failure for ngtcp2_conn_server_new cleans up reference that older ngtcp2 versions can leave.
• Fix that on malloc failure during accept of TCP, the socket is not left to cause a read event loop. It uses slow-accept to delay accepting new connections, if that fails it drops the new connections. When the tcp connection usage is full, it waits for 50msec, to allow existing queries to be resolved.
• Fix that malloc failure for rpz_strip_nsdname is checked and handled, so that it does not crash later.
• Fix that malloc failure during edns subnet addrtree insert is checked, so it does not crash later.
• Fix to check the return value of auth_xfer_create during fast_reload auth-zone add and change processing.
• Fix to check for malloc failure in rpz response create, for nodata and nxdomain, so it does not crash later.
• Fix that fast_reload does not terminate the server on malloc failure for dnstap, or if gethostname fails.
• Fix after malloc failure for stats, then it drains the pipe so the internal messaging stays correct. Also it does not exit the server if stats pipe communication fails.
• Fix that fast_reload does not terminate the server on config read failure after malloc failure.
• Fix that fast_reload does not terminate the server if random init for DNS cookies fails. The data is only random generated if cookies are enabled, and the random data is necessary.
• Fix for #1457: fix thread setname for thread start of dnstap, and fast_reload.
• Fix to update github ci actions/checkout to v7.
• Fix warning about file_string_matches in unbound-checkconf.
• Merge #1465 from dag-erling: Add libunbound/remote.h. Add a shared header containing prototypes for functions that both ends of a remote control connection need to implement.
• Merge #1467: daemon: fix DEREF_AFTER_NULL.EX.COND on worker_init. This fixes error handling if the worker stat_timer allocation has an out of memory error. That makes the server not crash later, attempting to use it.
• Fix #1469: dohclient: DoH POST missing content-length → :status 400 from strict resolvers (Cloudflare, Mullvad).
• Merge #1383 from jdek: Fix randomness generation on macOS/iOS under chroot.
• Fix unit test for malformed svcb for test on Windows.
• Merge #1475 from petrvaganoff: ipsecmod: fix deref on null in ipsecmod-whitelist after OOM.
• Fix #1474: DoQ responses are never padded - pad-responses does not apply to comm_doq (RFC 9250 §5.4 MUST).
• Merge #1476 from petrvaganoff: ipsecmod: fix possible deref on null after reply_find_answer_rrset().
• Unit test for CVE-2026-42955.
• Unit test for CVE-2026-44687.
• Unit test for CVE-2026-44690.
• Unit test for CVE-2026-46582.
• Unit test for CVE-2026-50045.
• Unit test for CVE-2026-50243.
• Unit test for CVE-2026-50248.
• Unit test for CVE-2026-55717.
• Unit test for CVE-2026-55973.
• Unit test for CVE-2026-56416.
• Fix error in log printout in fix for CVE-2026-50248, when the primary name is bogus.
• Updated credits for Xuanchao Xie in 22 july changelog.
• Merge #1478 from petrvaganoff: pythonmod: add check return value after ftell().
• Fix that for NSEC3 proofs the NSEC3 zone, as the b32.name is checked to be the same as the signer name. Also RRSIGs are not considered valid when an NSEC3 is not b32.signerzone.
• Fix that the aggressive negative cache does not insert NSEC records with overreaching next owner name. Also the result is not above the trust anchor's bailiwick. Also RRSIGS are not considered valid when an NSEC next owner name is not under the signer zone name.
• Fix mesh cycle detection for configuration with respip CNAME loop and tagged clients. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
• Unit test for block_a and block_aaaa.
• Fix to allow test fake sha1 on systems with possible sha1 support.
• Fix to use sha256 for unbound-anchor unit test.
• Fix unbound-anchor check for return value of X509_NAME_get_text_by_NID of the emailaddress.
• Fix lock test protect for auth zone change.
• Fix to lock shared_ports structure during initialisation.
• Fix to lock anchor structure when file is set for it in parse of the header.
• Merge #1480 from petrvaganoff: authzone: fix memory leak in xfer_set_masters() error path.
• Fix unused variable warnings in shared_ports_fetch_random and shared_ports_return_port when compiled without threads.
• Fix to guard access to shared ports interface array during set up, for analyzer.
• Fix sign of comparison warning in shared ports setup.
• Fix #1481: Fix to use tls-port after referral if tls-upstream is set.
• Merge #1479 from psumbera: Fix pthread detection on Solaris 11.4.
• Fix to call OPENSSL_cleanup on exit when that is defined.

Versienummer	1.26.0
Releasestatus	Final
Besturingssystemen	Linux, BSD, macOS, Solaris, Windows 10, Windows Server 2016, Windows Server 2019, Windows 11, Windows Server 2022, Windows Server 2025
Website	Stichting NLnet Labs
Download	https://nlnetlabs.nl/projects/unbound/download/
Licentietype	Voorwaarden (GNU/BSD/etc.)