-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

============================================================================= FreeBSD-SA-26:33.unbound Security Advisory
The FreeBSD Project

Topic: Multiple vulnerabilities in unbound

Category: contrib
Module: unbound
Announced: 2026-06-09
Affects: All supported versions of FreeBSD
Corrected: 2026-05-26 16:48:51 UTC (stable/15, 15.1-STABLE)
2026-05-28 22:16:07 UTC (releng/15.1, 15.1-RC2)
2026-06-09 19:19:52 UTC (releng/15.0, 15.0-RELEASE-p10)
2026-05-26 16:49:56 UTC (stable/14, 14.4-STABLE)
2026-06-09 19:19:14 UTC (releng/14.4, 14.4-RELEASE-p6)
2026-06-09 19:18:44 UTC (releng/14.3, 14.3-RELEASE-p15)
CVE Name: CVE-2026-32792, CVE-2026-33278, CVE-2026-40622,
CVE-2026-41292, CVE-2026-42534, CVE-2026-42923,
CVE-2026-42944, CVE-2026-42959, CVE-2026-42960,
CVE-2026-44390, CVE-2026-44608

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the following sections, please visit <URL:https://security.FreeBSD.org/>.

I. Background

Unbound is a validating, recursive, and caching DNS resolver
included in the FreeBSD base system as an optional service called local_unbound.

II. Problem Description

Multiple vulnerabilities have been reported in Unbound. Instead of
listing detailed writeups for each issue, please see the upstream
advisories referenced below.

CVE-2026-33278 - Possible remote code execution during DNSSEC
validation
CVE-2026-42944 - Heap overflow and crash with multiple nsid,
cookie, padding EDNS options
CVE-2026-42959 - Crash during DNSSEC validation of malicious
content
CVE-2026-32792 - Packet of death with DNSCrypt
CVE-2026-44608 - Use-after-free and crash in RPZ code
CVE-2026-40622 - "Ghost domain name" variant
CVE-2026-42960 - Possible cache poisoning while following
delegation
CVE-2026-41292 - Parsing a long list of incoming EDNS options
degrades performance
CVE-2026-42534 - Jostle logic bypass degrades resolution
performance
CVE-2026-42923 - Degradation of service with unbounded NSEC3 hash
calculations
CVE-2026-44390 - Unbounded name compression causes degradation of
service

III. Impact

The issues range from Denial of Service (DoS) through resource exhaustion or crashes to possible remote code execution during DNSSEC validation. See the upstream Unbound advisories for specific details.

IV. Workaround

No workaround is available. Systems not running the local_unbound service
are not affected.

V. Solution

Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date,
and restart the local_unbound service.

Perform one of the following:

1) To update your vulnerable system installed from base system packages:

Systems running a 15.0-RELEASE version of FreeBSD on the amd64 or arm64 platforms, which were installed using base system packages, can be updated
via the pkg(8) utility:

# pkg upgrade -r FreeBSD-base

2) To update your vulnerable system installed from binary distribution sets:

Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms which were not installed using base system packages can be updated via the freebsd-update(8) utility:

# freebsd-update fetch
# freebsd-update install

3) To update your vulnerable system via a source code patch:

The following patches have been verified to apply to the applicable
FreeBSD release branches.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

# fetch https://security.FreeBSD.org/patches/SA-26:33/unbound.patch
# fetch https://security.FreeBSD.org/patches/SA-26:33/unbound.patch.asc
# gpg --verify unbound.patch.asc

b) Apply the patch. Execute the following commands as root:

# cd /usr/src
# patch < /path/to/patch

c) Recompile the operating system using buildworld and installworld as described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.

Restart the applicable daemons, or reboot the system.

VI. Correction details

This issue is corrected as of the corresponding Git commit hash in the following stable and release branches:

Branch/path Hash Revision
- ------------------------------------------------------------------------- stable/15/ d2a10ff4cb84 stable/15-n283689 releng/15.1/ 1b6c85cfac36 releng/15.1-n283539 releng/15.0/ 6160bd311a1b releng/15.0-n281060 stable/14/ de9d7a2ab8f5 stable/14-n274187 releng/14.4/ 857abc12945a releng/14.4-n273722 releng/14.3/ a68c183e0ad2 releng/14.3-n271522
- -------------------------------------------------------------------------

Run the following command to see which files were modified by a
particular commit:

# git show --stat <commit hash>

Or visit the following URL, replacing NNNNNN with the hash:

<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>

To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:

# git rev-list --count --first-parent HEAD

VII. References

<URL:https://www.cve.org/CVERecord?id=CVE-2026-32792> <URL:https://www.cve.org/CVERecord?id=CVE-2026-33278> <URL:https://www.cve.org/CVERecord?id=CVE-2026-40622> <URL:https://www.cve.org/CVERecord?id=CVE-2026-41292> <URL:https://www.cve.org/CVERecord?id=CVE-2026-42534> <URL:https://www.cve.org/CVERecord?id=CVE-2026-42923> <URL:https://www.cve.org/CVERecord?id=CVE-2026-42944> <URL:https://www.cve.org/CVERecord?id=CVE-2026-42959> <URL:https://www.cve.org/CVERecord?id=CVE-2026-42960> <URL:https://www.cve.org/CVERecord?id=CVE-2026-44390> <URL:https://www.cve.org/CVERecord?id=CVE-2026-44608>

The latest revision of this advisory is available at <URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-26:33.unbound.asc> -----BEGIN PGP SIGNATURE-----

iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmooiWwbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrv5ZcQAMqhP1F0oVdGJ4ZlTusj An1CAKA3CO3TKt6jrbnTbnw4s1+9kKjwABGcrZw/0sdoq+e0DzhlG8uI9Pol46d8 ANgWVa0T2d4rTDxCRJZZsqxqDfd3PwpGbUPzNNptxnJxWSR5j87m0N6PcMddCBFc BKg8vdeOJDPky+khcNwXG/g52HcNheXPqzTgq1IMuYrNId4Xrp6pnKbpIPeEYXgj 6+GWIBz20B1qtEwNnjkDdqoHYK143SZcZzapO9QFmo+Su/tVJ+/ymEtFcY7Ze7JB Hm8jiBIX3S7emFLyUPvAAiY5Oh84IgpazGXhljDGc8R9Wt/ipoDfBSYmGUl9ZNFH 0haadzi5JdQmbqCANURXc7t81miGEI4LDKTcJaIkP0ITVxktENyr5YIpSh/OQEI0 NbAI+ASPp8eVI15YxVaKd0HIdjsGZPY0eRQymMAC55yponTu35aKFc+RG2xCVZat JPzrp50ZjmTxNMFt1MMPgZTZQxQC14iONT8LVymnG7cgAsjXGw2X7gjRWRMdC4Hb EezcuwDnHwYAWzD41+1W7WpyMXXdCW8gaIpcLzl41egTpTe932J++9va7RU1R86e VlqcpvxmEtu7shIvepFHi12l2JNsqsYLmhsYVoUJsMAOHQck2eUXOqfZ4+aQGwye cL48Uk5LxTjYEHENCtOKOm3e
=7uMj
-----END PGP SIGNATURE-----


--- PyGate Linux v1.5.15
* Origin: Dragon's Lair, PyGate NNTP<>Fido Gate (3:633/10)