BlackTreeLifecycle intelligence
Evidence-linked product lifecycle intelligenceSUPPORT · SECURITY · RETIREMENT
← Lifecycle catalogue
DEBIAN SECURITY ADVISORYDEBIANVERIFIED

PUBLISHER UPDATE · DSA-6581-1

DSA-6581-1 release notes and known issues

DSA-6581-1 unbound - security update

Scope: Debian. This update record adds version, fix and known-issue context. Its publication date is not a lifecycle boundary.

Summary

Multiple security vulnerabilities were discovered in Unbound, a validating, recursive, caching DNS resolver. CVE-2026-35501 (DNSSEC) Bypass of a configured island trust anchor underneath an insecure parent from an attacker-controlled NSEC record. CVE-2026-50106 (DNSSEC) Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent. CVE-2026-96405 Aggregate DNS name chained pointer decompression work leads to degradation of service. CVE-2026-97206 DNS-over-QUIC path-migration can lead to use-after-free on multi-threaded deployments, leading to potential denial of service. CVE-2026-109125 Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'. https://security-tracker.debian.org/tracker/DSA-6581-1

Improvements and security content

  • Multiple security vulnerabilities were discovered in Unbound, a validating, recursive, caching DNS resolver. CVE-2026-35501 (DNSSEC) Bypass of a configured island trust anchor underneath an insecure parent from an attacker-controlled NSEC record. CVE-2026-50106 (DNSSEC) Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent. CVE-2026-96405 Aggregate DNS name chained pointer decompression work leads to degradation of service. CVE-2026-97206 DNS-over-QUIC path-migration can lead to use-after-free on multi-threaded deployments, leading to potential denial of service. CVE-2026-109125 Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'. https://security-tracker.debian.org/tracker/DSA-6581-1

Known issues

Publisher statement

Not stated. The verified publisher record does not contain a known-issues statement.

Affected products and versions

Products

  • Debian

Affected versions

  • See the official publisher source for applicability.

Fixed versions or updates

  • No fixed version is stated in this record.

Recommended action

Review the official publisher document before deployment.

Related vulnerabilities

BlackTree CVE Intelligence
CVE-2026-35501Open CVE report →CVE-2026-50106Open CVE report →CVE-2026-96405Open CVE report →CVE-2026-97206Open CVE report →CVE-2026-109125Open CVE report →

These links connect the publisher update to related Lifecycle records without treating the update publication date as an end-of-support date.

Debian 12 BookwormOpen lifecycle record →

Official publisher evidence

DEBIANVERIFIED

DSA-6581-1 unbound - security update

Checked 30 Oct 2026. BlackTree preserves the last verified facts if a later source check is temporarily unavailable.

Open the official publisher source