UBUNTU-CVE-2026-42923

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-42923
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42923.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-42923
Upstream
  • CVE-2026-42923
Downstream
Related
Published
2026-05-20T00:00:00Z
Modified
2026-05-21T19:46:05.142544906Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Amber CVSS Calculator
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code path to consult the negative cache for DS records does not take into account the limit on NSEC3 hash calculations introduced in 1.19.1. This leads to degradation of service during the attack. An adversary that controls a DNSSEC signed zone can exploit this by signing NSEC3 records with acceptably high iterations for child delegations and querying a vulnerable Unbound. Unbound will keep performing the allowed hash calculations on the NSEC3 records and will not limit the work by the mitigation introduced in 1.19.1. As a side effect, a global lock for the negative cache will be held for the duration of the hashing, blocking other threads that need to consult the negative cache. Coordinated attacks could raise the vulnerability to denial of service. Unbound 1.25.1 contains a patch with a fix to bound the vulnerable code path with the existing limit for NSEC3 hash calculations.

References

Affected packages

Ubuntu:20.04:LTS
unbound

Package

Name
unbound
Purl
pkg:deb/ubuntu/unbound?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.9.0-2ubuntu1
1.9.0-2ubuntu2
1.9.4-2
1.9.4-2ubuntu1
1.9.4-2ubuntu1.1
1.9.4-2ubuntu1.2
1.9.4-2ubuntu1.3
1.9.4-2ubuntu1.4
1.9.4-2ubuntu1.5
1.9.4-2ubuntu1.6
1.9.4-2ubuntu1.8
1.9.4-2ubuntu1.9
1.9.4-2ubuntu1.11

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libunbound8",
            "binary_version": "1.9.4-2ubuntu1.11"
        },
        {
            "binary_name": "python-unbound",
            "binary_version": "1.9.4-2ubuntu1.11"
        },
        {
            "binary_name": "python3-unbound",
            "binary_version": "1.9.4-2ubuntu1.11"
        },
        {
            "binary_name": "unbound",
            "binary_version": "1.9.4-2ubuntu1.11"
        },
        {
            "binary_name": "unbound-anchor",
            "binary_version": "1.9.4-2ubuntu1.11"
        },
        {
            "binary_name": "unbound-host",
            "binary_version": "1.9.4-2ubuntu1.11"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42923.json"
Ubuntu:22.04:LTS
unbound

Package

Name
unbound
Purl
pkg:deb/ubuntu/unbound?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.13.1-1ubuntu5.15

Affected versions

1.*
1.13.1-1ubuntu1
1.13.1-1ubuntu3
1.13.1-1ubuntu5
1.13.1-1ubuntu5.1
1.13.1-1ubuntu5.2
1.13.1-1ubuntu5.3
1.13.1-1ubuntu5.4
1.13.1-1ubuntu5.5
1.13.1-1ubuntu5.7
1.13.1-1ubuntu5.8
1.13.1-1ubuntu5.10
1.13.1-1ubuntu5.11
1.13.1-1ubuntu5.12
1.13.1-1ubuntu5.13
1.13.1-1ubuntu5.14

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libunbound8",
            "binary_version": "1.13.1-1ubuntu5.15"
        },
        {
            "binary_name": "python3-unbound",
            "binary_version": "1.13.1-1ubuntu5.15"
        },
        {
            "binary_name": "unbound",
            "binary_version": "1.13.1-1ubuntu5.15"
        },
        {
            "binary_name": "unbound-anchor",
            "binary_version": "1.13.1-1ubuntu5.15"
        },
        {
            "binary_name": "unbound-host",
            "binary_version": "1.13.1-1ubuntu5.15"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42923.json"
Ubuntu:24.04:LTS
unbound

Package

Name
unbound
Purl
pkg:deb/ubuntu/unbound?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.19.2-1ubuntu3.8

Affected versions

1.*
1.17.1-2
1.18.0-2ubuntu1
1.18.0-2ubuntu2
1.19.1-1ubuntu1
1.19.2-1ubuntu1
1.19.2-1ubuntu3
1.19.2-1ubuntu3.1
1.19.2-1ubuntu3.2
1.19.2-1ubuntu3.3
1.19.2-1ubuntu3.4
1.19.2-1ubuntu3.5
1.19.2-1ubuntu3.6
1.19.2-1ubuntu3.7

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libunbound8",
            "binary_version": "1.19.2-1ubuntu3.8"
        },
        {
            "binary_name": "python3-unbound",
            "binary_version": "1.19.2-1ubuntu3.8"
        },
        {
            "binary_name": "unbound",
            "binary_version": "1.19.2-1ubuntu3.8"
        },
        {
            "binary_name": "unbound-anchor",
            "binary_version": "1.19.2-1ubuntu3.8"
        },
        {
            "binary_name": "unbound-host",
            "binary_version": "1.19.2-1ubuntu3.8"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42923.json"
Ubuntu:25.10
unbound

Package

Name
unbound
Purl
pkg:deb/ubuntu/unbound?arch=source&distro=questing

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.22.0-2ubuntu2.3

Affected versions

1.*
1.22.0-1ubuntu1
1.22.0-2ubuntu1
1.22.0-2ubuntu2
1.22.0-2ubuntu2.1
1.22.0-2ubuntu2.2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libunbound8",
            "binary_version": "1.22.0-2ubuntu2.3"
        },
        {
            "binary_name": "python3-unbound",
            "binary_version": "1.22.0-2ubuntu2.3"
        },
        {
            "binary_name": "unbound",
            "binary_version": "1.22.0-2ubuntu2.3"
        },
        {
            "binary_name": "unbound-anchor",
            "binary_version": "1.22.0-2ubuntu2.3"
        },
        {
            "binary_name": "unbound-host",
            "binary_version": "1.22.0-2ubuntu2.3"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42923.json"
Ubuntu:26.04:LTS
unbound

Package

Name
unbound
Purl
pkg:deb/ubuntu/unbound?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.24.2-1ubuntu2.1

Affected versions

1.*
1.22.0-2ubuntu2
1.22.0-2ubuntu4
1.24.2-1ubuntu1
1.24.2-1ubuntu2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libunbound8",
            "binary_version": "1.24.2-1ubuntu2.1"
        },
        {
            "binary_name": "python3-unbound",
            "binary_version": "1.24.2-1ubuntu2.1"
        },
        {
            "binary_name": "unbound",
            "binary_version": "1.24.2-1ubuntu2.1"
        },
        {
            "binary_name": "unbound-anchor",
            "binary_version": "1.24.2-1ubuntu2.1"
        },
        {
            "binary_name": "unbound-host",
            "binary_version": "1.24.2-1ubuntu2.1"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42923.json"
Ubuntu:Pro:14.04:LTS
unbound

Package

Name
unbound
Purl
pkg:deb/ubuntu/unbound?arch=source&distro=esm-infra-legacy%2Ftrusty

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.4.20-1
1.4.21-1
1.4.21-1ubuntu1
1.4.21-1ubuntu2
1.4.22-1ubuntu1
1.4.22-1ubuntu2
1.4.22-1ubuntu3
1.4.22-1ubuntu4
1.4.22-1ubuntu4.14.04.1
1.4.22-1ubuntu4.14.04.2
1.4.22-1ubuntu4.14.04.3
1.4.22-1ubuntu4.14.04.3+esm1
1.4.22-1ubuntu4.14.04.3+esm2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libunbound2",
            "binary_version": "1.4.22-1ubuntu4.14.04.3+esm2"
        },
        {
            "binary_name": "python-unbound",
            "binary_version": "1.4.22-1ubuntu4.14.04.3+esm2"
        },
        {
            "binary_name": "unbound",
            "binary_version": "1.4.22-1ubuntu4.14.04.3+esm2"
        },
        {
            "binary_name": "unbound-anchor",
            "binary_version": "1.4.22-1ubuntu4.14.04.3+esm2"
        },
        {
            "binary_name": "unbound-host",
            "binary_version": "1.4.22-1ubuntu4.14.04.3+esm2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42923.json"
Ubuntu:Pro:16.04:LTS
unbound

Package

Name
unbound
Purl
pkg:deb/ubuntu/unbound?arch=source&distro=esm-infra%2Fxenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.4.22-1ubuntu6
1.5.7-1ubuntu1
1.5.7-1ubuntu2
1.5.8-1ubuntu1
1.5.8-1ubuntu1.1
1.5.8-1ubuntu1.1+esm1
1.5.8-1ubuntu1.1+esm2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libunbound2",
            "binary_version": "1.5.8-1ubuntu1.1+esm2"
        },
        {
            "binary_name": "python-unbound",
            "binary_version": "1.5.8-1ubuntu1.1+esm2"
        },
        {
            "binary_name": "unbound",
            "binary_version": "1.5.8-1ubuntu1.1+esm2"
        },
        {
            "binary_name": "unbound-anchor",
            "binary_version": "1.5.8-1ubuntu1.1+esm2"
        },
        {
            "binary_name": "unbound-host",
            "binary_version": "1.5.8-1ubuntu1.1+esm2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42923.json"
Ubuntu:Pro:18.04:LTS
unbound

Package

Name
unbound
Purl
pkg:deb/ubuntu/unbound?arch=source&distro=esm-infra%2Fbionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.6.5-1
1.6.7-1
1.6.7-1build1
1.6.7-1ubuntu1
1.6.7-1ubuntu2
1.6.7-1ubuntu2.1
1.6.7-1ubuntu2.2
1.6.7-1ubuntu2.3
1.6.7-1ubuntu2.4
1.6.7-1ubuntu2.5
1.6.7-1ubuntu2.6
1.6.7-1ubuntu2.6+esm2
1.6.7-1ubuntu2.6+esm3

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libunbound2",
            "binary_version": "1.6.7-1ubuntu2.6+esm3"
        },
        {
            "binary_name": "python-unbound",
            "binary_version": "1.6.7-1ubuntu2.6+esm3"
        },
        {
            "binary_name": "python3-unbound",
            "binary_version": "1.6.7-1ubuntu2.6+esm3"
        },
        {
            "binary_name": "unbound",
            "binary_version": "1.6.7-1ubuntu2.6+esm3"
        },
        {
            "binary_name": "unbound-anchor",
            "binary_version": "1.6.7-1ubuntu2.6+esm3"
        },
        {
            "binary_name": "unbound-host",
            "binary_version": "1.6.7-1ubuntu2.6+esm3"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42923.json"