WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-08-17 21:25:50 +02:00
Code Issues Packages Projects Releases Wiki Activity
8,302 Commits 29 Branches 215 Tags
1e1940383ab5ee655fe7fac0da606fe59c76ce86
Commit Graph
8302 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
W.C.A. Wijngaards 1e1940383a - Fix CVE-2026-44687, Off-by-one error in 'harden-below-nxdomain' 
logic can shadow a stub/forward zone by a legitimate parent's
  NXDOMAIN. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-07-22 10:12:03 +02:00
W.C.A. Wijngaards f52a9e864b - Fix CVE-2026-44621, Libunbound applications configured with 
'unwanted-reply-threshold' could eventually be abruptly
  terminated. Thanks to Qifan Zhang, Palo Alto Networks, for the
  report.
 2026-07-22 10:11:26 +02:00
W.C.A. Wijngaards 13ec8d0f26 - Fix CVE-2026-42955, Extra fix for CVE-2026-40622 to also clamp 
the TTL of A/AAAA records disallowing a one-time 'ghost domain'
  delegation renewal via glue records. Thanks to Qifan Zhang, Palo
  Alto Networks, for the report.
 2026-07-22 10:11:04 +02:00
W.C.A. Wijngaards 27f22b8808 - Fix CVE-2026-41637, Degradation of resolution service from 
improperly accounted client-terminated DNS-over-QUIC queries. Thanks
  to Qifan Zhang, Palo Alto Networks, for the report.
 2026-07-22 10:10:24 +02:00
W.C.A. Wijngaards f54e0791ba - Fix CVE-2026-40691, Packet of death for DNSCrypt over TCP. Thanks 
to Qifan Zhang, Palo Alto Networks, for the report. In addition,
  thanks to Trung Nguyen (@everping) of CyStack, for also reporting
  this issue.
 2026-07-22 10:09:50 +02:00
W.C.A. Wijngaards 01dfd2f466 - Fix CVE-2026-32665, Remote DNS-over-QUIC denial of 
service due to `quic-size` budget bypass. Thanks to N0zoM1z0
  (https://github.com/N0zoM1z0) for the report. In addition, thanks to
  Kunta Chu, Kaihua Wang, and Jianjun Chen from Tsinghua University,
  for also reporting this issue. In addition, thanks to Qifan Zhang,
  Palo Alto Networks, for also reporting this issue. In addition,
  thanks to Xuanchao Xie, for also reporting this issue.
 2026-07-22 10:09:26 +02:00
W.C.A. Wijngaards f157c691bb - Fix CVE-2026-14586, Assertion in libngtcp2 when under pressure 
in high concurrency DNS-over-QUIC environments. Thanks to Kunta
  Chu, Kaihua Wang, and Jianjun Chen from Tsinghua University,
  for the report.
 2026-07-22 10:08:48 +02:00
W.C.A. Wijngaards fea0ff550b - Fix CVE-2026-46582, A wildcard replay, as another piece of data, 
triggers poisoning in the serve expired reply path. Thanks to
  Qifan Zhang, Palo Alto Networks, for the report.
 2026-07-22 10:07:52 +02:00
W.C.A. Wijngaards 87d59bfced Set version to 1.25.2 2026-07-22 10:06:30 +02:00
W.C.A. Wijngaards 75b6dba593 - Fix CVE-2026-44608, Use after free and crash in RPZ code. Thanks 
to Qifan Zhang, Palo Alto Networks, for the report.
release-1.25.1 		2026-05-20 10:22:52 +02:00
W.C.A. Wijngaards 138fb48eac Changelog entry. 
- Fix CVE-2026-44390, Unbounded name compression in certain cases
  causes degradation of service. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-05-20 10:22:10 +02:00
W.C.A. Wijngaards dae7a37974 - Fix CVE-2026-44390, Unbounded name compression in certain cases 
causes degradation of service. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-05-20 10:21:26 +02:00
W.C.A. Wijngaards 8ae4b4545d - Fix CVE-2026-42960, Possible cache poisoning attack while following 
delegation. Thanks to TaoFei Guo from Peking University, Yang Luo
  and JianJun Chen, Tsinghua University, for the report.
 2026-05-20 10:20:45 +02:00
W.C.A. Wijngaards c343fff3a4 - Fix CVE-2026-42923, Degradation of service with unbounded NSEC3 
hash calculations. Thanks to Qifan Zhang, Palo Alto Networks, for
  the report.
 2026-05-20 10:20:02 +02:00
W.C.A. Wijngaards a794c87578 - Fix CVE-2026-42534, Jostle logic bypass degrades resolution 
performance. Thanks to Qifan Zhang, Palo Alto Networks, for the
  report.
 2026-05-20 10:19:08 +02:00
W.C.A. Wijngaards ef5ca84360 - Fix CVE-2026-41292, Parsing a long list of incoming EDNS options 
degrades performance. Thanks to GitHub user 'N0zoM1z0', also Qifan
  Zhang from Palo Alto Networks, for the report.
 2026-05-20 10:18:23 +02:00
W.C.A. Wijngaards 8d8fa42266 - Fix CVE-2026-40622, "Ghost domain name" variant. Thanks to Qifan 
Zhang, Palo Alto Networks, for the report.
 2026-05-20 10:16:18 +02:00
W.C.A. Wijngaards a587535c5d - Fix CVE-2026-32792, Packet of death with DNSCrypt. Thanks to Andrew 
Griffiths from 'calif.io' for the report.
 2026-05-20 10:15:30 +02:00
W.C.A. Wijngaards 94d5babaee - Fix CVE-2026-42959, Crash during DNSSEC validation of malicious 
content. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-05-20 10:14:32 +02:00
W.C.A. Wijngaards fe946ba4e9 - Fix CVE-2026-42944, Heap overflow and crash with multiple nsid, 
cookie, padding EDNS options. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-05-20 10:13:55 +02:00
W.C.A. Wijngaards 6a31e470f8 - Fix CVE-2026-33278, Possible remote code execution during DNSSEC 
validation. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-05-20 10:13:08 +02:00
W.C.A. Wijngaards e577695aeb Set version to 1.25.1 for release. 2026-05-20 10:11:15 +02:00
W.C.A. Wijngaards 25fe602024 - For #1441: Fix type of ipv6 addr struct. release-1.25.0 2026-04-23 09:37:30 +02:00
W.C.A. Wijngaards df0e86de49 Changelog entry for #1441. 
- Merge #1441: Fix buffer overrun in
  doq_repinfo_retrieve_localaddr().
 2026-04-23 09:35:44 +02:00
FothsidandGitHub e49b550cf3 Fix buffer overrun in doq_repinfo_retrieve_localaddr() (#1441) 2026-04-23 09:35:23 +02:00
W.C.A. Wijngaards 07c96792f2 - Fix doxygen comment syntax. release-1.25.0rc1 2026-04-21 13:44:55 +02:00
W.C.A. Wijngaards 84ab430e11 - Set version number to 1.25.0 of code repository. 2026-04-21 13:27:55 +02:00
W.C.A. Wijngaards 53499e4a88 - Fix handling of wildcard CNAMEs in the chain of trust. 
An improper wildcard in the chain of trust would send
  the retries to the wrong upstream. Also it could label
  the step in the chain of trust as secure, when it was not.
  Thanks to Qifan Zhang, Palo Alto Networks for the report.
 2026-04-21 13:24:40 +02:00
W.C.A. Wijngaards 8a25a97687 - Fix that a DNAME with an unsigned CNAME is checked for 
the correct match. This stops that for certain zone
  configurations an unchecked unsigned CNAME could get
  secure status. Thanks to Qifan Zhang, Palo Alto Networks
  for the report.
 2026-04-21 13:19:13 +02:00
W.C.A. Wijngaards c112bcf2fd - Fix that signatures are not allowed with revoked dnskeys. 
Thanks to Qifan Zhang, Palo Alto Networks for the report.
 2026-04-21 13:07:34 +02:00
W.C.A. Wijngaards 9de549c498 - Fix that upstream TLS connections are not reused as TLS 
connections for a different name, at the same IP. This
  checks that the tls name is correct when reusing the
  upstream connections. Thanks to TaoFei Guo from Peking
  University and JianJun Chen from Tsinghua University for
  the report.
 2026-04-21 11:59:05 +02:00
W.C.A. Wijngaards 84c645e7b3 - Fix for missing bounds check for decompressing dnames 
for downloaded authority zones. This fixes that the server
  could end up with malformed zone content after receiving
  truncated packet contents from an AXFR. In addition, the
  domain names in the SOA rdata are checked before the
  authority code picks up the zone serial.
  Thanks to Halil Oktay for the report.
 2026-04-21 10:32:37 +02:00
W.C.A. Wijngaards 197a425c7d - Fix for iterator RCODE handling of YXDOMAIN. This fixes 
that the server only accepts YXDOMAIN answers that contain
  a DNAME record. This stops bad answers, and checks that
  the authoritative server gives correct replies.
  Thanks to Qifan Zhang, Palo Alto Networks for the report.
 2026-04-21 10:09:02 +02:00
W.C.A. Wijngaards 311054728d - Fix EDNS extended RCODE reflection. This fixes that 
the server does not echo extended rcode values after class
  chaos queries. Thanks to Qifan Zhang, Palo Alto Networks
  for the report.
 2026-04-21 09:58:19 +02:00
W.C.A. Wijngaards 6d74856212 - Fix for the Jiggle Attack. The server is fixed to answer 
with errors for error cases, and does not stay silent.
  In addition, the error replies do not contain parts of the
  incoming query. This is more conformant, stops reflection
  and stops it as a covert channel. Thanks to Yuqi Qiu and
  Xiang Li, Nankai University (AOSP Lab) for the report.
  In addition, thanks to Qifan Zhang, Palo Alto Networks, for
  noting the fingerprinting possibility, that is also fixed
  with this.
 2026-04-21 09:54:17 +02:00
W.C.A. Wijngaards d489e6027e - Add test case for malformed SVCB records. Thanks to 
Qifan Zhang, Palo Alto Networks for the additional test.
 2026-04-21 09:41:53 +02:00
W.C.A. Wijngaards e1d146d6b0 - Fix test with https zone for libressl. 2026-04-20 16:10:33 +02:00
W.C.A. Wijngaards eb2fe8df8d - Fix unused variable warning when compiled without ssl. 2026-04-20 12:24:55 +02:00
W.C.A. Wijngaards 86a8be75f0 - Fix compile warnings for thread setname routine, and test compile. 2026-04-20 12:24:28 +02:00
W.C.A. Wijngaards 52fc5ee374 - Fix pthread_setname detection to fail on warnings. 2026-04-17 17:13:14 +02:00
W.C.A. Wijngaards 82359c8fb1 - Update generated configure, with autoconf. 2026-04-17 17:00:09 +02:00
W.C.A. Wijngaards c996671a1f - Update generated man pages. 2026-04-17 16:32:02 +02:00
Yorgos Thessalonikefs e233a1ef65 Changelog entry for #1400: 
- Merge #1400: Support pthread_setname_np.
 2026-04-17 16:23:53 +02:00
Yorgos Thessalonikefs 06ff9f20d0 Merge branch 'features/pthread-setname' 2026-04-17 16:22:04 +02:00
W.C.A. Wijngaards af209a12ea - Fix subnet store of servfail to not leak memory. 2026-04-17 13:48:38 +02:00
W.C.A. Wijngaards 84ac7e1b58 - Fix ttl comparisons in rdata_copy for 32bit signed or unsigned. 2026-04-17 13:27:41 +02:00
W.C.A. Wijngaards 24d502763c - Fix to increase size of the buffer for the win_svc reportev log 
function.
 2026-04-17 11:05:31 +02:00
W.C.A. Wijngaards 99c61c19ac - Fix compat/gmtime_r old style definition syntax. 2026-04-17 11:05:15 +02:00
W.C.A. Wijngaards cb05e9d525 - Fix compat/chacha_private sigma and tau definitions to use 
nonstring attribute.
 2026-04-17 11:04:51 +02:00
W.C.A. Wijngaards abddd4e270 - Update github ci cross platform to use 
cross-platform-actions/action@v1.0.0.
- Fix github ci to speed up with parralel build, for windows ci.
 2026-04-17 10:41:24 +02:00