Nixpkgs security tracker
6.6 MEDIUM
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Attack Requirement (AT): None (N)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Vulnerable System Impact Confidentiality (VC): None (N)
- Vulnerable System Impact Integrity (VI): None (N)
- Vulnerable System Impact Availability (VA): High (H)
- Subsequent System Impact Confidentiality (SC): None (N)
- Subsequent System Impact Integrity (SI): None (N)
- Subsequent System Impact Availability (SA): None (N)
- Exploit Maturity (E): Unreported (U)
- Provider Urgency (U): Red (Red)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Attack Requirement (MAT): None (N)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Vulnerable System Impact Confidentiality (MVC): None (N)
- Modified Vulnerable System Impact Integrity (MVI): None (N)
- Modified Vulnerable System Impact Availability (MVA): High (H)
- Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
- Modified Subsequent System Impact Integrity (MSI): Negligible (N)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
16 packages
- luaPackages.luaunbound
- lua51Packages.luaunbound
- lua52Packages.luaunbound
- lua53Packages.luaunbound
- lua54Packages.luaunbound
- lua55Packages.luaunbound
- luajitPackages.luaunbound
- prometheus-unbound-exporter
- python312Packages.pyunbound
- python313Packages.pyunbound
- unbound-with-systemd
- haskellPackages.unbound-generics
- haskellPackages.unbound-generics-unify
- haskellPackages.unbound-kind-generics
- haskellPackages.unbounded-delays
- python314Packages.pyunbound
- @LeSuisse restored package unbound-with-systemd
- @LeSuisse ignored maintainer @Scrumplex maintainer.ignore
- @LeSuisse accepted
- @LeSuisse published on GitHub
Long list of incoming EDNS options degrades performance
NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS options can hold Unbound threads hostage while they are parsing and creating internal data structures for the options. Coordinated attacks can result in degradation and/or denial of service. Unbound 1.25.1 contains a patch with a fix to limit acceptable incoming EDNS options (100).
References
-
https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-41292.txt vendor-advisory
Affected products
- <1.25.1
Matching in nixpkgs
pkgs.unbound
Validating, recursive, and caching DNS resolver
pkgs.unbound-full
Validating, recursive, and caching DNS resolver
Ignored packages (15)
pkgs.luaPackages.luaunbound
A binding to libunbound
pkgs.lua51Packages.luaunbound
A binding to libunbound
pkgs.lua52Packages.luaunbound
A binding to libunbound
pkgs.lua53Packages.luaunbound
A binding to libunbound
pkgs.lua54Packages.luaunbound
A binding to libunbound
pkgs.lua55Packages.luaunbound
A binding to libunbound
pkgs.luajitPackages.luaunbound
A binding to libunbound
pkgs.prometheus-unbound-exporter
Prometheus exporter for Unbound DNS resolver
pkgs.python312Packages.pyunbound
Python library for Unbound, the validating, recursive, and caching DNS resolver
pkgs.python313Packages.pyunbound
Python library for Unbound, the validating, recursive, and caching DNS resolver
pkgs.python314Packages.pyunbound
Python library for Unbound, the validating, recursive, and caching DNS resolver
pkgs.haskellPackages.unbound-generics
Support for programming with names and binders using GHC Generics
pkgs.haskellPackages.unbounded-delays
Unbounded thread delays and timeouts
pkgs.haskellPackages.unbound-kind-generics
Support for programming with names and binders using kind-generics
Package maintainers
Ignored maintainers (1)
-
@Scrumplex Sefa Eyeoglu <contact@scrumplex.net>