USN-8946-1: Ten Vulnerabilities in Unbound on Ubuntu, One Critical for Cache Poisoning

Canonical released USN-8946-1 on 21 October 2026, patching ten vulnerabilities in the Unbound package across all supported Ubuntu releases, from 14.04 LTS through the recent 26.04 LTS. For anyone managing a recursive or authoritative DNS resolver with caching on an Ubuntu server, this is an update to apply without waiting for the next scheduled reboot.

The Most Serious Flaw: Cache Poisoning

The vulnerability deserving attention is CVE-2026-44690. According to the official advisory, Unbound was found to be incorrectly handling certain cached DNS responses, and a remote attacker could potentially exploit this issue to poison Unbound's cache. It affects Ubuntu 26.04, 24.04, 22.04 and 20.04 LTS.

NLnet Labs, the upstream developer, published the technical details: the flaw stems from insufficient validation of RRSIG.labels combined with premature cache writes during RFC 8198 aggressive NSEC processing, and was reported by Qifan Zhang of Palo Alto Networks. The concrete mechanism: an attacker controlling even a single delegated zone under a parent domain signed with NSEC can cause spurious wildcard delegation records for unrelated "sibling" zones to be inserted into the cache, thus returning forged DNS responses to clients querying that resolver. The NIST score assigned is 7.5 out of 10 (High).

The Other Nine CVEs

The remaining nine vulnerabilities almost all concern denial of service: improper TCP connection handling (CVE-2026-80225), malformed DNS responses (CVE-2026-81634), DNSSEC validation (CVE-2026-85501), outbound network ports (CVE-2026-50252), DNSCrypt packets (CVE-2026-40691), DNS-over-QUIC connections on 26.04 only (CVE-2026-32665) and EDNS options on 26.04 only (CVE-2026-55973). The last two, CVE-2023-50387 and CVE-2023-50868, date back to 2023 and affect only the older 18.04, 16.04 and 14.04 LTS releases.

How to Update

Release	Patched unbound Package
26.04 LTS	1.24.2-1ubuntu2.4
24.04 LTS	1.19.2-1ubuntu3.12
22.04 LTS	1.13.1-1ubuntu5.17
20.04 LTS	1.9.4-2ubuntu1.11+esm3 (requires Ubuntu Pro)
18.04 LTS	1.6.7-1ubuntu2.6+esm6 (requires Ubuntu Pro)
16.04 LTS	1.5.8-1ubuntu1.1+esm5 (requires Ubuntu Pro + Legacy Support)
14.04 LTS	1.4.22-1ubuntu4.14.04.3+esm5 (requires Ubuntu Pro + Legacy Support)

On 20.04 and earlier releases, the package is now in ESM: without an active Ubuntu Pro subscription, the patch will not be downloaded with a standard apt upgrade. Where Unbound is installed as a local resolver (for example behind NGINX or as a DNSSEC forwarder), it is worth checking the running version with unbound -V before and after the update.