Unbound 1.26.0 This release has some features and a number of bug fixes. The release is signed with the OpenPGP software signing key that is in use since Jan 1st 2026: User ID: NLnet Labs releases signing key G2 <releases@nlnetlabs.nl> Key ID: A144 323D EAAC DF45 Fingerprint: 2310 1869 0C4D 903E F419 146A A144 323D EAAC DF45 The key is available from https://nlnetlabs.nl/signing-keys . The certifi…
Unbound 1.26.0rc1 tag.
Unbound 1.25.2 This release has a number of security fixes. The release is signed with the OpenPGP software signing key that is in use since Jan 1st 2026: User ID: NLnet Labs releases signing key G2 <releases@nlnetlabs.nl> Key ID: A144 323D EAAC DF45 Fingerprint: 2310 1869 0C4D 903E F419 146A A144 323D EAAC DF45 The key is available from https://nlnetlabs.nl/signing-keys . This release consolidate…
Unbound 1.25.1 This release has a number of security fixes. The release is signed with the OpenPGP software signing key that is in use since Jan 1st 2026: User ID: NLnet Labs releases signing key G2 <releases@nlnetlabs.nl> Key ID: A144 323D EAAC DF45 Fingerprint: 2310 1869 0C4D 903E F419 146A A144 323D EAAC DF45 The key is available from https://nlnetlabs.nl/signing-keys . This release consolidate…
Unbound 1.25.0 This release has some features and a number of bug fixes. The release is signed with the OpenPGP software signing key that is in use since Jan 1st 2026: User ID: NLnet Labs releases signing key G2 <releases@nlnetlabs.nl> Key ID: A144 323D EAAC DF45 Fingerprint: 2310 1869 0C4D 903E F419 146A A144 323D EAAC DF45 The key is available from https://nlnetlabs.nl/signing-keys . For cached…
Unbound 1.25.0rc1 tag.
This security release has additional fixes for CVE-2025-11411. Promiscuous NS RRSets that complement DNS replies in the authority section can be used to trick resolvers to update their delegation information for the zone. The CVE is described here https://nlnetlabs.nl/downloads/unbound/CVE-2025-11411.txt Unbound 1.24.1 included a fix that scrubs unsolicited NS RRSets (and their respective address…
This security release fixes CVE-2025-11411. Promiscuous NS RRSets that complement DNS replies in the authority section can be used to trick resolvers to update their delegation information for the zone. The CVE is described here https://nlnetlabs.nl/downloads/unbound/CVE-2025-11411.txt We would like to thank Yuxiao Wu, Yunyi Zhang, Baojun Liu and Haixin Duan from Tsinghua University for discoverin…
Unbound 1.24.0 This release features increased defaults, num.valops statistic, unbound-control cache_lookup, and bug fixes. The default value increase for num-queries-per-thread is to make saturation of the task queue more resource intensive and less practical. Thanks to Shiming Liu, Network and Information Security Lab, Tsinghua University for the report. The default value increase for so-sndbuf…
Tag for Unbound 1.24.0rc1.
This security release fixes the Rebirthday Attack CVE-2025-5994. This re-opens up resolvers to a birthday paradox, for EDNS client subnet servers that respond with non-ECS answers. It only affects Unbound when compiled with --enable-subnet, and subnetmod is enabled with config options that send ECS information to upstream servers. The CVE is described here https://nlnetlabs.nl/downloads/unbound/CV…
Unbound 1.23.0 This release features changed defaults, fast reload, redis replica, DNS Error Reporting, and bug fixes. The fast reload is a feature that is listed as experimental. With unbound-control fast_reload the server can read the new config in a thread, and when done only briefly pauses the server to update the settings. This uses double memory, for like zones from disk or config that is lo…
Tag for Unbound 1.23.0rc2.