FreeSenseFreeSenseSecurity
freesense.org
← Fixed vulnerabilities
Fixed

Multiple vulnerabilities in unbound

FreeBSD-SA-26:33.unbound · CVE-2026-32792, CVE-2026-33278, CVE-2026-40622, CVE-2026-41292, CVE-2026-42534, CVE-2026-42923, CVE-2026-42944, CVE-2026-42959, CVE-2026-42960, CVE-2026-44390, CVE-2026-44608

Our decision for FreeSense

FreeBSD corrected this on 2026-05-26, before the FreeBSD source pin of every FreeSense version.

  • Advisory: corrected 2026-05-26
  • FreeSense 1.0 pin: e004ff15f87e (2026-08-03)
  • FreeSense 1.1 pin: a52c50b4b7c2 (2026-10-04)
  • FreeSense 1.2 pin: a52c50b4b7c2 (2026-10-04)
Decided by rules, not yet reviewed. The status comes from the advisory's correction date and the build configuration. A maintainer has not looked at whether FreeSense is exposed in practice. How we triage

By FreeSense version

VersionStatusFreeBSD pin
FreeSense 1.01.0.7 · frozen, no further fixesFixedFreeBSD pin of 2026-08-032026-08-03e004ff15
FreeSense 1.11.1.9FixedFreeBSD pin of 2026-10-042026-10-04a52c50b4
FreeSense 1.21.2.0-DEVELOPMENTFixedFreeBSD pin of 2026-10-042026-10-04a52c50b4

Workaround

No workaround is available. Systems not running the local_unbound service are not affected.

What FreeBSD says

Multiple vulnerabilities have been reported in Unbound. Instead of listing detailed writeups for each issue, please see the upstream advisories referenced below. CVE-2026-33278 - Possible remote code execution during DNSSEC validation CVE-2026-42944 - Heap overflow and crash with multiple nsid, cookie, padding EDNS options CVE-2026-42959 - Crash during DNSSEC validation of malicious content CVE-2026-32792 - Packet of death with DNSCrypt CVE-2026-44608 - Use-after-free and crash in RPZ code CVE-2026-40622 - "Ghost domain name" variant CVE-2026-42960 - Possible cache poisoning while following delegation CVE-2026-41292 - Parsing a long list of incoming EDNS options degrades performance CVE-2026-42534 - Jostle logic bypass degrades resolution performance CVE-2026-42923 - Degradation of service with unbounded NSEC3 hash calculations CVE-2026-44390 - Unbounded name compression causes degradati

Impact

The issues range from Denial of Service (DoS) through resource exhaustion or crashes to possible remote code execution during DNSSEC validation. See the upstream Unbound advisories for specific details.

Excerpt from the FreeBSD advisory. Read the original for the full text and the fix.

Copied to clipboard