[Deepin Integration]~[v25-Release] fix(cve): CVE-2026-109125, CVE-2026-97206, CVE-2026-35501 - consolidated unbound CVE backports by deepin-ci-robot@deepin-community/unbound by deepin-community-ci-bot[bot] #14212

Package information | 软件包信息

Package repository address | 软件包仓库地址

deb [trusted=yes] https://ci.deepin.com/repo/obs/deepin:/CI:/TestingIntegration:/test-integration-pr-4696/testing/ ./

Changelog | 更新信息

unbound (1.26.1-0+deb13u1deepin1) unstable; urgency=medium

• fix(cve): CVE-2026-109125 (unknown) - Fix CVE-2026-109125, possible
  cache poisoning vulnerability via a cache side-channel exposed by
  'unwanted-reply-threshold'. When the threshold is reached the pending
  upstream UDP queries on that source port are now dropped along with the
  cache clear, so the port can no longer be probed from the outside.
  Upstream:
  https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-109125.diff
• fix(cve): CVE-2026-97206 (unknown) - Fix CVE-2026-97206, DoQ
  path-migration can lead to use-after-free on multi-threaded
  deployments. Look up and lock the DoQ connection before removing the
  mesh state, and do not remove it twice from inside callbacks.
  Upstream: https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-97206.diff
• fix(cve): CVE-2026-35501 (unknown) - Fix CVE-2026-35501, bypass of a
  configured island trust anchor underneath an insecure parent from an
  attacker-controlled NSEC record. A forged NSEC insecure response can no
  longer be accepted and cached without RRSIG validation.
  Upstream: https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-35501.diff
• Consolidated the outstanding CVE fix PRs into a single branch. The
  fixes for CVE-2026-77860, CVE-2026-78227, CVE-2026-80225,
  CVE-2026-82720 and CVE-2026-77955 are already part of the 1.26.1
  upstream release imported in this package, so the stale patch files
  for them were dropped instead of being applied a second time.
• fix(cve): CVE-2026-96405 (unknown) - Fix CVE-2026-96405, Aggregate
  DNS name chained pointer decompression work leads to degradation of
  service Upstream:
  NLnetLabs/unbound@7efed803558daed6ff6ba835
  d53c1362232b01ea
• fix(cve): CVE-2026-50106 (unknown) - Fix CVE-2026-50106, Possible
  insecure NXDOMAIN for non-existing records under a configured island
  trust anchor underneath an insecure parent Upstream:
  NLnetLabs/unbound@a42b89f7a608f7badbd81233
  8702a0b2d77d5bcc.patch