UBUNTU-CVE-2026-42534

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-42534
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42534.json
JSON Data
https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2026-42534
Upstream
Downstream
Related
Published
2026-05-20T00:00:00Z
Modified
2026-06-02T20:15:08.861732063Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Amber CVSS Calculator
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could defeat its purpose and degrade resolution performance. Retransmits of the same query could renew the age of slow running queries and not allow the jostle logic to see them as aged and potential targets for replacement with new queries. An adversary who can query a vulnerable Unbound and who can control a domain name server that replies slowly and/or maliciously to Unbound's queries can exploit the vulnerability and degrade the resolution performance of Unbound. When Unbound's 'num-queries-per-thread' reaches its limit, the jostle logic kicks in. When a new query comes in, half of the available queries that are also slow to resolve are candidates for replacement. The vulnerability then happens because duplicate queries that need resolution would skew the aging result by using the timestamp of the latest duplicate query instead of the original one that started the resolution effort. Cache and local data response performance remains unaffected. Coordinated attacks could raise this to a denial of resolution service. Unbound 1.25.1 contains a patch with a fix to attach an initial, non-updatable start time for incoming queries that allow the jostle logic to work as intended.

References

Affected packages

Ubuntu:22.04:LTS
unbound

Package

Name
unbound
Purl
pkg:deb/ubuntu/unbound?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.13.1-1ubuntu5.15

Affected versions

1.*
1.13.1-1ubuntu1
1.13.1-1ubuntu3
1.13.1-1ubuntu5
1.13.1-1ubuntu5.1
1.13.1-1ubuntu5.2
1.13.1-1ubuntu5.3
1.13.1-1ubuntu5.4
1.13.1-1ubuntu5.5
1.13.1-1ubuntu5.7
1.13.1-1ubuntu5.8
1.13.1-1ubuntu5.10
1.13.1-1ubuntu5.11
1.13.1-1ubuntu5.12
1.13.1-1ubuntu5.13
1.13.1-1ubuntu5.14

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "1.13.1-1ubuntu5.15",
            "binary_name": "libunbound8"
        },
        {
            "binary_name": "python3-unbound",
            "binary_version": "1.13.1-1ubuntu5.15"
        },
        {
            "binary_version": "1.13.1-1ubuntu5.15",
            "binary_name": "unbound"
        },
        {
            "binary_version": "1.13.1-1ubuntu5.15",
            "binary_name": "unbound-anchor"
        },
        {
            "binary_version": "1.13.1-1ubuntu5.15",
            "binary_name": "unbound-host"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42534.json"
Ubuntu:24.04:LTS
unbound

Package

Name
unbound
Purl
pkg:deb/ubuntu/unbound?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.19.2-1ubuntu3.8

Affected versions

1.*
1.17.1-2
1.18.0-2ubuntu1
1.18.0-2ubuntu2
1.19.1-1ubuntu1
1.19.2-1ubuntu1
1.19.2-1ubuntu3
1.19.2-1ubuntu3.1
1.19.2-1ubuntu3.2
1.19.2-1ubuntu3.3
1.19.2-1ubuntu3.4
1.19.2-1ubuntu3.5
1.19.2-1ubuntu3.6
1.19.2-1ubuntu3.7

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "libunbound8",
            "binary_version": "1.19.2-1ubuntu3.8"
        },
        {
            "binary_version": "1.19.2-1ubuntu3.8",
            "binary_name": "python3-unbound"
        },
        {
            "binary_name": "unbound",
            "binary_version": "1.19.2-1ubuntu3.8"
        },
        {
            "binary_name": "unbound-anchor",
            "binary_version": "1.19.2-1ubuntu3.8"
        },
        {
            "binary_name": "unbound-host",
            "binary_version": "1.19.2-1ubuntu3.8"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42534.json"
Ubuntu:25.10
unbound

Package

Name
unbound
Purl
pkg:deb/ubuntu/unbound?arch=source&distro=questing

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.22.0-2ubuntu2.3

Affected versions

1.*
1.22.0-1ubuntu1
1.22.0-2ubuntu1
1.22.0-2ubuntu2
1.22.0-2ubuntu2.1
1.22.0-2ubuntu2.2

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "libunbound8",
            "binary_version": "1.22.0-2ubuntu2.3"
        },
        {
            "binary_name": "python3-unbound",
            "binary_version": "1.22.0-2ubuntu2.3"
        },
        {
            "binary_name": "unbound",
            "binary_version": "1.22.0-2ubuntu2.3"
        },
        {
            "binary_name": "unbound-anchor",
            "binary_version": "1.22.0-2ubuntu2.3"
        },
        {
            "binary_name": "unbound-host",
            "binary_version": "1.22.0-2ubuntu2.3"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42534.json"
Ubuntu:26.04:LTS
unbound

Package

Name
unbound
Purl
pkg:deb/ubuntu/unbound?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.24.2-1ubuntu2.1

Affected versions

1.*
1.22.0-2ubuntu2
1.22.0-2ubuntu4
1.24.2-1ubuntu1
1.24.2-1ubuntu2

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "libunbound8",
            "binary_version": "1.24.2-1ubuntu2.1"
        },
        {
            "binary_name": "python3-unbound",
            "binary_version": "1.24.2-1ubuntu2.1"
        },
        {
            "binary_name": "unbound",
            "binary_version": "1.24.2-1ubuntu2.1"
        },
        {
            "binary_name": "unbound-anchor",
            "binary_version": "1.24.2-1ubuntu2.1"
        },
        {
            "binary_version": "1.24.2-1ubuntu2.1",
            "binary_name": "unbound-host"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42534.json"
Ubuntu:Pro:14.04:LTS
unbound

Package

Name
unbound
Purl
pkg:deb/ubuntu/unbound?arch=source&distro=esm-infra-legacy%2Ftrusty

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.4.20-1
1.4.21-1
1.4.21-1ubuntu1
1.4.21-1ubuntu2
1.4.22-1ubuntu1
1.4.22-1ubuntu2
1.4.22-1ubuntu3
1.4.22-1ubuntu4
1.4.22-1ubuntu4.14.04.1
1.4.22-1ubuntu4.14.04.2
1.4.22-1ubuntu4.14.04.3
1.4.22-1ubuntu4.14.04.3+esm1
1.4.22-1ubuntu4.14.04.3+esm2
1.4.22-1ubuntu4.14.04.3+esm3

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libunbound2",
            "binary_version": "1.4.22-1ubuntu4.14.04.3+esm3"
        },
        {
            "binary_name": "python-unbound",
            "binary_version": "1.4.22-1ubuntu4.14.04.3+esm3"
        },
        {
            "binary_version": "1.4.22-1ubuntu4.14.04.3+esm3",
            "binary_name": "unbound"
        },
        {
            "binary_name": "unbound-anchor",
            "binary_version": "1.4.22-1ubuntu4.14.04.3+esm3"
        },
        {
            "binary_name": "unbound-host",
            "binary_version": "1.4.22-1ubuntu4.14.04.3+esm3"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42534.json"
Ubuntu:Pro:16.04:LTS
unbound

Package

Name
unbound
Purl
pkg:deb/ubuntu/unbound?arch=source&distro=esm-infra-legacy%2Fxenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.4.22-1ubuntu6
1.5.7-1ubuntu1
1.5.7-1ubuntu2
1.5.8-1ubuntu1
1.5.8-1ubuntu1.1
1.5.8-1ubuntu1.1+esm1
1.5.8-1ubuntu1.1+esm2
1.5.8-1ubuntu1.1+esm3

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "1.5.8-1ubuntu1.1+esm3",
            "binary_name": "libunbound2"
        },
        {
            "binary_name": "python-unbound",
            "binary_version": "1.5.8-1ubuntu1.1+esm3"
        },
        {
            "binary_name": "unbound",
            "binary_version": "1.5.8-1ubuntu1.1+esm3"
        },
        {
            "binary_name": "unbound-anchor",
            "binary_version": "1.5.8-1ubuntu1.1+esm3"
        },
        {
            "binary_version": "1.5.8-1ubuntu1.1+esm3",
            "binary_name": "unbound-host"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42534.json"
Ubuntu:Pro:18.04:LTS
unbound

Package

Name
unbound
Purl
pkg:deb/ubuntu/unbound?arch=source&distro=esm-infra%2Fbionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.6.5-1
1.6.7-1
1.6.7-1build1
1.6.7-1ubuntu1
1.6.7-1ubuntu2
1.6.7-1ubuntu2.1
1.6.7-1ubuntu2.2
1.6.7-1ubuntu2.3
1.6.7-1ubuntu2.4
1.6.7-1ubuntu2.5
1.6.7-1ubuntu2.6
1.6.7-1ubuntu2.6+esm2
1.6.7-1ubuntu2.6+esm3
1.6.7-1ubuntu2.6+esm4

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "1.6.7-1ubuntu2.6+esm4",
            "binary_name": "libunbound2"
        },
        {
            "binary_name": "python-unbound",
            "binary_version": "1.6.7-1ubuntu2.6+esm4"
        },
        {
            "binary_version": "1.6.7-1ubuntu2.6+esm4",
            "binary_name": "python3-unbound"
        },
        {
            "binary_name": "unbound",
            "binary_version": "1.6.7-1ubuntu2.6+esm4"
        },
        {
            "binary_name": "unbound-anchor",
            "binary_version": "1.6.7-1ubuntu2.6+esm4"
        },
        {
            "binary_name": "unbound-host",
            "binary_version": "1.6.7-1ubuntu2.6+esm4"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42534.json"
Ubuntu:Pro:20.04:LTS
unbound

Package

Name
unbound
Purl
pkg:deb/ubuntu/unbound?arch=source&distro=esm-infra%2Ffocal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.9.0-2ubuntu1
1.9.0-2ubuntu2
1.9.4-2
1.9.4-2ubuntu1
1.9.4-2ubuntu1.1
1.9.4-2ubuntu1.2
1.9.4-2ubuntu1.3
1.9.4-2ubuntu1.4
1.9.4-2ubuntu1.5
1.9.4-2ubuntu1.6
1.9.4-2ubuntu1.8
1.9.4-2ubuntu1.9
1.9.4-2ubuntu1.11
1.9.4-2ubuntu1.11+esm1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "1.9.4-2ubuntu1.11+esm1",
            "binary_name": "libunbound8"
        },
        {
            "binary_name": "python-unbound",
            "binary_version": "1.9.4-2ubuntu1.11+esm1"
        },
        {
            "binary_name": "python3-unbound",
            "binary_version": "1.9.4-2ubuntu1.11+esm1"
        },
        {
            "binary_name": "unbound",
            "binary_version": "1.9.4-2ubuntu1.11+esm1"
        },
        {
            "binary_name": "unbound-anchor",
            "binary_version": "1.9.4-2ubuntu1.11+esm1"
        },
        {
            "binary_name": "unbound-host",
            "binary_version": "1.9.4-2ubuntu1.11+esm1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42534.json"