UBUNTU-CVE-2026-44608

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-44608
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-44608.json
JSON Data
https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2026-44608
Upstream
Downstream
Related
Published
2026-05-20T00:00:00Z
Modified
2026-06-02T20:15:05.919319474Z
Severity
  • 4.6 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber CVSS Calculator
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met (multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers) it could result in heap use-after-free and eventual crash. An adversary can exploit the vulnerability if conditions are first met on a vulnerable Unbound, i.e., multi-threaded, an RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers and an ongoing XFR for that RPZ zone. Local RPZ files do not trigger the vulnerability. If the timing is right and an XFR happens at the same time another thread needs to read that RPZ zone, the reader may not hold the lock long enough and the thread applying the XFR may free objects that the reader is about to walk causing the use-after-free. Unbound 1.25.1 contains a patch with a fix to the locking code.

References

Affected packages

Ubuntu:Pro:16.04:LTS / unbound

Package

Name
unbound
Purl
pkg:deb/ubuntu/unbound?arch=source&distro=esm-infra-legacy%2Fxenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.4.22-1ubuntu6
1.5.7-1ubuntu1
1.5.7-1ubuntu2
1.5.8-1ubuntu1
1.5.8-1ubuntu1.1
1.5.8-1ubuntu1.1+esm1
1.5.8-1ubuntu1.1+esm2
1.5.8-1ubuntu1.1+esm3

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "1.5.8-1ubuntu1.1+esm3",
            "binary_name": "libunbound2"
        },
        {
            "binary_version": "1.5.8-1ubuntu1.1+esm3",
            "binary_name": "python-unbound"
        },
        {
            "binary_version": "1.5.8-1ubuntu1.1+esm3",
            "binary_name": "unbound"
        },
        {
            "binary_version": "1.5.8-1ubuntu1.1+esm3",
            "binary_name": "unbound-anchor"
        },
        {
            "binary_version": "1.5.8-1ubuntu1.1+esm3",
            "binary_name": "unbound-host"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-44608.json"

Ubuntu:24.04:LTS / unbound

Package

Name
unbound
Purl
pkg:deb/ubuntu/unbound?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.19.2-1ubuntu3.8

Affected versions

1.*
1.17.1-2
1.18.0-2ubuntu1
1.18.0-2ubuntu2
1.19.1-1ubuntu1
1.19.2-1ubuntu1
1.19.2-1ubuntu3
1.19.2-1ubuntu3.1
1.19.2-1ubuntu3.2
1.19.2-1ubuntu3.3
1.19.2-1ubuntu3.4
1.19.2-1ubuntu3.5
1.19.2-1ubuntu3.6
1.19.2-1ubuntu3.7

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "1.19.2-1ubuntu3.8",
            "binary_name": "libunbound8"
        },
        {
            "binary_version": "1.19.2-1ubuntu3.8",
            "binary_name": "python3-unbound"
        },
        {
            "binary_version": "1.19.2-1ubuntu3.8",
            "binary_name": "unbound"
        },
        {
            "binary_version": "1.19.2-1ubuntu3.8",
            "binary_name": "unbound-anchor"
        },
        {
            "binary_version": "1.19.2-1ubuntu3.8",
            "binary_name": "unbound-host"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-44608.json"

Ubuntu:25.10 / unbound

Package

Name
unbound
Purl
pkg:deb/ubuntu/unbound?arch=source&distro=questing

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.22.0-2ubuntu2.3

Affected versions

1.*
1.22.0-1ubuntu1
1.22.0-2ubuntu1
1.22.0-2ubuntu2
1.22.0-2ubuntu2.1
1.22.0-2ubuntu2.2

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "1.22.0-2ubuntu2.3",
            "binary_name": "libunbound8"
        },
        {
            "binary_version": "1.22.0-2ubuntu2.3",
            "binary_name": "python3-unbound"
        },
        {
            "binary_version": "1.22.0-2ubuntu2.3",
            "binary_name": "unbound"
        },
        {
            "binary_version": "1.22.0-2ubuntu2.3",
            "binary_name": "unbound-anchor"
        },
        {
            "binary_version": "1.22.0-2ubuntu2.3",
            "binary_name": "unbound-host"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-44608.json"

Ubuntu:26.04:LTS / unbound

Package

Name
unbound
Purl
pkg:deb/ubuntu/unbound?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.24.2-1ubuntu2.1

Affected versions

1.*
1.22.0-2ubuntu2
1.22.0-2ubuntu4
1.24.2-1ubuntu1
1.24.2-1ubuntu2

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "1.24.2-1ubuntu2.1",
            "binary_name": "libunbound8"
        },
        {
            "binary_version": "1.24.2-1ubuntu2.1",
            "binary_name": "python3-unbound"
        },
        {
            "binary_version": "1.24.2-1ubuntu2.1",
            "binary_name": "unbound"
        },
        {
            "binary_version": "1.24.2-1ubuntu2.1",
            "binary_name": "unbound-anchor"
        },
        {
            "binary_version": "1.24.2-1ubuntu2.1",
            "binary_name": "unbound-host"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-44608.json"