From 04efaf8876bd7c3a547eff92d0dc94c1b3d1a8da Mon Sep 17 00:00:00 2001 From: Ankur Tyagi Date: Fri, 11 Sep 2026 11:09:16 +1200 Subject: [PATCH] unbound: patch CVE-2026-44687 Details: https://nvd.nist.gov/vuln/detail/cve-2026-44687 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal --- .../unbound/unbound/CVE-2026-44687.patch | 31 +++++++++++++++++++ .../recipes-support/unbound/unbound_1.24.2.bb | 1 + 2 files changed, 32 insertions(+) create mode 100644 meta-networking/recipes-support/unbound/unbound/CVE-2026-44687.patch diff --git a/meta-networking/recipes-support/unbound/unbound/CVE-2026-44687.patch b/meta-networking/recipes-support/unbound/unbound/CVE-2026-44687.patch new file mode 100644 index 0000000000..03e57f6327 --- /dev/null +++ b/meta-networking/recipes-support/unbound/unbound/CVE-2026-44687.patch @@ -0,0 +1,31 @@ +From ac34bce07f66a96baf85e3f25f99623b08b6dd86 Mon Sep 17 00:00:00 2001 +From: "W.C.A. Wijngaards" +Date: Wed, 22 Jul 2026 10:12:03 +0200 +Subject: [PATCH] - Fix CVE-2026-44687, Off-by-one error in + 'harden-below-nxdomain' logic can shadow a stub/forward zone by a + legitimate parent's NXDOMAIN. Thanks to Qifan Zhang, Palo Alto Networks, + for the report. + +(cherry picked from commit 1e1940383ab5ee655fe7fac0da606fe59c76ce86) + +CVE: CVE-2026-44687 +Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/1e1940383ab5ee655fe7fac0da606fe59c76ce86] + +Signed-off-by: Ankur Tyagi +--- + services/cache/dns.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/services/cache/dns.c b/services/cache/dns.c +index 8dae2ffcc..121870ee3 100644 +--- a/services/cache/dns.c ++++ b/services/cache/dns.c +@@ -1019,7 +1019,7 @@ dns_cache_lookup(struct module_env* env, + if(env->cfg->harden_below_nxdomain) { + while(!dname_is_root(k.qname)) { + if(dpname && dpnamelen +- && !dname_subdomain_c(k.qname, dpname)) ++ && !dname_strict_subdomain_c(k.qname, dpname)) + break; /* no synth nxdomain above the stub */ + dname_remove_label(&k.qname, &k.qname_len); + h = query_info_hash(&k, flags); diff --git a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb index ac8cd281d6..6cae8632ae 100644 --- a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb +++ b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb @@ -27,6 +27,7 @@ SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;t file://CVE-2026-32665.patch \ file://CVE-2026-42955.patch \ file://CVE-2026-44621.patch \ + file://CVE-2026-44687.patch \ " SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c"