CVE-2026-50583 is a medium severity vulnerability affecting multiple specific versions of the mbedtls library. The exact nature and technical details of the vulnerability are not provided. There is no CVSS score or detailed impact information available. No known exploits in the wild have been reported. No patch or remediation information is currently available.
CVE-2026-50584 is a medium severity vulnerability affecting multiple specific versions of the mbedtls library. No detailed technical description or CVSS score is available. The affected versions include various releases from 2.1.2-1 through 3.6.7-3ubuntu1, as explicitly listed. There is no information on exploitation in the wild or vendor-provided patch status.
CVE-2026-50585 is a medium severity vulnerability affecting multiple specific versions of the mbedtls library. No detailed description or technical details about the nature of the vulnerability are available. There is no information on exploitation or patch availability.
A medium severity vulnerability identified as CVE-2026-50586 affects multiple specific versions of the mbedtls library. The exact nature and technical details of the vulnerability are unknown based on the available data. There is no CVSS score or detailed description to clarify the impact or exploitation methods. No known exploits are reported in the wild. The affected versions are explicitly listed, covering a range of mbedtls releases primarily used in Ubuntu distributions. No patch or remediation information is provided, and the vulnerability does not pertain to a cloud service.
CVE-2026-50587 is a medium severity vulnerability affecting multiple specific versions of the mbedtls library. The exact nature and technical details of the vulnerability are unknown based on the provided data. There is no CVSS score or detailed description available. No information about available patches or vendor advisories is provided. No known exploits in the wild have been reported. The affected versions include various specific releases from 2.1.2-1 through 3.6.7-3ubuntu1 and others as listed. No geographic targeting is indicated.
CVE-2026-50588 is a medium severity vulnerability affecting multiple specific versions of the mbedtls library. The exact nature and technical details of the vulnerability are unknown based on the provided data. There is no CVSS score or detailed description available. No known exploits in the wild have been reported. The affected versions include a range of mbedtls releases primarily used in Ubuntu distributions. No patch or remediation information is provided, so the patch status is not confirmed.
CVE-2026-50640 is a medium severity vulnerability affecting multiple specific versions of the mbedtls library. The exact nature and technical details of the vulnerability are unknown based on the provided data. There is no CVSS score or detailed description available. No known exploits in the wild have been reported. The affected versions include various releases from 2.1.2-1 through 3.6.7-3ubuntu1 and related Ubuntu package versions. No patch or remediation information is provided, so patch status is not confirmed. No geographic targeting is indicated.
CVE-2026-50713 is a medium severity vulnerability affecting multiple specific versions of the mbedtls library. No detailed description or technical details about the nature of the vulnerability are available. There is no CVSS score provided, no known exploits in the wild, and no vendor patch or remediation information has been disclosed.
An unspecified vulnerability has been identified in multiple versions of the mbedtls library. The exact nature and technical details of the vulnerability are unknown based on the provided information. The vulnerability affects numerous specific versions of mbedtls, including various Ubuntu package versions. No CVSS score or detailed impact information is available. The severity is assessed as medium based on the limited data. There is no indication of known exploits in the wild or available patches. The vulnerability is not related to a cloud service, and no vendor advisory or remediation guidance is provided.
CVE-2026-54441 is a medium severity vulnerability affecting multiple specific versions of the mbedtls library. The exact nature and technical details of the vulnerability are unknown as no description or CVSS score is provided. The affected versions include various releases from 2.1.2-1 through 3.6.7-3ubuntu1, primarily in Ubuntu package variants. There is no public information on exploitation in the wild or vendor-provided patches. Due to the lack of detailed information, the impact and remediation status remain unclear.
NLnet Labs Unbound versions 1.16.2 through 1.25.1 contain a vulnerability related to 'ghost domain names' attacks. This flaw allows an attacker controlling a ghost zone to extend the caching window of expired parent-side glue records by up to one TTL value. When the 'harden-referral-path' option is enabled, Unbound performs implicit queries that can trigger this behavior without client queries. This vulnerability is a variant of CVE-2026-40622 but affects A/AAAA glue records instead of NS queries. The CVSS score is 3.7, indicating medium severity.
NLnet Labs Unbound versions 1.13.2 through 1.25.1 contain a vulnerability in the handling of stub or forward zones below an intermediate label under a DNSSEC signed zone. An off-by-one error in the 'harden-below-nxdomain' logic causes the DNS resolver to incorrectly return a secure NXDOMAIN answer from the parent zone, bypassing the configured stub or forward zone and preventing the upstream server from being contacted. This issue is enabled by default and affects DNS resolution behavior for certain nested private namespaces.
NLnet Labs Unbound versions 1.6.0 through 1.25.1 contain a vulnerability where a replayed wildcard resource record set (rrset) can be temporarily considered DNSSEC secure based on RRSIG validation alone, before later being marked bogus after NSEC validation. This can lead to a race condition in the serve expired path where a poisoned rrset is cached with a secure status, allowing an attacker to cause a specific DNS record to be replaced by a wildcard record. Exploitation requires injection of a signed wildcard rrset without accompanying NSEC records and involves DNSSEC-signed domains with CNAME wrappers pointing to records adjacent to wildcards. The CVSS score is 3.7 (medium severity).
NLnet Labs Unbound versions 1.22.0 through 1.25.1 contain a vulnerability where a single client query for a deeply nested name under a DNSSEC-signed parent causes Unbound to send more upstream packets than the configured 'max-global-quota'. This bypasses the intended limit on upstream amplification traffic. The vulnerability has a CVSS score of 5.3 (medium severity) and does not impact confidentiality or integrity but affects availability. No known exploits are reported in the wild. The affected versions include multiple specific builds primarily on Ubuntu platforms.
NLnet Labs Unbound versions 1.15.0 through 1.25.1 contain a vulnerability in the handling of TLS server names for DNS-over-TLS (DoT) forwarded queries. A use-after-free condition can occur during the DoT TCP handshake if the owning struct is removed prematurely, leading to a daemon crash and denial of service. Exploitation requires a specific configuration with a stub/forward zone using DoT and an '#authname' suffix, as well as precise timing of transient connection failures.
NLnet Labs Unbound versions 1.6.2 through 1.25.1 have a vulnerability in the 'respip' module when used with 'response-ip' redirect rules or RPZ files with RPZ-IP triggers. The rewriting handler does not verify the security status of upstream DNS answers, allowing BOGUS A/AAAA answers to be rewritten to operator-configured IPs with a hardcoded INSECURE security level. This can cause clients to receive insecure NOERROR replies redirected to potentially malicious IPs.
NLnet Labs Unbound versions 1.7.0 through 1.25.1 have a vulnerability where an auth/rpz zone with a primary hostname resolving to BOGUS A/AAAA records is still treated as a valid XFR endpoint. An attacker who can spoof the hostname's A/AAAA record without needing a valid RRSIG can become the zone's XFR primary and replace the entire zone or the resolver's response policy. This vulnerability has a CVSS score of 6.5 (medium severity).
NLnet Labs Unbound up to and including version 1.25.1 contains a vulnerability related to the 'unwanted-reply-threshold' feature. When enabled with a value greater than zero, glue records of 0.0.0.0/::0 can cause Unbound to repeatedly clear its DNS caches by triggering the unwanted reply counter. This can be exploited by an attacker controlling a delegation that returns such glue records, causing indefinite cache flushes without sending spoofed packets. The issue arises from a mismatch in IP addresses used internally by Unbound and the glue records, leading to false detection of unwanted replies.
NLnet Labs Unbound versions 1.25.0 through 1.25.1 contain a vulnerability where a fix intended to enable cooperation between the 'respip' and 'dns64' modules creates a shallow copy of the view name. Under memory pressure and specific configurations involving 'respip'/'rpz' modules and subquery-attaching modules, this can lead to memory corruption if the original view name owner is removed. The likelihood of a crash is low and depends on memory allocator behavior. Debug memory builds can detect and terminate the server on free errors.
NLnet Labs Unbound versions 1.18.0 through 1.25.1 have a vulnerability in the handling of DNS cookies when listening on a proxy-protocol-port interface with 'answer-cookie: yes'. The server cookie is computed over the proxy's wire address rather than the client address declared by PROXYv2, allowing a server cookie obtained via one proxy node to validate for all clients behind that node. This enables an off-path attacker to replay a harvested cookie with any spoofed source, bypassing DNS Cookie checks.