BIND, Unbound and PowerDNS Fixed 16 CVEs on 21 October, and Two of Them Cap DNS Name Decompression Work
Security / news
BIND, Unbound and PowerDNS Fixed 16 CVEs on 21 October, and Two of Them Cap DNS Name Decompression Work
Unbound 1.26.2 and PowerDNS add limits on how much compressed-name work one packet can cost; the DNS advisories also include a cache-poisoning and a DNSSEC-bypass flaw.
A network attacker who can reach a recursive resolver, and who controls an authoritative server the resolver will query, can make Unbound burn CPU by chaining DNS compression pointers in one reply. Unbound 1.26.2 and PowerDNS patched that class of flaw on 21 October 2026, the same day ISC fixed four separate BIND 9 bugs. Three projects posted advisories to oss-security that day; the DNS fixes are in 9.20.30 and 9.21.27 (BIND), 1.26.2 (Unbound) and PowerDNS Recursor 5.3.12 and 5.4.8.
- PowerDNS Recursor 5.3.12 / 5.4.87 CVEs
- Unbound 1.26.25 CVEs
- BIND 9.20.30 / 9.21.274 CVEs
- PowerDNS Authoritative 4.9.18 / 5.0.8 / 5.1.51 CVEs
Source: oss-security posts from ISC, NLnet Labs and PowerDNS, accessed 2026-10-22
The authoritative server's one CVE, CVE-2026-73206, is also in the Recursor's seven, so the distinct total is 16.
The shared flaw: unbounded decompression
Unbound's advisory for CVE-2026-96405 (Medium, CVSS 3.1) says it limits compression-pointer traversal for each individual name operation but "has no aggregate inbound decompression-work budget." Many chained pointers in one message consume a lot of CPU. The fix, per NLnet Labs, is a limit of 2048 per upstream reply packet and 128000 per zone transfer packet. NLnet credits Yuheng Zhang, Jianjun Chen, Zihan Wang and Kaiwen Shen.
PowerDNS Security Advisory 2026-13 describes CVE-2026-73206 as a crafted packet that causes high resource use while a server decompresses DNS name pointers. It is rated High, CVSS 3.1 score 7.5 (availability only), with "Risk of system compromise: None." Affected are the Authoritative Server up to 4.9.17, 5.0.7 and 5.1.4. The reporter is listed as Yuheng Zhang et al., and the fix adds limits on decompression per name and per packet. The same name appears in both projects' credits; neither page says the reports are linked.
What else shipped
Unbound's other four are a High use-after-free (CVE-2026-97206) in the DNS-over-QUIC path on multi-threaded deployments, affecting 1.22.0 through 1.26.1, credited to Kunta Chu and Jianjun Chen of Tsinghua University; a Medium cache-poisoning risk through a side channel exposed by unwanted-reply-threshold (CVE-2026-109125); a Medium insecure NXDOMAIN under an island trust anchor (CVE-2026-50106); and a Low trust-anchor bypass (CVE-2026-35501).
PowerDNS Recursor's list includes CVE-2026-85555, a DNSSEC validation bypass and cache poisoning through out-of-band NS resolution. Three of its seven are High; the post does not say which. ISC's four BIND bugs are resource exhaustion (CVE-2026-19630), memory corruption from concurrent GSS-TSIG messages (CVE-2026-94300) and two crashes of named (CVE-2026-96888, CVE-2026-97313).
What the advisories leave out
None of the posts says any flaw is exploited. The Unbound decompression bug needs two preconditions: recursive-query access and control of an ordinarily delegated authoritative server, so its Medium rating fits. ISC's post gives no severities or affected ranges and says the embargo has ended, so BIND operators have to read ISC's knowledge-base pages for each CVE.
PowerDNS lists no workaround and Unbound offers an upgrade or its published patches. The same day brought GitLab's second CVSS 10.0 overflow and the PHP 8.5.12 release.
Sources
More in Security
- 01musl's regcomp Has Integer Overflows in Every Release Since 0.5.0, and the Fix Is 1.2.7, Not Yet OutCVE-2026-107891 needs an application that compiles untrusted regular expressions; Alpine shipped patched packages before musl did.
- 02eMudhra's Eight Intermediate CA Keys Were Single Bytes, Recoverable in 256 GuessesChrome, Firefox, Apple and Microsoft have blocked the intermediates, but curl, Python and Node still accepted a forged certificate in one researcher's tests.
- 03AWS Says Its Services Are Not Affected by the PHP Flaws, but Lightsail Instances Cannot Be Patched in PlaceBulletin 2026-143-AWS lists four services with different fixes, an 8,192-byte WAF body limit for one CVE and a custom rule for the other.
- 04PHP Pre-Announces Two CVSS 9.2 Flaws for 14:00 UTC and Names No VersionsA third-party post already lists CVE IDs and 'fixed' builds that are the September 24 releases, which contradicts php.net.