unbound (1.13.1-1ubuntu5.15) jammy-security; urgency=medium

  * SECURITY UPDATE: Packet of death with DNSCrypt (feasibility very low)
    - debian/patches/CVE-2026-32792.patch: validate len in
      dnscrypt/dnscrypt.c.
    - CVE-2026-32792
  * SECURITY UPDATE: Parsing a long list of incoming EDNS options degrades
    performance
    - debian/patches/CVE-2026-41292.patch: limit parsed edns options in
      util/data/msgparse.c.
    - CVE-2026-41292
  * SECURITY UPDATE: Jostle logic bypass degrades resolution performance
    - debian/patches/CVE-2026-42534.patch: properly handle jostle aging in
      services/mesh.c, services/mesh.h.
    - CVE-2026-42534
  * SECURITY UPDATE: Degradation of service with unbounded NSEC3 hash
    calculations
    - debian/patches/CVE-2026-42923.patch: limit salt length in
      validator/val_neg.c, validator/val_nsec3.c, validator/val_nsec3.h.
    - CVE-2026-42923
  * SECURITY UPDATE: Crash during DNSSEC validation of malicious content
    - debian/patches/CVE-2026-42959.patch: fix calculations in
      validator/val_utils.c.
    - CVE-2026-42959
  * SECURITY UPDATE: Possible cache poisoning attack while following
    delegation
    - debian/patches/CVE-2026-42960.patch: only mark glue as allowed for
      type NS in the authority section in iterator/iter_scrub.c.
    - CVE-2026-42960
  * SECURITY UPDATE: Unbounded name compression in certain cases causes
    degradation of service
    - debian/patches/CVE-2026-44390.patch: fix counting in
      util/data/msgencode.c.
    - CVE-2026-44390

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 19 May 2026 08:30:28 -0400

unbound (1.13.1-1ubuntu5.14) jammy-security; urgency=medium

  * SECURITY REGRESSION: Incomplete fix for CVE-2025-11411.
    - debian/patches/CVE-2025-11411-fix1.patch: Add mitigations for YXDOMAIN in
      iterator/iter_scrub.c. Add tests in testdata/iter_scrub_promiscuous.rpl
      and testdata/ratelimit.tdir/ratelimit.testns.
    - CVE-2025-11411

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Mon, 01 Dec 2025 15:12:17 -0330

unbound (1.13.1-1ubuntu5.13) jammy-security; urgency=medium

  * SECURITY UPDATE: promiscuous NS RRSets domain hijack issue
    - debian/patches/CVE-2025-11411.patch: fix possible domain hijacking
      attack and add new iter-scrub-promiscuous configuration option.
    - CVE-2025-11411

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 31 Oct 2025 09:39:13 -0400

unbound (1.13.1-1ubuntu5.12) jammy; urgency=medium

  * Update MAX_RESTART_COUNT from 8 to 11 to allow longer CNAME chains
    (LP: #2122609)

 -- Bryan Alexander <bryan.alexander@canonical.com>  Fri, 26 Sep 2025 12:08:24 -0700

unbound (1.13.1-1ubuntu5.11) jammy-security; urgency=medium

  * SECURITY UPDATE: Rebirthday Attack cache poisoning issue
    - debian/patches/CVE-2025-5994.patch: Fix issue in
      edns-subnet/subnetmod.c, edns-subnet/subnetmod.h.
    - CVE-2025-5994

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 18 Jul 2025 13:40:33 -0400

unbound (1.13.1-1ubuntu5.10) jammy; urgency=medium

  * d/p/lp-2087526-1-fix-memory-exhaust-in-local-zones.patch:
    fix error: fix contents_view ordering in patch (LP: #2087526)

 -- John Chittum <john.chittum@canonical.com>  Wed, 19 Mar 2025 10:04:46 -0500

unbound (1.13.1-1ubuntu5.9) jammy; urgency=medium

  * d/p/lp-2087526-1-fix-memory-exhaust-in-local-zones.patch:
    fix error: "memory exhausted" when defining more than 9994
    local_zones. (LP: #2087526).

 -- John Chittum <john.chittum@canonical.com>  Mon, 10 Feb 2025 12:57:20 -0500

unbound (1.13.1-1ubuntu5.8) jammy-security; urgency=medium

  * SECURITY UPDATE: denial of service via large RRsets compression
    - debian/patches/CVE-2024-8508.patch: limit name compression
      calculations per packet to avoid CPU lockup in util/data/msgencode.c
    - CVE-2024-8508

 -- Vyom Yadav <vyom.yadav@canonical.com>  Thu, 17 Oct 2024 11:28:18 +0530

unbound (1.13.1-1ubuntu5.7) jammy-security; urgency=medium

  * SECURITY UPDATE: null pointer dereference
    - debian/patches/CVE-2024-43167-1.patch: fix null pointer
      dereference issue in function ub_ctx_set_fwd of file
      libunbound/libunbound.c
    - debian/patches/CVE-2024-43167-2.patch: fix to print a parse
      error when config is read with no name for a forward-zone, stub-
      zone or view.
    - CVE-2024-43167
  * SECURITY UPDATE: heap buffer overflow
    - debian/patches/CVE-2024-43168-1.patch: fix heap-buffer-overflow
      issue in function cfg_mark_ports of file util/config_file.c
    - debian/patches/CVE-2024-43168-2.patch: adjust error text and 
      disallow negative ports in other parts of cfg_mark_ports.
    - CVE-2024-43168

 -- Bruce Cable <bruce.cable@canonical.com>  Thu, 05 Sep 2024 16:35:49 +1000

unbound (1.13.1-1ubuntu5.5) jammy-security; urgency=medium

  * SECURITY UPDATE: Unbound could be used to take part in a DoS attack
    - debian/patches/CVE-2024-33655.patch: fix for the DNSBomb
      vulnerability in doc/example.conf.in, doc/unbound.conf.5.in,
      services/cache/infra.c, services/cache/infra.h, services/mesh.c,
      testdata/*, util/config_file.c, util/config_file.h,
      util/configlexer.lex, util/configparser.y.
    - CVE-2024-33655

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 15 May 2024 13:34:34 +0200

# For older changelog entries, run 'apt-get changelog libunbound8'
