Ubuntu USN-8946-1 Fixes Unbound DNS Vulnerabilities
Tech GuruQuick Answer
Ubuntu published USN-8946-1 for ten Unbound vulnerabilities across supported and ESM releases. Match each resolver to the release- and feature-specific scope, install the listed package, restart or reload the service, validate DNSSEC and cache behavior, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory Ubuntu Unbound packages, releases, features, exposure, upstreams, and entitlements; match CVE-specific scope; install the supported package; restart or reload the resolver; validate resolution, DNSSEC, forwarding, and cache integrity; and retain evidence.
Last verified: 2026-10-21 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Unbound packages on supported Ubuntu releases from 14.04 ESM through 26.04 LTS |
|---|---|
| Advisory | USN-8946-1 |
| CVEs | CVE-2023-50387, CVE-2023-50868, CVE-2026-32665, CVE-2026-40691, CVE-2026-44690, CVE-2026-50252, CVE-2026-55973, CVE-2026-80225, CVE-2026-81634, CVE-2026-85501 |
| Authoritative release date | 2026-10-21 09:48:45 UTC |
| Authority revision date | 2026-10-21 09:48:45 UTC |
| Affected versions | Ubuntu 26.04, 24.04, 22.04, 20.04 ESM, 18.04 ESM, 16.04 ESM, and 14.04 ESM with vulnerable Unbound packages; individual CVE applicability varies by release and feature. |
| Fixed version | 26.04: 1.24.2-1ubuntu2.4; 24.04: 1.19.2-1ubuntu3.12; 22.04: 1.13.1-1ubuntu5.17; 20.04: 1.9.4-2ubuntu1.11+esm3; 18.04: 1.6.7-1ubuntu2.6+esm6; 16.04: 1.5.8-1ubuntu1.1+esm5; 14.04: 1.4.22-1ubuntu4.14.04.3+esm5 |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Ubuntu does not state that these vulnerabilities are being maliciously exploited.; no exploitation claim is inferred. |
What Changed
Ubuntu fixed ten Unbound DNS resolver issues that can enable remote denial of service or, for CVE-2026-44690 on specified releases, DNS cache poisoning. DNSCrypt, DNS-over-QUIC, DNSSEC, and release-specific exposure differ across the set.
What To Validate Now
- Inventory. Identify Ubuntu Unbound resolvers and libraries, exact release and package version, enabled DNSSEC, DNSCrypt, DNS-over-QUIC and TCP features, network exposure, upstreams, owners, and ESM entitlement.
- Establish applicability. Match each host and feature to the CVE-specific Ubuntu release scope. Do not infer that every listed CVE affects every Ubuntu release or resolver configuration.
- Remediate. Install the USN-listed Unbound and libunbound package versions using the appropriate Ubuntu or Ubuntu Pro/ESM channel and restart or reload the resolver according to the supported procedure.
- Validate. Confirm the installed and running version, validate DNSSEC and representative resolution, forwarding and cache behavior, monitor availability and cache integrity, and retain package and service evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
CVE applicability varies by Ubuntu release and enabled feature. Ubuntu Pro or Legacy Support is required for older ESM fixes. Treat resolver availability and cache integrity as separate validation targets after the update.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
