Qifan Zhang (Palo Alto Networks)

Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries

Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records

Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abruptly terminated

Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN

Memory corruption could lead to crash and denial of service

DNS Cookie bypass when combined with proxy-protocol use

Privacy/configuration issue when adding local data in views through 'unbound-control'

'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash

'dns-error-reporting: yes' leads to stack buffer overflow

Packet of death for a DNSCrypt misconfigured Unbound