Unbound

Recent Commits

• W.C.A. Wijngaards (28 Jul 26)

  - Tag for 1.26.0rc1. The repo continues with version 1.26.1.

• W.C.A. Wijngaards (24 Jul 26)

  - Fix to call OPENSSL_cleanup on exit when that is defined.

• W.C.A. Wijngaards (24 Jul 26)

  Changelog note for #1479 - Merge #1479 from psumbera: Fix pthread detection on Solaris 11.4.

• Petr Sumbera (24 Jul 26)

  Fix pthread detection on Solaris 11.4 (#1479) AX_PTHREAD requires _REENTRANT to confirm that pthread support is enabled. Solaris 11.4 headers no longer use the macro, and GCC 16 therefore no longer defines it for -pthread. Detect XPG7 support in the target headers and require _REENTRANT only on older Solaris releases. The existing pthread compile and link test remains the final capability check. This follows the canonical Autoconf Archive change: https://github.com/autoconf-archive/autoconf-archive/pull/341 Regenerate configure with Autoconf 2.71. Tested on Solaris 11.4 with GCC 15.2 and GCC 16.1. The Autoconf Archive change was also tested on Solaris 11.3. Co-authored-by: Rainer Orth <[email protected]>

• W.C.A. Wijngaards (24 Jul 26)

  Changelog note for #1481. - Fix #1481: Fix to use tls-port after referral if tls-upstream is set.

• W.C.A. Wijngaards (24 Jul 26)

  - Fix to use tls-port after referral if tls-upstream is set.

• W.C.A. Wijngaards (24 Jul 26)

  - Fix sign of comparison warning in shared ports setup.

• W.C.A. Wijngaards (24 Jul 26)

  - Fix to guard access to shared ports interface array during set up, for analyzer.

• W.C.A. Wijngaards (24 Jul 26)

  - Fix unused variable warnings in shared_ports_fetch_random and shared_ports_return_port when compiled without threads.

• W.C.A. Wijngaards (24 Jul 26)

  Changelog entry for #1480 - Merge #1480 from petrvaganoff: authzone: fix memory leak in xfer_set_masters() error path.

• Petr Vaganov (24 Jul 26)

  authzone: fix memory leak in xfer_set_masters() error path (#1480) Added memory deallocation for the `file` and `host` fields of the `auth_master` node in the event of a URL/allocation error, and unlinked the partially created node from the masters list by resetting the link that pointed to it. Signed-off-by: Petr Vaganov <[email protected]>

• W.C.A. Wijngaards (24 Jul 26)

  - Fix lock test protect for auth zone change. - Fix to lock shared_ports structure during initialisation. - Fix to lock anchor structure when file is set for it in

• W.C.A. Wijngaards (24 Jul 26)

  - Fix to allow test fake sha1 on systems with possible sha1 support. - Fix to use sha256 for unbound-anchor unit test. - Fix unbound-anchor check for return value of X509_NAME_get_text_by_NID of the emailaddress.

• W.C.A. Wijngaards (24 Jul 26)

  - Update generated man pages.

• W.C.A. Wijngaards (24 Jul 26)

  - set code repository version to 1.26.0.

• W.C.A. Wijngaards (24 Jul 26)

  - Fix #1477: respip + dns64: dns64 uses A records modified by respip instead of original A records. Adds local-zone types block_a_wdata and block_aaaa_wdata, that are like block_a and block_aaaa, and uses local-data if present.

• W.C.A. Wijngaards (24 Jul 26)

  - Unit test for block_a and block_aaaa.

• W.C.A. Wijngaards (24 Jul 26)

  Changelog note for #1433 - Merge #1433 from jisakiel: Add new static zone type block_aaaa to suppress AAAA queries.

• Jisakiel (24 Jul 26)

  Add new static zone type block_aaaa to suppress AAAA queries (#1433) Following d5b9a790f lead for block_a - this would allow suppressing AAAA queries instead for sticking to IPV4. Co-authored-by: Jisakiel <[email protected]>

• W.C.A. Wijngaards (23 Jul 26)

  - Fix mesh cycle detection for configuration with respip CNAME loop and tagged clients. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards (23 Jul 26)

  - Fix that the aggressive negative cache does not insert NSEC records with overreaching next owner name. Also the result is not above the trust anchor's bailiwick. Also RRSIGS are not considered valid when an NSEC next owner name is not under the signer zone name. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards (23 Jul 26)

  - Fix that for NSEC3 proofs the NSEC3 zone, as the b32.name is checked to be the same as the signer name. Also RRSIGs are not considered valid when an NSEC3 is not b32.signerzone. Thanks to Qifan Zhang, Palo Alto Networks, for the report.

• W.C.A. Wijngaards (23 Jul 26)

  Changelog entry for #1478 - Merge #1478 from petrvaganoff: pythonmod: add check return value after ftell().

• Petr Vaganov (23 Jul 26)

  pythonmod: add check return value after ftell() (#1478) Variable 'flen', which might receive a negative value at pythonmod.c:493 by calling function 'ftell', is used without checking at pythonmod.c:508 by calling function 'fread'. Found by the static analyzer Svace (ISP RAS). Signed-off-by: Petr Vaganov <[email protected]>

• W.C.A. Wijngaards (23 Jul 26)

  - Updated credits for Xuanchao Xie in 22 july changelog.

• W.C.A. Wijngaards (22 Jul 26)

  - iana portlist update.

• W.C.A. Wijngaards (22 Jul 26)

  - Fix error in log printout in fix for CVE-2026-50248, when the primary name is bogus.

• W.C.A. Wijngaards (22 Jul 26)

  - Unit test for CVE-2026-56416.

• W.C.A. Wijngaards (22 Jul 26)

  - Unit test for CVE-2026-55973.

• W.C.A. Wijngaards (22 Jul 26)

  - Unit test for CVE-2026-55717.