unbound (1.26.1-1) [PTS] [DDPO]

OK: VCS matches the version in the archive

Git: https://salsa.debian.org/dns-team/unbound.git
JSON
Enter a full Vcs-* header, supported schemes are: Vcs-Bzr, Vcs-Cvs, Vcs-Darcs, Vcs-Git, Vcs-Hg, Vcs-Mtn, Vcs-Svn.
For Vcs-Git append -b branch to select the branch name; append [subdir] if the debian/ directory is not in the repository root.
The next upload will reset the information from the source package headers.
Branch: master
Path: debian/changelog
Repo size: 14204928
Browser: https://salsa.debian.org/dns-team/unbound
Last scan: 2026-10-10 02:38:03+00
Next scan: 2026-10-18 10:34:00+00
Merge requests: 3
CI pipeline status: success

Debian changelog in Git:

unbound (1.26.1-1) unstable; urgency=medium

  * new upstream security/bugfx release, including the following fixes:
   - CVE-2026-81642 - severity: CRITICAL
     Heap buffer overflow and possible Remote Code Execution
     when digesting DNSKEY
   - CVE-2026-81634 - severity: HIGH
     Possible heap buffer overflow during DNSSEC canonicalization
   - CVE-2026-82717 - severity: HIGH
     CNAME synthesis could lead to heap corruption
   - CVE-2026-77955 - severity: MEDIUM
     Possible ZONEMD verification bypass window
   - CVE-2026-78227 - severity: MEDIUM
     Use-after-free in DoQ stream output buffer on reset re-transmission
   - CVE-2026-80225 - severity: MEDIUM
     Possible degradation of service from continuous queries
     on the same TCP/DoT connection
   - CVE-2026-82720 - severity: MEDIUM
     Use-after-free in DoH stream cleanup code path
   - CVE-2026-85501 - severity: MEDIUM
     Retrap: Novel Vulnerabilities to launch
     Algorithmic Complexity Attacks on DNSSEC
   - CVE-2026-77860 - severity: LOW
     'serve-expired' can bypass Unbound 'wait-limit'

 -- Michael Tokarev <mjt@tls.msk.ru>  Wed, 16 Sep 2026 18:31:09 +0300

This branch is even with tag debian/1.26.1-1