CVS commit: [pkgsrc-2026Q3] pkgsrc/net/unbound

["Benny Siegert" <bsiegert%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   bsiegert
Date:           Mon Nov  2 19:53:33 UTC 2026

Modified Files:
        pkgsrc/net/unbound [pkgsrc-2026Q3]: Makefile distinfo

Log Message:
Pullup ticket #7324 - requested by kim
net/unbound: security fix

Revisions pulled up:
- net/unbound/Makefile                                          1.141
- net/unbound/distinfo                                          1.94

---
   Module Name:    pkgsrc
   Committed By:   kim
   Date:           Thu Oct 22 10:18:40 UTC 2026

   Modified Files:
           pkgsrc/net/unbound: Makefile distinfo

   Log Message:
   unbound: update to 1.26.2

   This release consolidates security fixes for issues reported over
   a period of time. There are fixes for CVE-2026-35501, CVE-2026-50106,
   CVE-2026-96405, CVE-2026-97206 and CVE-2026-109125.

   Bug Fixes

   - Fix CVE-2026-97206, DoQ path-migration can lead to use-after-free on
     multi-threaded deployments. Thanks to Kunta Chu and Jianjun Chen
     from Tsinghua University for the report.
   - Fix CVE-2026-50106, Possible insecure NXDOMAIN for non-existing
     records under a configured island trust anchor underneath an
     insecure parent. Thanks to Qifan Zhang from Palo Alto Networks
     for the report.
   - Fix CVE-2026-96405, Aggregate DNS name chained pointer decompression
     work leads to degradation of service. Thanks to Yuheng Zhang
     (Tsinghua University and Jingxian Technology Co., Ltd.), Jianjun
     Chen (Tsinghua University), Zihan Wang (Z.AI Co., Ltd.) and Kaiwen
     Shen (CloudItera) for the report.
   - Fix CVE-2026-109125, Possible cache poisoning vulnerability via
     a cache side-channel exposed by 'unwanted-reply-threshold'. Thanks
     to TaoFei Guo (Peking University), and Yang Luo and JianJun Chen
     (Tsinghua University) for the report.
   - Fix CVE-2026-35501, Bypass of a configured island trust anchor
     underneath an insecure parent from an attacker-controlled NSEC
     record. Thanks to Qifan Zhang from Palo Alto Networks for the
     report.


To generate a diff of this commit:
cvs rdiff -u -r1.139 -r1.139.2.1 pkgsrc/net/unbound/Makefile
cvs rdiff -u -r1.93 -r1.93.2.1 pkgsrc/net/unbound/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/net/unbound/Makefile
diff -u pkgsrc/net/unbound/Makefile:1.139 pkgsrc/net/unbound/Makefile:1.139.2.1
--- pkgsrc/net/unbound/Makefile:1.139   Mon Sep 21 09:44:22 2026
+++ pkgsrc/net/unbound/Makefile Mon Nov  2 19:53:32 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.139 2026/09/21 09:44:22 kim Exp $
+# $NetBSD: Makefile,v 1.139.2.1 2026/11/02 19:53:32 bsiegert Exp $
 
-DISTNAME=      unbound-1.26.1
+DISTNAME=      unbound-1.26.2
 CATEGORIES=    net
 MASTER_SITES=  https://nlnetlabs.nl/downloads/unbound/
 

Index: pkgsrc/net/unbound/distinfo
diff -u pkgsrc/net/unbound/distinfo:1.93 pkgsrc/net/unbound/distinfo:1.93.2.1
--- pkgsrc/net/unbound/distinfo:1.93    Mon Sep 21 09:44:22 2026
+++ pkgsrc/net/unbound/distinfo Mon Nov  2 19:53:32 2026
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.93 2026/09/21 09:44:22 kim Exp $
+$NetBSD: distinfo,v 1.93.2.1 2026/11/02 19:53:32 bsiegert Exp $
 
-BLAKE2s (unbound-1.26.1.tar.gz) = 876b749d8f3b74a0fd39e852f9579c3b7bd1f5532f68682c9dceffbb15c8351d
-SHA512 (unbound-1.26.1.tar.gz) = b0a02fe77e5d0ad697e950ee0c13b987f0f33b489dfe4bf4ed0b09723ca883ebe4465f69625b7d4eba8171516e6879bb07bf8c22b6e8bdd357e2f4f43e485525
-Size (unbound-1.26.1.tar.gz) = 6948585 bytes
+BLAKE2s (unbound-1.26.2.tar.gz) = d52402a3cbd248aa0766f55cc0fd1deffd1829bee915cb7ed8c2672766ea3287
+SHA512 (unbound-1.26.2.tar.gz) = a4e9e88feda033d4311f573fda624bcb5f964a7bf21639d3a0719a384aef72b594f56f58b42cdca897f0c07d2f343179e56c330c153052040902aed66522c9fc
+Size (unbound-1.26.2.tar.gz) = 6949796 bytes
 SHA1 (patch-configure) = 37abfa057f57c7ca712972ce06de8f09d667c2c6