Unbound
Last updated
Unbound is a validating, recursive, caching DNS resolver.
Install with winget
$ winget install --id NLnetLabs.Unbound --exact --version 1.26.1Run in Command Prompt, PowerShell, or Windows Terminal. Prompts for any agreements.
Silent install command for Unbound
Unbound uses EXE (NSIS). The silent install switches are /S.
unbound_setup_1.26.1.exe /S
For Intune admins
Stop chasing app updates. Pckgr patches them for you.
Automated application patching for Microsoft Intune. Pckgr keeps a curated library of 1,000+ apps continuously up-to-date in your tenant via Microsoft Graph - no manual repackaging, no chasing vendor sites.
Start free 30-day trialFrom $49/month. No credit card required.
Not on Intune? Pckgr RMM deploys and patches apps like this one on any Windows fleet. Free for up to 5 devices.
Installers · v1.26.1
| Architecture | Type | Scope | Install | Download |
|---|---|---|---|---|
| x86 | EXE NSIS | - | Direct |
Copy a command tailored to that specific architecture, type, and scope - useful when winget would otherwise pick a different default.
Security
25 known CVEs via NVD
Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including...
NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. During failure code paths (i.e., RPZ drop query, jostle due to heavy traffic), a dropped DoH stream brings down the whole Do...
In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream respo...
In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA can overflow the di...
In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor...
In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT conn...
NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that holds the DNS response. ngtcp2's retransmission buffer keeps a shallow pointer int...
In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the...
See a CVE that affects your fleet? Push the patched version to Intune in one click with Pckgr - automated patching is the only way to keep up.
Not on Intune? Patch it with Pckgr RMM, free for up to 5 devices.
Frequently asked questions
How do I install Unbound on Windows?
How do I install Unbound silently for unattended deployment?
What are the silent install switches for Unbound?
How do I uninstall Unbound via winget?
Is Unbound free?
Does Unbound work on Windows 10?
How do I keep Unbound up to date?
Recent versions
- 1.26.1latest
- 1.26.0
- 1.25.2
- 1.25.1
- 1.25.0
- 1.24.2
- 1.24.1
- 1.24.0
- 1.23.1
- 1.23.0