DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.

Aggregate DNS name chained pointer decompression work leads to degradation of service.

Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent.

Bypass of a configured island trust anchor underneath an insecure parent from an atacker-controlled NSEC record.

Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'

Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC

Use-after-free in DoH stream cleanup code path

CNAME synthesis could lead to heap corruption

Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY

Possible heap buffer overflow during DNSSEC canonicalization

Possible degradation of service from continuous queries on the same TCP/DoT connection

Use-after-free in DoQ stream output buffer on reset re-transmission

Possible ZONEMD verification bypass window

'serve-expired' can bypass Unbound 'wait-limit'

Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration

Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name

Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2

Packet of death for a DNSCrypt misconfigured Unbound

'dns-error-reporting: yes' leads to stack buffer overflow

'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash

Privacy/configuration issue when adding local data in views through 'unbound-control'

DNS Cookie bypass when combined with proxy-protocol use

Memory corruption could lead to crash and denial of service

Possible cache poisoning attack by mapping source port population per thread

Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush

BOGUS configured primary hostname accepted for XFR in auth/rpz zones

'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL

Possible heap use-after-free in an error path when a DoT forwarded query is jostled out

'max-global-quota' reset by DNSSEC validation restarts

A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path