Refresh OpenSSL packages in the Unbound image
@balajinvda is already working on this.
Since Sep 11, 2026.
- Dominant language
- Go
- Stars
- 218
- Forks
- 72
- Avg merge
- 1d 12h
- Merged PRs (30d)
- 427
Description
Problem
nvcf-unbound:0.10.2 contains libssl3t64 and openssl-provider-fips version 3.5.6-1~deb13u1. The same 18 advisories are reported against both packages, for 36 occurrences total: 6 Critical and 30 High.
Critical (per package): CVE-2026-34182, CVE-2026-63073, CVE-2026-75803
High (per package): CVE-2026-14456, CVE-2026-14457, CVE-2026-18798, CVE-2026-34180, CVE-2026-34181, CVE-2026-34183, CVE-2026-42764, CVE-2026-45445, CVE-2026-45447, CVE-2026-54874, CVE-2026-63072, CVE-2026-63075, CVE-2026-63076, CVE-2026-7383, CVE-2026-9076
Recorded fixed package floors are 3.5.6-1~deb13u2 for the earlier set and 3.5.7-1~deb13u2 for the later set. The target should therefore be at least 3.5.7-1~deb13u2 for both packages.
Expected outcome
- Refresh the Unbound runtime/base package set so both OpenSSL packages are at
3.5.7-1~deb13u2or later. - Keep the OpenSSL package versions coherent; do not update only one of
libssl3t64andopenssl-provider-fips. - Build and exercise the Unbound image, including startup and DNS resolution behavior.
- Publish a replacement release and verify all 36 OpenSSL occurrences are absent from its vulnerability results.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.