- CVE-2024-33655: add the upstream wait-limit and discard-timeout mechanism so accumulated recursion replies can no longer be released as a pulsing burst (DNSBomb), including every upstream follow-up to that mechanism: discard only UDP replies and never a reply on an open stream connection, clear the HTTP/2 stream back-pointer on the drop paths, account discarded replies in mesh num_reply_addrs, and fix CVE-2026-56444 in the serve-expired discard path - CVE-2024-43167: NULL-check the first forward stub name in ub_ctx_set_fwd() to prevent a NULL pointer dereference in libunbound, and reject a forward-zone, stub-zone or view without a name at config parse time so no name-less object reaches the daemon - CVE-2026-42955: clamp the cached TTL of parent-side A/AAAA glue as well as NS records so a client query can no longer renew a ghost domain delegation - CVE-2026-46582: keep a secure wildcard RRset out of the rrset cache until the NSEC wildcard proof completes, preventing poisoning via the serve-expired reply path - CVE-2026-50243: skip the response-ip/RPZ rewrite for BOGUS answers so a spoofed DNSSEC-protected answer is no longer redirected as INSECURE - CVE-2026-55708: enter the default-protected local zones when unbound-control view_local_data creates a view-specific local zone tree