- CVE-2026-82720: pop each reply off the mesh reply list before it is dropped or answered, detach the tcp_req_info and DoH stream references and clear the h2 stream mesh states when a DoH session is dropped, so an RPZ drop or jostled query can no longer leave a dangling DoH stream reference that is used after free - CVE-2026-77955: do not serve or write to disk a zonemd-check zone while its ZONEMD verification is still pending; the zonefile write is deferred to the ZONEMD callback and done only if the zone verified - CVE-2026-85501: bound the DNSSEC work per validation (ReTrap): add the val-validation-attempts and val-hash-attempts limits (default 32), limit DNSKEY/RRSIG and DS key-tag matches and NSEC/NSEC3 records checked, shorten oversized referral DS RRsets, stop validator restarts once the limits are hit, and require only the answer and authority sections to be secure; the built-in val-clean-additional default is now no, the shipped unbound.conf keeps val-clean-additional: yes