- CVE-2026-81634: bounds-check the scratch buffer in rrset_canonical() and rrset_canonicalize_to_buffer() before writing the RRSIG rdata, the first canonical owner name and each RR's rdata, so a large rrset can no longer be written past the end of the buffer - CVE-2026-80225: cap the number of pipelined TCP/DoT queries drained per event-loop visit in tcp_req_info_read_again() and tcp_more_read_again() and defer the remainder via a zero-delay timer, so one connection can no longer starve the other file descriptors - CVE-2026-85501: bound the DNSSEC validation work per query (ReTrap): add the val-validation-attempts and val-hash-attempts limits (default 32), limit DNSKEY/RRSIG and DS key-tag matches and the NSEC/NSEC3 records checked per message, shorten oversized referral DS RRsets, stop validator restarts once the limits are hit, and require only the answer and authority sections to be secure; the built-in val-clean-additional default is now no, the shipped unbound.conf keeps val-clean-additional: yes