Skip to content
OpenAdvisories
High ALSA-2026:23231 3 CVEs

Important: unbound security update

Published Jun 4, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

* unbound: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (CVE-2026-42944)
* unbound: Unbound DNSSEC Validator Denial of Service via Incorrect Write Offset Counter in Chase-Reply Messages (CVE-2026-42959)
* unbound: Unbound DNSSEC Validator Use-After-Free via Deep Copy Pointer Overwrite Leading to DoS and Possible Remote Code Execution (CVE-2026-33278)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 7

ReleasePackageFixed in
AlmaLinux · 10 python3-unbound 1.24.2-7.el10_2.1
AlmaLinux · 10 unbound 1.24.2-7.el10_2.1
AlmaLinux · 10 unbound-anchor 1.24.2-7.el10_2.1
AlmaLinux · 10 unbound-devel 1.24.2-7.el10_2.1
AlmaLinux · 10 unbound-dracut 1.24.2-7.el10_2.1
AlmaLinux · 10 unbound-libs 1.24.2-7.el10_2.1
AlmaLinux · 10 unbound-utils 1.24.2-7.el10_2.1

Vulnerabilities 3

  • Critical 9.1
    CVE-2026-33278

    Possible arbitrary code execution during DNSSEC validation

    NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code execution as a result of deep copying a data structure and erroneously overwriting a destination p…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • High 8.7
    CVE-2026-42944

    Heap overflow with multiple NSID, COOKIE, PADDING EDNS options

    NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options ('nsid', 'answer-cookie', '…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • High 8.7
    CVE-2026-42959

    Crash during DNSSEC validation of malicious content

    NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validator that can lead to a crash given malicious upstream replies. When Unbound constructs chase-reply messages for validation, the code uses the wrong…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-33278
  • report
    https://access.redhat.com/security/cve/CVE-2026-42944
  • report
    https://access.redhat.com/security/cve/CVE-2026-42959
  • report
    https://bugzilla.redhat.com/2479774
  • report
    https://bugzilla.redhat.com/2479806
  • report
    https://bugzilla.redhat.com/2479808
  • advisory
    https://errata.almalinux.org/10/ALSA-2026-23231.html