Skip to content
OpenAdvisories
High ALSA-2026:37282 4 CVEs

Important: unbound security update

Published Jul 9, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

* unbound: Unbound: Denial of Service via excessive EDNS options (CVE-2026-41292)
* unbound: Unbound: Cache manipulation via 'ghost domain names' attack (CVE-2026-40622)
* unbound: Unbound: Denial of Service due to excessive resource consumption with large DNS Resource Record Sets (CVE-2026-44390)
* unbound: Unbound: Denial of Service due to degraded resolution performance in jostle logic (CVE-2026-42534)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 4

ReleasePackageFixed in
AlmaLinux · 8 python3-unbound 1.16.2-5.12.el8_10
AlmaLinux · 8 unbound 1.16.2-5.12.el8_10
AlmaLinux · 8 unbound-devel 1.16.2-5.12.el8_10
AlmaLinux · 8 unbound-libs 1.16.2-5.12.el8_10

Vulnerabilities 4

  • Medium 6.9
    CVE-2026-42534

    Jostle logic bypass degrades resolution performance

    NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could defeat its purpose and degrade resolution performance. Retransmits of the same query could renew the age of slow running queries and not allow the jostle …

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • Medium 6.9
    CVE-2026-44390

    Unbounded name compression in certain cases causes degradation of service

    NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets that Unbound needs to perform name compression for. Malicious upstream responses with very large RRsets with records that don't share a suff…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • Medium 6.6
    CVE-2026-40622

    Another 'ghost domain names' attack variant

    NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, a…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • Medium 6.6
    CVE-2026-41292

    Long list of incoming EDNS options degrades performance

    NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS options can hold Unbound threads hostage while they …

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-40622
  • report
    https://access.redhat.com/security/cve/CVE-2026-41292
  • report
    https://access.redhat.com/security/cve/CVE-2026-42534
  • report
    https://access.redhat.com/security/cve/CVE-2026-44390
  • report
    https://bugzilla.redhat.com/2480125
  • report
    https://bugzilla.redhat.com/2480130
  • report
    https://bugzilla.redhat.com/2480131
  • advisory
    https://errata.almalinux.org/8/ALSA-2026-37282.html