Skip to content
OpenAdvisories
High ALSA-2026:55784 1 CVE

Important: unbound security update

Published Aug 17, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

* unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes (CVE-2026-44690)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 4

ReleasePackageFixed in
AlmaLinux · 8 python3-unbound 1.16.2-5.14.el8_10
AlmaLinux · 8 unbound 1.16.2-5.14.el8_10
AlmaLinux · 8 unbound-devel 1.16.2-5.14.el8_10
AlmaLinux · 8 unbound-libs 1.16.2-5.14.el8_10

Vulnerabilities 1

  • High 7.5
    CVE-2026-44690

    Cross-zone wildcard cache poisoning via RRSIG.labels manipulation

    In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a sin…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-44690
  • report
    https://bugzilla.redhat.com/2503063
  • advisory
    https://errata.almalinux.org/8/ALSA-2026-55784.html