Summary
The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.
Security Fix(es):
* unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes (CVE-2026-44690)
* unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option (CVE-2026-55973)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | python3-unbound | 1.24.2-7.el10_2.4 |
| AlmaLinux · 10 | unbound | 1.24.2-7.el10_2.4 |
| AlmaLinux · 10 | unbound-anchor | 1.24.2-7.el10_2.4 |
| AlmaLinux · 10 | unbound-devel | 1.24.2-7.el10_2.4 |
| AlmaLinux · 10 | unbound-dracut | 1.24.2-7.el10_2.4 |
| AlmaLinux · 10 | unbound-libs | 1.24.2-7.el10_2.4 |
| AlmaLinux · 10 | unbound-utils | 1.24.2-7.el10_2.4 |
Vulnerabilities 2
-
High 7.5
Cross-zone wildcard cache poisoning via RRSIG.labels manipulation
In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a sin…
-
High 7.5
'dns-error-reporting: yes' leads to stack buffer overflow
In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain nam…