Skip to content
OpenAdvisories
High ELSA-2026-36320 4 CVEs

Important: unbound security update (Oracle Linux 10)

Published Jul 16, 2026 · Updated Jul 16, 2026

Ecosystem: Oracle Linux

Summary

[1.24.2-15]
- Fix CVE-2026-42534: Jostle logic bypass degrades resolution performance

[1.24.2-14]
- Fix CVE-2026-41292: DoS via excessive EDNS options

[1.24.2-13]
- Add upstream unit test for CVE-2026-40622

[1.24.2-12]
- Fix CVE-2026-44390: DoS with large RRsets

[1.24.2-11]
- Fix CVE-2026-40622: cache manipulation via 'ghost domain names' attack

[1.24.2-10]
- Fix CVE-2026-42959

[1.24.2-9]
- Fix CVE-2026-42944

[1.24.2-8]
- Fix CVE-2026-33278

Fixed packages 7

ReleasePackageFixed in
Oracle Linux · 10 python3-unbound 0:1.24.2-7.el10_2.2
Oracle Linux · 10 unbound 0:1.24.2-7.el10_2.2
Oracle Linux · 10 unbound-anchor 0:1.24.2-7.el10_2.2
Oracle Linux · 10 unbound-devel 0:1.24.2-7.el10_2.2
Oracle Linux · 10 unbound-dracut 0:1.24.2-7.el10_2.2
Oracle Linux · 10 unbound-libs 0:1.24.2-7.el10_2.2
Oracle Linux · 10 unbound-utils 0:1.24.2-7.el10_2.2

Vulnerabilities 4

  • Medium 6.9
    CVE-2026-42534

    Jostle logic bypass degrades resolution performance

    NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could defeat its purpose and degrade resolution performance. Retransmits of the same query could renew the age of slow running queries and not allow the jostle …

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • Medium 6.9
    CVE-2026-44390

    Unbounded name compression in certain cases causes degradation of service

    NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets that Unbound needs to perform name compression for. Malicious upstream responses with very large RRsets with records that don't share a suff…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • Medium 6.6
    CVE-2026-40622

    Another 'ghost domain names' attack variant

    NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, a…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • Medium 6.6
    CVE-2026-41292

    Long list of incoming EDNS options degrades performance

    NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS options can hold Unbound threads hostage while they …

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine