Summary
[1.16.2-5.12]
- Fix CVE-2026-40622 (RHEL-184832)
- Fix CVE-2026-44390 (RHEL-186680)
- Fix CVE-2026-41292 (RHEL-187346)
- Fix CVE-2026-42534 (RHEL-187081)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | python3-unbound | 0:1.16.2-5.12.el8_10 |
| Oracle Linux · 8 | unbound | 0:1.16.2-5.12.el8_10 |
| Oracle Linux · 8 | unbound-devel | 0:1.16.2-5.12.el8_10 |
| Oracle Linux · 8 | unbound-libs | 0:1.16.2-5.12.el8_10 |
Vulnerabilities 4
-
Medium 6.9
Jostle logic bypass degrades resolution performance
NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could defeat its purpose and degrade resolution performance. Retransmits of the same query could renew the age of slow running queries and not allow the jostle …
-
Medium 6.9
Unbounded name compression in certain cases causes degradation of service
NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets that Unbound needs to perform name compression for. Malicious upstream responses with very large RRsets with records that don't share a suff…
-
Medium 6.6
Another 'ghost domain names' attack variant
NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, a…
-
Medium 6.6
Long list of incoming EDNS options degrades performance
NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS options can hold Unbound threads hostage while they …