Skip to content
OpenAdvisories
Medium RHSA-2026:20357 4 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published May 28, 2026 · Updated Oct 9, 2026

Ecosystem: Red Hat

Fixed packages 8

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 python3-unbound 0:1.25.1-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 unbound 0:1.25.1-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 unbound-anchor 0:1.25.1-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 unbound-devel 0:1.25.1-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 unbound-dracut 0:1.25.1-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 unbound-libs 0:1.25.1-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 unbound-munin 0:1.25.1-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 unbound-utils 0:1.25.1-1.hum1

Vulnerabilities 4

  • Medium 6.9
    CVE-2026-42923

    Degradation of service with unbounded NSEC3 hash calculations

    NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code path to consult the negative cache for DS records does not take into account the limit on NSEC3 hash calculations introduced in 1.19.1. This leads…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • Medium 6.6
    CVE-2026-40622

    Another 'ghost domain names' attack variant

    NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, a…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • Medium 5.7
    CVE-2026-42960

    Possible cache poisoning via promiscuous records for the authority section

    NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. Promiscuous RRSets that complement DNS replies in the authority section can be used to trick Unbound to cache such records. If …

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • Medium 4.6
    CVE-2026-32792

    Packet of death with DNSCrypt

    NLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service vulnerability when compiled with DNSCrypt support ('--enable-dnscrypt'). A bad DNSCrypt query could underflow Unbound's DNSCrypt packet reading procedure that may lead to heap…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-32792
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-42960
  • report
    https://access.redhat.com/security/cve/CVE-2026-42923
  • report
    https://access.redhat.com/security/cve/CVE-2026-40622
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_20357.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2479779
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-32792
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-32792
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2480127
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-40622
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-40622
  • article
    https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-40622.txt
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2479825
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-42923
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-42923
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2479821
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-42960
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-42960