Skip to content
OpenAdvisories
Medium RHSA-2026:37282 4 CVEs

Red Hat Security Advisory: unbound security update

Published Jul 29, 2026 · Updated Oct 19, 2026

Ecosystem: Red Hat

Fixed packages 8

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream python3-unbound 0:1.16.2-5.12.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream python3-unbound-debuginfo 0:1.16.2-5.12.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream unbound 0:1.16.2-5.12.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream unbound-debuginfo 0:1.16.2-5.12.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream unbound-debugsource 0:1.16.2-5.12.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream unbound-devel 0:1.16.2-5.12.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream unbound-libs 0:1.16.2-5.12.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream unbound-libs-debuginfo 0:1.16.2-5.12.el8_10

Vulnerabilities 4

  • Medium 6.9
    CVE-2026-42534

    Jostle logic bypass degrades resolution performance

    NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could defeat its purpose and degrade resolution performance. Retransmits of the same query could renew the age of slow running queries and not allow the jostle …

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • Medium 6.9
    CVE-2026-44390

    Unbounded name compression in certain cases causes degradation of service

    NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets that Unbound needs to perform name compression for. Malicious upstream responses with very large RRsets with records that don't share a suff…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • Medium 6.6
    CVE-2026-40622

    Another 'ghost domain names' attack variant

    NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, a…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • Medium 6.6
    CVE-2026-41292

    Long list of incoming EDNS options degrades performance

    NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS options can hold Unbound threads hostage while they …

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2480125
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2480127
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2480130
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2480131
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_37282.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-40622
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-40622
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-40622
  • article
    https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-40622.txt
  • report
    https://access.redhat.com/security/cve/CVE-2026-41292
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-41292
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-41292
  • article
    https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-41292.txt
  • report
    https://access.redhat.com/security/cve/CVE-2026-42534
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-42534
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-42534
  • article
    https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42534.txt
  • report
    https://access.redhat.com/security/cve/CVE-2026-44390
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-44390
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-44390
  • article
    https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-44390.txt