Skip to content
OpenAdvisories
High RHSA-2026:55784 1 CVE

Red Hat Security Advisory: unbound security update

Published Aug 18, 2026 · Updated Oct 19, 2026

Ecosystem: Red Hat

Fixed packages 8

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream python3-unbound 0:1.16.2-5.14.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream python3-unbound-debuginfo 0:1.16.2-5.14.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream unbound 0:1.16.2-5.14.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream unbound-debuginfo 0:1.16.2-5.14.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream unbound-debugsource 0:1.16.2-5.14.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream unbound-devel 0:1.16.2-5.14.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream unbound-libs 0:1.16.2-5.14.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream unbound-libs-debuginfo 0:1.16.2-5.14.el8_10

Vulnerabilities 1

  • High 7.5
    CVE-2026-44690

    Cross-zone wildcard cache poisoning via RRSIG.labels manipulation

    In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a sin…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2503063
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55784.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-44690
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-44690
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-44690
  • article
    https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-44690.txt