Skip to content
OpenAdvisories
Critical RHSA-2026:68590 9 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Sep 22, 2026 · Updated Oct 17, 2026

Ecosystem: Red Hat

Fixed packages 8

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 python3-unbound 0:1.26.1-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 unbound 0:1.26.1-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 unbound-anchor 0:1.26.1-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 unbound-devel 0:1.26.1-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 unbound-dracut 0:1.26.1-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 unbound-libs 0:1.26.1-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 unbound-munin 0:1.26.1-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 unbound-utils 0:1.26.1-1.hum1

Vulnerabilities 9

  • Critical 9.1
    CVE-2026-81642 Public exploit

    Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY

    In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • High 8.4
    CVE-2026-82717

    CNAME synthesis could lead to heap corruption

    In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis duri…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-81634

    Possible heap buffer overflow during DNSSEC canonicalization

    In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length chec…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux
  • Medium 6.5
    CVE-2026-78227

    Use-after-free in DoQ stream output buffer on reset re-transmission

    NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that holds the DNS response. ngtcp2's retransmission buffer keeps a…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux
  • Medium 5.9
    CVE-2026-82720

    Use-after-free in DoH stream cleanup code path

    NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. During failure code paths (i.e., RPZ drop query, jostle due to heavy traffic), a dropped DoH stream brin…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux
  • Medium 5.3
    CVE-2026-80225

    Possible degradation of service from continuous queries on the same TCP/DoT connection

    In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names o…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux
  • Medium 5.3
    CVE-2026-85501

    Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC

    Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux
  • Medium 4.4
    CVE-2026-77955

    Possible ZONEMD verification bypass window

    In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux
  • Low 3.7
    CVE-2026-77860

    'serve-expired' can bypass Unbound 'wait-limit'

    In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb (…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-81642
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-82720
  • report
    https://access.redhat.com/security/cve/CVE-2026-81634
  • report
    https://access.redhat.com/security/cve/CVE-2026-80225
  • report
    https://access.redhat.com/security/cve/CVE-2026-77860
  • report
    https://access.redhat.com/security/cve/CVE-2026-77955
  • report
    https://access.redhat.com/security/cve/CVE-2026-85501
  • report
    https://access.redhat.com/security/cve/CVE-2026-82717
  • report
    https://access.redhat.com/security/cve/CVE-2026-78227
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68590.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2535050
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-77860
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-77860
  • article
    https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-77860.txt
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2535053
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-77955
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-77955
  • article
    https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-77955.txt
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2535052
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-78227
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-78227
  • article
    https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-78227.txt
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2535055
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-80225
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-80225
  • article
    https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-80225.txt
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2535054
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-81634
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-81634
  • article
    https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81634.txt
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2535059
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-81642
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-81642
  • article
    https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81642.txt
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2535051
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-82717
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-82717