Skip to content
OpenAdvisories
Medium RHSA-2026:97121 18 CVEs

Red Hat Security Advisory: unbound security, bug fix, and enhancement update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 13

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.3 python3-unbound 0:1.26.1-2.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 python3-unbound-debuginfo 0:1.26.1-2.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 unbound 0:1.26.1-2.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 unbound-anchor 0:1.26.1-2.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 unbound-anchor-debuginfo 0:1.26.1-2.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 unbound-debuginfo 0:1.26.1-2.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 unbound-debugsource 0:1.26.1-2.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 unbound-devel 0:1.26.1-2.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 unbound-dracut 0:1.26.1-2.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 unbound-libs 0:1.26.1-2.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 unbound-libs-debuginfo 0:1.26.1-2.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 unbound-utils 0:1.26.1-2.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 unbound-utils-debuginfo 0:1.26.1-2.el10_3

Vulnerabilities 18

  • Medium 6.9
    CVE-2026-42923

    Degradation of service with unbounded NSEC3 hash calculations

    NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code path to consult the negative cache for DS records does not take into account the limit on NSEC3 hash calculations introduced in 1.19.1. This leads…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • Medium 6.5
    CVE-2026-50248

    BOGUS configured primary hostname accepted for XFR in auth/rpz zones

    In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname's A/AAAA record (no…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • Medium 6.3
    CVE-2026-50243

    'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL

    In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the 'respip' module in front of the validator together with a 'response-ip' redirect rule or an RPZ file with an RPZ-IP trigger, the rewriting handler does not check the s…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • Medium 5.9
    CVE-2026-44621

    Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abruptly terminated

    With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and libunbound needs to call 'libworker_alloc_cleanup…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • Medium 5.9
    CVE-2026-50046

    Possible heap use-after-free in an error path when a DoT forwarded query is jostled out

    In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS (DoT) forwarded queries is tied to a struct's ('serviced_query') lifetime but also referenced by another struct ('waiting_tcp'). When the owning struct is jostl…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • Medium 5.9
    CVE-2026-52863

    Memory corruption could lead to crash and denial of service

    In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of the view name in effect that could lead to memory corruption if the owner of the original view name is jostled …

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • Medium 5.9
    CVE-2026-55717

    'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash

    In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: <net> redirect' /'response-ip-data: <net> CNAME <target>' rule (or the RPZ 'rpz-cname-override' equivalent), a remote client who controls a…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • Medium 5.9
    CVE-2026-56444

    Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration

    In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with 'serve-expired: yes' and 'serve-expired-client-timeout > discard-timeout > 0' (contrary to the suggested values), the discard-timeout branch during the serve expired logi…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • Medium 5.7
    CVE-2026-42960

    Possible cache poisoning via promiscuous records for the authority section

    NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. Promiscuous RRSets that complement DNS replies in the authority section can be used to trick Unbound to cache such records. If …

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • Medium 5.3
    CVE-2026-50045

    'max-global-quota' reset by DNSSEC validation restarts

    In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a single client query for a deeply nested name under a DNSSEC-signed parent can cause Unbound to send more upstream packets per client query than the configured 'max-global-quota'. This effectively bypa…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • Medium 5.3
    CVE-2026-50251

    Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush

    In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled (set to any value greater than zero), glue records of 0.0.0.0/::0 can short-circuit Unbound, on systems that can direct such traffic, by issuing DNS queries a…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • Medium 4.8
    CVE-2026-56416

    Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name

    In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain name as 'datstart + dname_valid(datstart, ...)' and …

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • Medium 4.6
    CVE-2026-44608

    Use after free and crash under special conditions in RPZ code

    NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met (multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers) it could result in heap use-after-fre…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • Low 3.7
    CVE-2026-42955

    Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records

    In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • Low 3.7
    CVE-2026-44687

    Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN

    In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed zone could be shadowed by the intermediate label's secure NXDOMAIN answer from the parent. This is caused by an …

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • Low 3.7
    CVE-2026-46582

    A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path

    In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache, before later validation treats it as bogus based…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • Low 3.7
    CVE-2026-54478

    DNS Cookie bypass when combined with proxy-protocol use

    In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the RFC 9018 server-cookie SipHash is computed over the proxy's wire address instead of the PROXYv2-declared client. …

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine
  • Low 3.1
    CVE-2026-55708

    Privacy/configuration issue when adding local data in views through 'unbound-control'

    In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'view_local_data' and 'view_local_datas' commands of 'unbound-control' create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux Alpine

References

  • article
    https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/10.3_release_notes/index
  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2479821
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2479825
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2480126
  • article
    https://issues.redhat.com/browse/RHEL-246536
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_97121.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-42923
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-42923
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-42923
  • report
    https://access.redhat.com/security/cve/CVE-2026-42955
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2506144
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-42955
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-42955
  • article
    https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42955.txt
  • report
    https://access.redhat.com/security/cve/CVE-2026-42960
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-42960
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-42960
  • report
    https://access.redhat.com/security/cve/CVE-2026-44608
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-44608
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-44608
  • article
    https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-44608.txt
  • report
    https://access.redhat.com/security/cve/CVE-2026-44621
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2506149
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-44621
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-44621
  • article
    https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-44621.txt
  • report
    https://access.redhat.com/security/cve/CVE-2026-44687
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2506130
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-44687
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-44687
  • article
    https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-44687.txt
  • report
    https://access.redhat.com/security/cve/CVE-2026-46582
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2506139
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-46582
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-46582
  • article
    https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-46582.txt
  • report
    https://access.redhat.com/security/cve/CVE-2026-50045
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2506136