Red Hat Security Advisory

RHSA-2026:20357

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-05-23 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Hardened Images python3-unbound-1.25.1-1.hum1@aarch64, python3-unbound-1.25.1-1.hum1@x86_64, unbound-1.25.1-1.hum1@aarch64 +14

Fixes 4 records

TI-2026-31123 CVE-2026-42923 · GHSA-8f6w-8h24-fw66

Degradation of service with unbounded NSEC3 hash calculations

LOW 36

NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code path to consult the negative cache for DS records does not take into account the limit on NSEC3 hash calcul…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00339 Published 2026-05-20 Partial fix · 1.25.1 CWE-407

TI-2026-29354 CVE-2026-40622 · GHSA-m3vq-fgh9-hq65

Another 'ghost domain names' attack variant

LOW 34

NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00142 Published 2026-05-20 Partial fix · 1.25.1 CWE-346

TI-2026-25270 CVE-2026-32792 · GHSA-8v34-57vr-p4cp

Packet of death with DNSCrypt

LOW 27

NLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service vulnerability when compiled with DNSCrypt support ('--enable-dnscrypt').

CVSS 4.0MEDIUM 4.6 Network No auth No interaction EPSS 0.00337 Published 2026-05-20 Partial fix · 1.25.1 CWE-125

TI-2026-31147 CVE-2026-42960 · GHSA-x7f7-rggg-4jvv

Possible cache poisoning via promiscuous records for the authority section

LOW 25

NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section.

CVSS 4.0MEDIUM 5.7 Adjacent network No auth No interaction EPSS 0.00262 Published 2026-05-20 Partial fix · 1.25.1 CWE-349