Red Hat Security Advisory

RHSA-2026:37282

unbound security update

Released 2026-07-09 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 8) python3-unbound-1.16.2-5.12.el8_10, unbound-1.16.2-5.12.el8_10, unbound-devel-1.16.2-5.12.el8_10 +1

Fixes 4 records

TI-2026-32341 CVE-2026-44390 · GHSA-6522-r5fq-99gw

Unbounded name compression in certain cases causes degradation of service

LOW 37

NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets that Unbound needs to perform name compression for.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00648 Published 2026-05-20 Partial fix · 1.25.1 CWE-407

TI-2026-30814 CVE-2026-42534 · GHSA-xfcv-gp55-3wpf

Jostle logic bypass degrades resolution performance

LOW 37

NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could defeat its purpose and degrade resolution performance.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00604 Published 2026-05-20 Partial fix · 1.25.1 CWE-440

TI-2026-29895 CVE-2026-41292 · GHSA-2wvj-gvc7-gfhx

Long list of incoming EDNS options degrades performance

LOW 37

NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00748 Published 2026-05-20 Partial fix · 1.25.1 CWE-407

TI-2026-29354 CVE-2026-40622 · GHSA-m3vq-fgh9-hq65

Another 'ghost domain names' attack variant

LOW 34

NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00142 Published 2026-05-20 Partial fix · 1.25.1 CWE-346