Red Hat Security Advisory

RHSA-2026:68291

unbound security update

Released 2026-09-16 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 10) python3-unbound-1.24.2-7.el10_2.5, unbound-1.24.2-7.el10_2.5, unbound-anchor-1.24.2-7.el10_2.5 +3
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) unbound-devel-1.24.2-7.el10_2.5

Fixes 1 record

TI-2026-36997 CVE-2026-50252 · GHSA-jfgc-mgqq-r573

Possible cache poisoning attack by mapping source port population per thread

LOW 25

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions.

CVSS 4.0MEDIUM 5.7 Adjacent network No auth No interaction EPSS 0.00172 Published 2026-07-22 Partial fix · 1.25.2 CWE-349