Red Hat Security Advisory

RHSA-2026:71487

unbound security update

Released 2026-09-24 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) python3-unbound-1.24.2-3.el9_8.8, unbound-1.24.2-3.el9_8.8, unbound-dracut-1.24.2-3.el9_8.8 +1
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) unbound-devel-1.24.2-3.el9_8.8

Fixes 3 records

TI-2026-56302 CVE-2026-81642 · GHSA-xxc4-rpp8-3fw7

Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY

MEDIUM 49

In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00962 Published 2026-09-16 Partial fix · 1.26.1 CWE-122

TI-2026-57038 CVE-2026-82717 · GHSA-r5xg-xh8m-9q2w

CNAME synthesis could lead to heap corruption

MEDIUM 40

In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution.

CVSS 4.0HIGH 8.4 Network No auth No interaction EPSS 0.00782 Published 2026-09-16 Partial fix · 1.26.1 CWE-122

TI-2026-56296 CVE-2026-81634 · GHSA-x9ff-rj4v-x6mq

Possible heap buffer overflow during DNSSEC canonicalization

LOW 39

In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0048 Published 2026-09-16 Partial fix · 1.26.1 CWE-122