Critical Security Update for Unbound Package: Addressing Cache Poisoning Vulnerability
Summary
ALSA-2025:11849: Important: unbound security update. Affects python3-unbound versions < 1.16.2-19.el9_6.1. Fixed in 1.16.2-19.el9_6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Unbound package is a validating, recursive, and caching DNS or DNSSEC resolver widely used for its efficiency and reliability in handling DNS queries. It is designed to provide secure and fast DNS resolution, making it a critical component in many network infrastructures. However, it has been identified to have a vulnerability that could allow cache poisoning, potentially leading to malicious redirection of DNS queries.
Vulnerability Detail
The vulnerability identified as CVE-2025-5994 allows for cache poisoning in the Unbound package. This issue arises from improper handling of DNS responses, which can be exploited by attackers to insert malicious entries into the DNS cache. The ramifications of this vulnerability are severe, as it could lead to users being redirected to malicious websites, compromising sensitive information and undermining the integrity of DNS services.
How To Fix
Minimum fixed version
1.16.2-19.el9_6.1
This is the first release that contains the fix.
sudo dnf update python3-unboundTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable DNSSEC validation in Unbound until the package is updated. This can be done by modifying the configuration file (usually located at /etc/unbound/unbound.conf) and setting 'dnssec: no'. However, this is not recommended as it compromises the security of DNS queries.
Conclusion
The Unbound package has a critical vulnerability that requires immediate attention. By updating to the patched version, users can protect their systems from potential cache poisoning attacks. It is crucial to stay informed about such vulnerabilities and take proactive measures to secure your applications.
See every vulnerability recorded for python3-unbound →
FAQ
The impact includes potential redirection of users to malicious sites, leading to data theft and compromised network security.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without any signup.
Consider disabling DNSSEC validation as a temporary workaround, but be aware that this reduces security.
Yes, you can set up a cron job to regularly check for and apply updates to your packages.
Detailed information can be found on the CVE page for CVE-2025-5994 and the advisory from AlmaLinux.
Related vulnerabilities
Recent vulnerabilities recorded for python3-unbound.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
