Critical Remote Code Execution and Buffer Overflow Vulnerabilities in Unbound DNS Resolver
Summary
ALSA-2026:70754: Critical: unbound security update. Affects python3-unbound versions < 1.16.2-5.14.el8_10.4. Fixed in 1.16.2-5.14.el8_10.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Unbound is a validating, recursive, and caching DNS resolver that is widely used for its reliability and performance. It supports DNSSEC, allowing for secure DNS queries. However, recent vulnerabilities have been identified that could lead to severe security risks, including remote code execution and buffer overflows, potentially compromising systems that rely on this package.
Vulnerability Detail
The vulnerabilities in Unbound stem from improper handling of DNS responses, particularly in CNAME synthesis and DNSSEC responses. Specifically, CVE-2026-82717 allows for remote code execution through CNAME synthesis, while CVE-2026-81634 and CVE-2026-81642 expose systems to heap buffer overflows, which can lead to arbitrary code execution. These vulnerabilities can be exploited by attackers to gain unauthorized access to systems, manipulate DNS queries, and disrupt services.
How To Fix
Minimum fixed version
1.16.2-5.14.el8_10.4
This is the first release that contains the fix.
sudo dnf update python3-unboundTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider disabling DNSSEC validation or limiting the exposure of your DNS resolver to untrusted networks until the update can be applied. However, this may compromise the security of DNS queries.
Conclusion
The identified vulnerabilities in Unbound pose significant risks to systems relying on this DNS resolver. It is crucial to update to the latest patched version to mitigate these risks effectively. Regular monitoring and proactive security measures are essential to safeguard against potential exploits.
See every vulnerability recorded for python3-unbound →
FAQ
Unbound is a DNS resolver that provides validation, recursion, and caching for DNS queries, enhancing the security and performance of DNS lookups.
The vulnerabilities can lead to remote code execution, allowing attackers to execute arbitrary code on affected systems, potentially leading to data breaches or service disruptions.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
While the best course of action is to update to the patched version, you can temporarily disable DNSSEC validation or restrict access to the DNS resolver.
If immediate updating is not possible, ensure that your systems are monitored for suspicious activity and consider implementing additional security measures to protect your network.
Related vulnerabilities
Recent vulnerabilities recorded for python3-unbound.
