Critical Security Update for Unbound Package: Heap Overflow and Denial of Service Vulnerabilities
Summary
ALSA-2026:23231: Important: unbound security update. Affects python3-unbound versions < 1.24.2-7.el10_2.1. Fixed in 1.24.2-7.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Unbound is a validating, recursive, and caching DNS or DNSSEC resolver widely used for its reliability and performance in handling DNS queries. It provides enhanced security features, including DNSSEC validation, which ensures the authenticity of DNS responses. However, recent vulnerabilities have been identified that could compromise its functionality and security.
Vulnerability Detail
The vulnerabilities in Unbound include a heap overflow that can lead to crashes when multiple nsid, cookie, and padding EDNS options are processed (CVE-2026-42944). Additionally, there is a Denial of Service (DoS) risk due to an incorrect write offset counter in chase-reply messages (CVE-2026-42959). Furthermore, a use-after-free vulnerability can occur due to deep copy pointer overwrite, potentially leading to DoS and remote code execution (CVE-2026-33278). These vulnerabilities stem from improper handling of DNSSEC validation processes, which can be exploited by attackers to disrupt service or execute arbitrary code.
How To Fix
Minimum fixed version
1.24.2-7.el10_2.1
This is the first release that contains the fix.
sudo dnf update python3-unboundTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable DNSSEC validation in Unbound's configuration file to mitigate the risk until the update is applied. This can be done by setting 'dnssec: no' in the unbound.conf file. However, this is not recommended as a long-term solution.
Conclusion
The recent vulnerabilities identified in the Unbound package pose serious risks to DNS services, including potential crashes and remote code execution. It is crucial for users to update to the patched version promptly and consider temporary workarounds if immediate updates are not feasible. Monitoring tools like Vulert can assist in identifying affected applications.
See every vulnerability recorded for python3-unbound →
FAQ
The vulnerabilities can lead to service disruptions, crashes, and potential remote code execution, compromising the integrity and availability of DNS services.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
Continuing to use Unbound without applying the update poses significant security risks, including potential exploitation of the vulnerabilities by attackers.
If an immediate update is not possible, consider disabling DNSSEC validation as a temporary workaround, but plan to update as soon as possible.
For more details, refer to the CVE pages listed in the references section of the vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for python3-unbound.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.