Critical Cache Poisoning Vulnerability in Unbound and Related Packages
Summary
ALSA-2026:55784: Important: unbound security update. Affects python3-unbound versions < 1.16.2-5.14.el8_10. Fixed in 1.16.2-5.14.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Unbound is a validating, recursive, and caching DNS or DNSSEC resolver widely used for its reliability and performance in DNS resolution. It is designed to enhance security and efficiency in DNS queries by validating responses and caching them for faster access. However, it has been found to be vulnerable to a cache poisoning attack due to insufficient validation of RRSIG labels, which can lead to malicious exploitation.
Vulnerability Detail
The vulnerability, identified as CVE-2026-44690, arises from insufficient validation of RRSIG labels and premature cache writes in Unbound. This flaw allows attackers to poison the DNS cache, potentially redirecting users to malicious sites or intercepting sensitive information. The implications of this vulnerability are severe, as it compromises the integrity of DNS responses, leading to possible data breaches and loss of user trust.
How To Fix
Minimum fixed version
1.16.2-5.14.el8_10
This is the first release that contains the fix.
sudo dnf update python3-unboundTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may consider disabling caching in Unbound until the update can be applied. This can be done by modifying the configuration file (usually located at /etc/unbound/unbound.conf) and setting 'cache-max-ttl: 0'. However, this is not a long-term solution and should be followed by an update as soon as possible.
Conclusion
The cache poisoning vulnerability in Unbound poses significant risks to DNS integrity and user security. It is crucial to update the affected packages to the patched version to mitigate these risks. Users should also consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for python3-unbound →
FAQ
CVE-2026-44690 is a vulnerability in Unbound that allows for cache poisoning due to insufficient validation of RRSIG labels.
If exploited, this vulnerability can lead to malicious redirection of DNS queries, potentially compromising sensitive data and user privacy.
The affected packages include python3-unbound, unbound, unbound-devel, and unbound-libs in AlmaLinux 8.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground.
If immediate updates cannot be applied, consider disabling caching in Unbound as a temporary workaround until the update can be performed.
Related vulnerabilities
Recent vulnerabilities recorded for python3-unbound.
