Critical Security Flaw in Unbound Packages: Cache Poisoning and Denial of Service Vulnerabilities
Summary
ALSA-2026:55892: Important: unbound security update. Affects python3-unbound versions < 1.24.2-7.el10_2.4. Fixed in 1.24.2-7.el10_2.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Unbound is a validating, recursive, and caching DNS or DNSSEC resolver widely used for its reliability and performance. It provides essential DNS services, ensuring that domain name resolutions are accurate and secure. However, recent vulnerabilities have been identified that could compromise its integrity and availability, making it crucial for users to stay informed and updated.
Vulnerability Detail
The vulnerabilities identified in the Unbound packages include a cache poisoning issue due to insufficient RRSIG.Labels validation (CVE-2026-44690) and a Denial of Service (DoS) risk stemming from malformed EDNS Report-Channel options (CVE-2026-55973). These vulnerabilities could allow attackers to manipulate DNS responses or disrupt service, leading to potential data breaches or service outages.
How To Fix
Minimum fixed version
1.24.2-7.el10_2.4
This is the first release that contains the fix.
sudo dnf update python3-unboundTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of their DNS resolver by implementing firewall rules to restrict access to trusted IP addresses only. This can help mitigate the risk of exploitation until the packages are updated.
Conclusion
The identified vulnerabilities in Unbound packages pose significant risks to DNS integrity and service availability. It is essential for users to update their packages to the latest patched version to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for python3-unbound →
FAQ
The main vulnerabilities include cache poisoning due to insufficient validation and Denial of Service from malformed EDNS options.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
These vulnerabilities can lead to data manipulation, service disruption, and potential data breaches, affecting the integrity and availability of DNS services.
Yes, a patch is available in version 1.24.2-7.el10_2.4 of the Unbound packages.
If immediate updates are not possible, consider implementing firewall rules to restrict access to your DNS resolver as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for python3-unbound.
