Critical Security Update for Unbound and Related Packages: Heap Overflow and Denial of Service Vulnerabilities
Summary
ALSA-2026:24365: Important: unbound security update. Affects python3-unbound versions < 1.16.2-5.11.el8_10. Fixed in 1.16.2-5.11.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Unbound is a validating, recursive, and caching DNS or DNSSEC resolver widely used for its reliability and performance in handling DNS queries. It is designed to enhance security and efficiency in DNS resolution, making it a critical component in many network infrastructures. However, recent vulnerabilities have been identified that could compromise its functionality and security.
Vulnerability Detail
The vulnerabilities identified in Unbound include a heap overflow that can lead to a crash when multiple nsid, cookie, and padding EDNS options are used (CVE-2026-42944). Additionally, there is a Denial of Service vulnerability in the Unbound DNSSEC Validator caused by an incorrect write offset counter in chase-reply messages (CVE-2026-42959). These vulnerabilities can be exploited by attackers to disrupt DNS services, potentially leading to service outages and security breaches.
How To Fix
Minimum fixed version
1.16.2-5.11.el8_10
This is the first release that contains the fix.
sudo dnf update python3-unboundTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds have been provided for these vulnerabilities. It is recommended to apply the security updates as soon as they are available.
Conclusion
In summary, the recent vulnerabilities in Unbound pose significant risks to DNS services, necessitating immediate action to update affected packages. By following the provided steps to update to the patched version, users can safeguard their systems against potential exploits.
See every vulnerability recorded for python3-unbound →
FAQ
The heap overflow vulnerability can lead to a crash of the Unbound service, disrupting DNS resolution and potentially affecting all dependent services.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By utilizing a manifest file like package-lock.json, you can check for vulnerabilities in real-time.
The vulnerabilities are associated with CVE-2026-42944 for the heap overflow issue and CVE-2026-42959 for the Denial of Service vulnerability.
While no specific workarounds are available, it is advisable to limit exposure to the affected services and monitor network traffic for unusual activity.
For more details, refer to the CVE pages associated with the vulnerabilities or the advisory from AlmaLinux.
Related vulnerabilities
Recent vulnerabilities recorded for python3-unbound.
