Critical Security Update for Unbound and Related Packages: Heap Overflow and Denial of Service Vulnerabilities
Summary
ALSA-2026:24369: Important: unbound security update. Affects python3-unbound versions < 1.24.2-3.el9_8.1. Fixed in 1.24.2-3.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Unbound is a validating, recursive, and caching DNS or DNSSEC resolver widely used for its reliability and performance. It provides essential DNS services, ensuring secure and efficient domain name resolution. However, recent vulnerabilities have been identified that could compromise its functionality and security, affecting systems relying on this package.
Vulnerability Detail
The vulnerabilities in Unbound stem from multiple issues, including a heap overflow that can lead to crashes when handling multiple nsid, cookie, and padding EDNS options. Additionally, there is a Denial of Service (DoS) vulnerability caused by an incorrect write offset counter in chase-reply messages, and a use-after-free vulnerability that may allow remote code execution due to deep copy pointer overwrites. These vulnerabilities can severely impact the stability and security of systems using Unbound.
How To Fix
Minimum fixed version
1.24.2-3.el9_8.1
This is the first release that contains the fix.
sudo dnf update python3-unboundTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can disable the affected features in Unbound's configuration to mitigate the risk until the update is applied. However, this is not a permanent solution and should be followed by an update as soon as possible.
Conclusion
In summary, the recent vulnerabilities in Unbound pose significant risks to systems relying on this DNS resolver. It is imperative to update to the latest patched version to mitigate these vulnerabilities and ensure the security and stability of your applications.
See every vulnerability recorded for python3-unbound →
FAQ
Unbound is a DNS resolver that provides validating, recursive, and caching services, ensuring secure and efficient domain name resolution.
The main vulnerabilities include a heap overflow, Denial of Service via incorrect write offset counter, and a use-after-free vulnerability leading to potential remote code execution.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
If immediate updating is not possible, consider disabling the affected features in Unbound's configuration as a temporary workaround.
Updating to the patched version is crucial to protect your systems from potential exploits that could lead to crashes or unauthorized access.
Related vulnerabilities
Recent vulnerabilities recorded for python3-unbound.
