Critical Security Update for Unbound DNS Resolver: Denial of Service Vulnerabilities
Summary
ALSA-2026:36320: Important: unbound security update. Affects python3-unbound versions < 1.24.2-7.el10_2.2. Fixed in 1.24.2-7.el10_2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Unbound is a validating, recursive, and caching DNS or DNSSEC resolver widely used for its reliability and performance. It is designed to enhance DNS security and efficiency, making it a critical component in many network infrastructures. However, recent vulnerabilities have been identified that could potentially compromise its functionality and security.
Vulnerability Detail
The vulnerabilities in Unbound include a Denial of Service (DoS) attack via excessive EDNS options, cache manipulation through 'ghost domain names', and resource exhaustion due to large DNS Resource Record Sets. These vulnerabilities can lead to service interruptions, degraded performance, and potential exploitation by malicious actors, making it crucial for users to address them promptly.
How To Fix
Minimum fixed version
1.24.2-7.el10_2.2
This is the first release that contains the fix.
sudo dnf update python3-unboundTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the number of EDNS options processed by configuring the Unbound settings to ignore excessive options. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
The identified vulnerabilities in Unbound pose significant risks to network security and performance. It is imperative for users to update their packages to the latest patched version to mitigate these risks effectively. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python3-unbound →
FAQ
Unbound is a DNS resolver that provides validation, recursion, and caching to enhance DNS security and performance.
The vulnerabilities can lead to Denial of Service attacks, service interruptions, and potential exploitation by attackers.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider implementing temporary workarounds such as limiting EDNS options until a proper update can be applied.
For more details, refer to the CVE pages listed in the related section of the vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for python3-unbound.
