Moderate Security Vulnerability in Unbound Packages: DNSBomb and Domain Hijacking Risks
Summary
ALSA-2026:18556: Moderate: unbound security update. Affects python3-unbound versions < 1.24.2-7.el10. Fixed in 1.24.2-7.el10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Unbound is a validating, recursive, and caching DNS or DNSSEC resolver widely used for its reliability and performance. It is designed to enhance the security and efficiency of DNS queries, making it a critical component in many network infrastructures. However, recent vulnerabilities have been identified that could compromise its integrity, specifically the DNSBomb vulnerability and domain hijacking via promiscuous records.
Vulnerability Detail
The vulnerabilities identified in Unbound include the DNSBomb vulnerability (CVE-2024-33655) and the potential for domain hijacking through promiscuous records (CVE-2025-11411). The DNSBomb vulnerability allows attackers to exploit the DNS resolver, potentially leading to denial of service or other malicious activities. The domain hijacking issue arises when untrusted records are accepted, allowing attackers to redirect traffic or impersonate legitimate domains. These vulnerabilities pose significant risks to network security and data integrity.
How To Fix
Minimum fixed version
1.24.2-7.el10
This is the first release that contains the fix.
sudo dnf update python3-unboundTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict the DNS resolver's access to trusted domains only, minimizing exposure to potential attacks. However, this is not a permanent solution and updating the software is strongly recommended.
Conclusion
The recent vulnerabilities in Unbound packages highlight significant security risks that could impact network integrity and data security. It is crucial for users to update their packages to the latest patched version to mitigate these risks effectively. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities in open-source software.
See every vulnerability recorded for python3-unbound →
FAQ
The DNSBomb vulnerability allows attackers to exploit the DNS resolver, potentially leading to denial of service or other malicious activities.
Domain hijacking can occur when untrusted records are accepted by Unbound, allowing attackers to redirect traffic or impersonate legitimate domains.
If you are using an affected version of Unbound, you should update to the patched version 1.24.2-7.el10 as soon as possible.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without requiring any signup.
Related vulnerabilities
Recent vulnerabilities recorded for python3-unbound.
