Moderate Security Update for Unbound Packages: Addressing DNSBomb and Domain Hijacking Vulnerabilities
Summary
ALSA-2026:18931: Moderate: unbound security update. Affects python3-unbound versions < 1.24.2-2.el9. Fixed in 1.24.2-2.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Unbound is a validating, recursive, and caching DNS or DNSSEC resolver widely used for its reliability and performance. It provides essential services for domain name resolution, ensuring that users can access websites and services seamlessly. However, recent vulnerabilities have been identified that could compromise its security, specifically the DNSBomb vulnerability and potential domain hijacking through promiscuous records.
Vulnerability Detail
The vulnerabilities identified in Unbound include CVE-2024-33655, which relates to a DNSBomb attack that can overwhelm the resolver with malicious DNS queries, potentially leading to denial of service. Additionally, CVE-2025-11411 allows for domain hijacking via promiscuous records, where an attacker can manipulate DNS records to redirect traffic. These vulnerabilities pose significant risks to network integrity and user data security.
How To Fix
Minimum fixed version
1.24.2-2.el9
This is the first release that contains the fix.
sudo dnf update python3-unboundTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of their DNS resolver by implementing firewall rules to restrict access to trusted IP addresses only. This can help mitigate the risk of exploitation until the packages are updated.
Conclusion
The recent vulnerabilities in Unbound packages highlight the importance of maintaining up-to-date software to protect against potential security threats. By updating to the latest patched version, users can safeguard their systems from DNS-related attacks and ensure reliable domain name resolution.
See every vulnerability recorded for python3-unbound →
FAQ
The DNSBomb vulnerability (CVE-2024-33655) allows attackers to overwhelm the DNS resolver with excessive malicious queries, potentially causing service disruption.
Domain hijacking (CVE-2025-11411) can occur when attackers exploit promiscuous records to manipulate DNS responses, redirecting users to malicious sites.
Failing to update Unbound leaves systems vulnerable to attacks that can lead to service outages, data breaches, and compromised user privacy.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json, ensuring real-time awareness of security issues.
Related vulnerabilities
Recent vulnerabilities recorded for python3-unbound.
