Moderate Vulnerability in Unbound Packages: DNS Cache Poisoning Risk
Summary
ALSA-2026:68292: Moderate: unbound security update. Affects python3-unbound versions < 1.24.2-3.el9_8.6. Fixed in 1.24.2-3.el9_8.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Unbound is a validating, recursive, and caching DNS resolver that is widely used for its reliability and performance in managing DNS queries. It supports DNSSEC, enhancing security by ensuring the authenticity of DNS responses. However, a recent vulnerability has been identified that could potentially allow attackers to exploit the DNS cache through UDP source port predictability, posing a risk to systems relying on this package.
Vulnerability Detail
The vulnerability identified as CVE-2026-50252 relates to DNS cache poisoning due to predictable UDP source ports in Unbound. This flaw allows attackers to manipulate DNS responses, leading to possible redirection of users to malicious sites or interception of sensitive data. The issue arises from the way Unbound handles UDP packets, making it susceptible to crafted requests that can exploit the predictable nature of source ports.
How To Fix
Minimum fixed version
1.24.2-3.el9_8.6
This is the first release that contains the fix.
sudo dnf update python3-unboundTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can mitigate the risk by implementing firewall rules to limit access to the DNS resolver or by using a different DNS resolver that does not exhibit this vulnerability until the update can be applied.
Conclusion
In summary, the vulnerability CVE-2026-50252 in Unbound packages poses a significant risk due to DNS cache poisoning via UDP source port predictability. It is crucial to update to the patched version to safeguard against potential exploitation. For those unable to update immediately, implementing temporary workarounds can help mitigate risks.
See every vulnerability recorded for python3-unbound →
FAQ
CVE-2026-50252 is a vulnerability in Unbound that allows DNS cache poisoning due to predictable UDP source ports.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability can lead to users being redirected to malicious sites, potentially compromising sensitive information.
Yes, a patch is available in version 1.24.2-3.el9_8.6 of the affected packages.
If immediate updating is not possible, consider implementing firewall rules to restrict access to the DNS resolver as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for python3-unbound.
