Moderate Vulnerability in Unbound Packages: DNS Cache Poisoning via UDP Source Port Predictability
Summary
ALSA-2026:69120: Moderate: unbound security update. Affects python3-unbound versions < 1.16.2-5.14.el8_10.2. Fixed in 1.16.2-5.14.el8_10.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Unbound is a validating, recursive, and caching DNS or DNSSEC resolver widely used for its reliability and performance in DNS resolution tasks. It is designed to enhance security and efficiency in DNS queries, making it a critical component for many network infrastructures. However, it is susceptible to a vulnerability that could allow attackers to exploit DNS cache poisoning, potentially leading to malicious redirection of DNS queries.
Vulnerability Detail
The vulnerability identified as CVE-2026-50252 affects the Unbound package due to predictable UDP source port selection. This predictability can be exploited by attackers to perform DNS cache poisoning attacks, where they can inject false DNS responses into the cache. As a result, users may be redirected to malicious sites, leading to data breaches, phishing attacks, or other security incidents.
How To Fix
Minimum fixed version
1.16.2-5.14.el8_10.2
This is the first release that contains the fix.
sudo dnf update python3-unboundTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may consider disabling DNSSEC validation or using alternative DNS resolvers until the update can be applied. However, this is not a long-term solution and may expose your system to other vulnerabilities.
Conclusion
The unbound security update addresses a significant vulnerability that could lead to DNS cache poisoning attacks. It is crucial for users and administrators to update their systems to the patched version to safeguard against potential exploits. Regular monitoring and updates are essential to maintain security in network infrastructures.
See every vulnerability recorded for python3-unbound →
FAQ
CVE-2026-50252 is a vulnerability in the Unbound package that allows for DNS cache poisoning due to predictable UDP source port selection.
If exploited, this vulnerability can lead to users being redirected to malicious websites, resulting in potential data breaches or phishing attacks.
The affected packages include unbound, python3-unbound, unbound-devel, and unbound-libs in the AlmaLinux 8 ecosystem.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
Yes, a patch is available. You can update to version 1.16.2-5.14.el8_10.2 to mitigate the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for python3-unbound.
