Critical Security Vulnerability in Unbound Packages: CVE-2026-81642
Summary
RHSA-2026:72264: Red Hat Security Advisory: unbound security update. Affects python3-unbound versions < 0:1.16.2-5.el8_8.6. Fixed in 0:1.16.2-5.el8_8.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Unbound is a validating, recursive, and caching DNS resolver that is widely used for its performance and security features. It is designed to provide secure DNS resolution by supporting DNSSEC and has a modular architecture that allows for easy integration with various systems. The vulnerability in question affects multiple packages associated with Unbound, including python3-unbound, unbound-libs, and their respective debuginfo and development packages, making it crucial for users to address this issue promptly.
Vulnerability Detail
The vulnerability identified as CVE-2026-81642 allows for potential denial of service attacks and data corruption due to improper handling of DNS queries. This flaw can be exploited by an attacker to manipulate DNS responses, leading to significant security risks such as data leakage or service interruption. The vulnerability has a CVSS score of 9.8, indicating its critical nature and the urgent need for remediation.
How To Fix
Minimum fixed version
0:1.16.2-5.el8_8.6
This is the first release that contains the fix.
sudo dnf update python3-unboundTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable DNSSEC validation or limit the exposure of their DNS resolver to untrusted networks. However, this is not a recommended long-term solution as it may compromise the security of DNS queries.
Conclusion
The vulnerability CVE-2026-81642 poses a significant risk to users of Unbound packages, necessitating immediate action to update affected software. By following the provided steps to update and considering temporary workarounds, users can mitigate potential threats and enhance their system's security.
See every vulnerability recorded for python3-unbound →
FAQ
CVE-2026-81642 is a critical security vulnerability affecting Unbound packages that can lead to denial of service and data corruption.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
If you cannot update the package immediately, consider implementing temporary workarounds such as disabling DNSSEC validation or restricting network access.
More information can be found in the Red Hat Security Advisory at https://security.access.redhat.com/data/osv/RHSA-2026:72264.json.
Related vulnerabilities
Recent vulnerabilities recorded for python3-unbound.
