RHSA-2026:68590
Vulnerability from csaf_redhat - Published: 2026-09-17 10:22 - Updated: 2026-09-22 20:01Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Critical
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
unbound:
* python3-unbound-1.26.1-1.hum1 (aarch64, x86_64)
* unbound-1.26.1-1.hum1 (aarch64, x86_64)
* unbound-anchor-1.26.1-1.hum1 (aarch64, x86_64)
* unbound-devel-1.26.1-1.hum1 (aarch64, x86_64)
* unbound-dracut-1.26.1-1.hum1 (aarch64, x86_64)
* unbound-libs-1.26.1-1.hum1 (aarch64, x86_64)
* unbound-munin-1.26.1-1.hum1 (noarch)
* unbound-utils-1.26.1-1.hum1 (aarch64, x86_64)
* unbound-1.26.1-1.hum1.src (src)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A vulnerability in Unbound's serve-expired code path allows a remote attacker to bypass pending-query limits using specially crafted DNS queries. By causing a security counter to double-decrement, the attacker can hold an arbitrary number of pending queries from a single source, resulting in a Denial of Service (DoS) condition.
CWE-675 - Multiple Operations on Resource in Single-Operation ContextAffected products
Fixed
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Low
A vulnerability in Unbound allows tampered DNS records in ZONEMD-configured zones (below a trust anchor) to be served or saved before integrity checks complete. Asynchronous DS/DNSKEY resolution creates a time window where unverified data is processed. If this compromised data is written to disk, it persists across server restarts and serves incorrect DNS information until re-verified.
4.4 (Medium)
Affected products
Fixed
17 products, the same list as for
CVE-2026-77860
Threats
Impact
Moderate
A flaw was found in Unbound. This vulnerability occurs in the DNS-over-QUIC (DoQ) stream output buffer when a client sends a RESET_STREAM, causing the output buffer to be freed while retransmission entries still point to it. A remote attacker, by querying Unbound over DoQ, withholding acknowledgments, and sending a RESET_STREAM, can trigger this flaw. This leads to retransmissions against freed memory, ultimately resulting in a denial of service due to an abnormal server exit.
5.9 (Medium)
Affected products
Fixed
17 products, the same list as for
CVE-2026-77860
Threats
Impact
Moderate
A flaw was found in Unbound. A malicious actor can exploit a vulnerability in the TCP/DoT reading procedure, which lacks a limit on consecutive reads. By continuously streaming distinct uncached names over a TCP/DoT connection, an attacker can monopolize a worker's event loop. This can lead to a degradation of service, effectively causing a Denial of Service (DoS) for legitimate users.
5.3 (Medium)
Affected products
Fixed
17 products, the same list as for
CVE-2026-77860
Threats
Impact
Moderate
A flaw was found in Unbound. This vulnerability allows a remote attacker to cause a heap buffer overflow during the processing of DNSSEC responses. By sending a specially crafted DNSSEC response, a malicious server or an attacker tampering with network traffic can trigger this flaw. This could lead to a denial of service, making the Unbound service unavailable.
7.5 (High)
Affected products
Fixed
17 products, the same list as for
CVE-2026-77860
Threats
Impact
Important
A flaw was found in Unbound's DNSSEC validator. A remote attacker can exploit this vulnerability by controlling a malicious zone and sending a specially crafted DNSKEY record. This can lead to a heap buffer overflow, potentially resulting in a denial of service or remote code execution.
9.8 (Critical)
Affected products
Fixed
17 products, the same list as for
CVE-2026-77860
Threats
Impact
Critical
A flaw was found in Unbound. Improper handling of buffer positions and compression pointers in Unbound's CNAME synthesis allows a remote attacker to corrupt heap memory via upstream DNS responses. This vulnerability can result in a denial of service (DoS) or, under specific conditions, remote code execution (RCE).
8.1 (High)
Affected products
Fixed
17 products, the same list as for
CVE-2026-77860
Threats
Impact
Important
A use-after-free vulnerability in Unbound's DNS-over-HTTPS (DoH) stream cleanup code allows a remote attacker to cause a denial of service (DoS). When DoH support is compiled, sending a specially crafted DoH connection under specific failure conditions—such as an RPZ drop query or heavy traffic—causes the Unbound process to terminate.
5.9 (Medium)
Affected products
Fixed
17 products, the same list as for
CVE-2026-77860
Threats
Impact
Moderate
A flaw was found in Unbound. This vulnerability, termed 'ReTrap', allows a remote attacker to launch algorithmic complexity attacks on the Domain Name System Security Extensions (DNSSEC) validation process. By serving malicious zones or responses, an attacker can exploit various mechanisms, such as mismatched DNSKEY records, deeply nested domains, or excessive invalid NSEC records. Successful exploitation leads to a degradation of service, effectively causing a Denial of Service (DoS) for affected Unbound resolvers.
5.3 (Medium)
Affected products
Fixed
17 products, the same list as for
CVE-2026-77860
Threats
Impact
Moderate
References
58 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\nunbound:\n * python3-unbound-1.26.1-1.hum1 (aarch64, x86_64)\n * unbound-1.26.1-1.hum1 (aarch64, x86_64)\n * unbound-anchor-1.26.1-1.hum1 (aarch64, x86_64)\n * unbound-devel-1.26.1-1.hum1 (aarch64, x86_64)\n * unbound-dracut-1.26.1-1.hum1 (aarch64, x86_64)\n * unbound-libs-1.26.1-1.hum1 (aarch64, x86_64)\n * unbound-munin-1.26.1-1.hum1 (noarch)\n * unbound-utils-1.26.1-1.hum1 (aarch64, x86_64)\n * unbound-1.26.1-1.hum1.src (src)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:68590",
"url": "https://access.redhat.com/errata/RHSA-2026:68590"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-81642",
"url": "https://access.redhat.com/security/cve/CVE-2026-81642"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-82720",
"url": "https://access.redhat.com/security/cve/CVE-2026-82720"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-81634",
"url": "https://access.redhat.com/security/cve/CVE-2026-81634"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-80225",
"url": "https://access.redhat.com/security/cve/CVE-2026-80225"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-77860",
"url": "https://access.redhat.com/security/cve/CVE-2026-77860"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-77955",
"url": "https://access.redhat.com/security/cve/CVE-2026-77955"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-85501",
"url": "https://access.redhat.com/security/cve/CVE-2026-85501"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-82717",
"url": "https://access.redhat.com/security/cve/CVE-2026-82717"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-78227",
"url": "https://access.redhat.com/security/cve/CVE-2026-78227"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68590.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
"tracking": {
"current_release_date": "2026-09-22T20:01:14+00:00",
"generator": {
"date": "2026-09-22T20:01:14+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.0"
}
},
"id": "RHSA-2026:68590",
"initial_release_date": "2026-09-17T10:22:12+00:00",
"revision_history": [
{
"date": "2026-09-17T10:22:12+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-17T18:02:10+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-22T20:01:14+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "python3-unbound-0:1.26.1-1.hum1@aarch64",
"product": {
"name": "python3-unbound-0:1.26.1-1.hum1@aarch64",
"product_id": "python3-unbound-0:1.26.1-1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-unbound@1.26.1-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "unbound-0:1.26.1-1.hum1@aarch64",
"product": {
"name": "unbound-0:1.26.1-1.hum1@aarch64",
"product_id": "unbound-0:1.26.1-1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unbound@1.26.1-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "unbound-anchor-0:1.26.1-1.hum1@aarch64",
"product": {
"name": "unbound-anchor-0:1.26.1-1.hum1@aarch64",
"product_id": "unbound-anchor-0:1.26.1-1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unbound-anchor@1.26.1-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "unbound-devel-0:1.26.1-1.hum1@aarch64",
"product": {
"name": "unbound-devel-0:1.26.1-1.hum1@aarch64",
"product_id": "unbound-devel-0:1.26.1-1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unbound-devel@1.26.1-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "unbound-dracut-0:1.26.1-1.hum1@aarch64",
"product": {
"name": "unbound-dracut-0:1.26.1-1.hum1@aarch64",
"product_id": "unbound-dracut-0:1.26.1-1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unbound-dracut@1.26.1-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "unbound-libs-0:1.26.1-1.hum1@aarch64",
"product": {
"name": "unbound-libs-0:1.26.1-1.hum1@aarch64",
"product_id": "unbound-libs-0:1.26.1-1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unbound-libs@1.26.1-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "unbound-utils-0:1.26.1-1.hum1@aarch64",
"product": {
"name": "unbound-utils-0:1.26.1-1.hum1@aarch64",
"product_id": "unbound-utils-0:1.26.1-1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unbound-utils@1.26.1-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "python3-unbound-0:1.26.1-1.hum1@x86_64",
"product": {
"name": "python3-unbound-0:1.26.1-1.hum1@x86_64",
"product_id": "python3-unbound-0:1.26.1-1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-unbound@1.26.1-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "unbound-0:1.26.1-1.hum1@x86_64",
"product": {
"name": "unbound-0:1.26.1-1.hum1@x86_64",
"product_id": "unbound-0:1.26.1-1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unbound@1.26.1-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "unbound-anchor-0:1.26.1-1.hum1@x86_64",
"product": {
"name": "unbound-anchor-0:1.26.1-1.hum1@x86_64",
"product_id": "unbound-anchor-0:1.26.1-1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unbound-anchor@1.26.1-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "unbound-devel-0:1.26.1-1.hum1@x86_64",
"product": {
"name": "unbound-devel-0:1.26.1-1.hum1@x86_64",
"product_id": "unbound-devel-0:1.26.1-1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unbound-devel@1.26.1-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "unbound-dracut-0:1.26.1-1.hum1@x86_64",
"product": {
"name": "unbound-dracut-0:1.26.1-1.hum1@x86_64",
"product_id": "unbound-dracut-0:1.26.1-1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unbound-dracut@1.26.1-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "unbound-libs-0:1.26.1-1.hum1@x86_64",
"product": {
"name": "unbound-libs-0:1.26.1-1.hum1@x86_64",
"product_id": "unbound-libs-0:1.26.1-1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unbound-libs@1.26.1-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "unbound-utils-0:1.26.1-1.hum1@x86_64",
"product": {
"name": "unbound-utils-0:1.26.1-1.hum1@x86_64",
"product_id": "unbound-utils-0:1.26.1-1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unbound-utils@1.26.1-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "unbound-0:1.26.1-1.hum1@src",
"product": {
"name": "unbound-0:1.26.1-1.hum1@src",
"product_id": "unbound-0:1.26.1-1.hum1@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unbound@1.26.1-1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"product": {
"name": "unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"product_id": "unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unbound-munin@1.26.1-1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"product": {
"name": "unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"product_id": "unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unbound-munin@1.26.1-1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-unbound-0:1.26.1-1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64"
},
"product_reference": "python3-unbound-0:1.26.1-1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-unbound-0:1.26.1-1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64"
},
"product_reference": "python3-unbound-0:1.26.1-1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unbound-0:1.26.1-1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64"
},
"product_reference": "unbound-0:1.26.1-1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unbound-0:1.26.1-1.hum1@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src"
},
"product_reference": "unbound-0:1.26.1-1.hum1@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unbound-0:1.26.1-1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64"
},
"product_reference": "unbound-0:1.26.1-1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unbound-anchor-0:1.26.1-1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64"
},
"product_reference": "unbound-anchor-0:1.26.1-1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unbound-anchor-0:1.26.1-1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64"
},
"product_reference": "unbound-anchor-0:1.26.1-1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unbound-devel-0:1.26.1-1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64"
},
"product_reference": "unbound-devel-0:1.26.1-1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unbound-devel-0:1.26.1-1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64"
},
"product_reference": "unbound-devel-0:1.26.1-1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unbound-dracut-0:1.26.1-1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64"
},
"product_reference": "unbound-dracut-0:1.26.1-1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unbound-dracut-0:1.26.1-1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64"
},
"product_reference": "unbound-dracut-0:1.26.1-1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unbound-libs-0:1.26.1-1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64"
},
"product_reference": "unbound-libs-0:1.26.1-1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unbound-libs-0:1.26.1-1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64"
},
"product_reference": "unbound-libs-0:1.26.1-1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms"
},
"product_reference": "unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms"
},
"product_reference": "unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unbound-utils-0:1.26.1-1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64"
},
"product_reference": "unbound-utils-0:1.26.1-1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unbound-utils-0:1.26.1-1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
},
"product_reference": "unbound-utils-0:1.26.1-1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-77860",
"cwe": {
"id": "CWE-675",
"name": "Multiple Operations on Resource in Single-Operation Context"
},
"discovery_date": "2026-09-16T08:52:01.975259+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535050"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability in Unbound\u0027s serve-expired code path allows a remote attacker to bypass pending-query limits using specially crafted DNS queries. By causing a security counter to double-decrement, the attacker can hold an arbitrary number of pending queries from a single source, resulting in a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "unbound: Unbound: Denial of Service via \u0027serve-expired\u0027 code path bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw in Unbound allows a remote attacker controlling an authoritative DNS zone to bypass query rate-limiting safeguards and exhaust server capacity via specially crafted queries. The impact is assessed as Low because exploitation is restricted to non-default environments where the serve-expired directive is explicitly enabled, and successfully triggering the issue requires complex preconditions and precise query timing rather than enabling direct, unconstrained service disruption.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-77860"
},
{
"category": "external",
"summary": "RHBZ#2535050",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535050"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-77860",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-77860"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-77860",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77860"
},
{
"category": "external",
"summary": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-77860.txt",
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-77860.txt"
}
],
"release_date": "2026-09-16T08:29:23.501000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T10:22:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68590"
},
{
"category": "workaround",
"details": "To mitigate this issue, disable the \u0027serve-expired\u0027 option in the Unbound configuration. This can be achieved by setting \u0027serve-expired: no\u0027 in the \u0027unbound.conf\u0027 file. A restart of the Unbound service is required for the changes to take effect. Disabling this feature may impact the availability of stale DNS records.",
"product_ids": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "unbound: Unbound: Denial of Service via \u0027serve-expired\u0027 code path bypass"
},
{
"cve": "CVE-2026-77955",
"cwe": {
"id": "CWE-345",
"name": "Insufficient Verification of Data Authenticity"
},
"discovery_date": "2026-09-16T08:52:53.526442+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535053"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability in Unbound allows tampered DNS records in ZONEMD-configured zones (below a trust anchor) to be served or saved before integrity checks complete. Asynchronous DS/DNSKEY resolution creates a time window where unverified data is processed. If this compromised data is written to disk, it persists across server restarts and serves incorrect DNS information until re-verified.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "unbound: Unbound: ZONEMD verification bypass due to asynchronous DNSSEC resolution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate: Unbound is susceptible to a ZONEMD verification bypass when configured with ZONEMD-enabled zones positioned below a trust anchor. This creates a window where tampered zone data can be served or written to disk before DNSSEC integrity checks complete, potentially leading to DNS spoofing or cache poisoning.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-77955"
},
{
"category": "external",
"summary": "RHBZ#2535053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535053"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-77955",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-77955"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-77955",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77955"
},
{
"category": "external",
"summary": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-77955.txt",
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-77955.txt"
}
],
"release_date": "2026-09-16T08:29:39.955000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T10:22:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68590"
},
{
"category": "workaround",
"details": "To mitigate this issue, avoid configuring Unbound with `zonemd-check: yes` for zones located below a trust anchor, especially when the `zonefile` option is also enabled. If ZONEMD is required, ensure that zones are not configured in a way that allows for this asynchronous resolution vulnerability. Disabling the `zonemd-check` option or removing the `zonefile` option for affected zones can prevent the attack window. A restart of the Unbound service is required for configuration changes to take effect.",
"product_ids": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "unbound: Unbound: ZONEMD verification bypass due to asynchronous DNSSEC resolution"
},
{
"cve": "CVE-2026-78227",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2026-09-16T08:52:26.506865+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535052"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Unbound. This vulnerability occurs in the DNS-over-QUIC (DoQ) stream output buffer when a client sends a RESET_STREAM, causing the output buffer to be freed while retransmission entries still point to it. A remote attacker, by querying Unbound over DoQ, withholding acknowledgments, and sending a RESET_STREAM, can trigger this flaw. This leads to retransmissions against freed memory, ultimately resulting in a denial of service due to an abnormal server exit.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "unbound: Unbound: Denial of Service via use-after-free in DoQ stream output buffer",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate impact use-after-free vulnerability in Unbound affects configurations compiled with DNS-over-QUIC (DoQ) support. Most Red Hat Enterprise Linux products are not impacted as their Unbound packages do not include the vulnerable DoQ functionality. This only affects Red Hat hardened images.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-78227"
},
{
"category": "external",
"summary": "RHBZ#2535052",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535052"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-78227",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-78227"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-78227",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78227"
},
{
"category": "external",
"summary": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-78227.txt",
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-78227.txt"
}
],
"release_date": "2026-09-16T08:29:52.342000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T10:22:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68590"
},
{
"category": "workaround",
"details": "To mitigate this do not set quic-port unless DNS-over-QUIC is required. If it is enabled, allow it only from trusted clients.",
"product_ids": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "unbound: Unbound: Denial of Service via use-after-free in DoQ stream output buffer"
},
{
"cve": "CVE-2026-80225",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-09-16T08:53:46.737468+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535055"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Unbound. A malicious actor can exploit a vulnerability in the TCP/DoT reading procedure, which lacks a limit on consecutive reads. By continuously streaming distinct uncached names over a TCP/DoT connection, an attacker can monopolize a worker\u0027s event loop. This can lead to a degradation of service, effectively causing a Denial of Service (DoS) for legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "unbound: Unbound: Denial of Service via continuous queries on TCP/DoT connection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate severity flaw in Unbound allows a remote attacker to cause a denial of service by continuously sending distinct, uncached DNS queries over a TCP or DNS-over-TLS (DoT) connection. This can monopolize a single worker\u0027s event loop, leading to service degradation for legitimate users. The impact is limited to availability and requires sustained malicious traffic.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-80225"
},
{
"category": "external",
"summary": "RHBZ#2535055",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535055"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-80225",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80225"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-80225",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80225"
},
{
"category": "external",
"summary": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-80225.txt",
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-80225.txt"
}
],
"release_date": "2026-09-16T08:30:04.246000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T10:22:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68590"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using `firewall-cmd --permanent --add-rich-rule=\u0027rule family=\"ipv4\" source address=\"\u003cTRUSTED_NETWORK\u003e\" port port=\"53\" protocol=\"tcp\" accept\u0027` and `firewall-cmd --permanent --add-rich-rule=\u0027rule family=\"ipv4\" source address=\"\u003cTRUSTED_NETWORK\u003e\" port port=\"853\" protocol=\"tcp\" accept\u0027`. After adding rules, apply them with `firewall-cmd --reload`. Replace `\u003cTRUSTED_NETWORK\u003e` with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections.",
"product_ids": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "unbound: Unbound: Denial of Service via continuous queries on TCP/DoT connection"
},
{
"cve": "CVE-2026-81634",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-09-16T08:53:19.884865+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535054"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Unbound. This vulnerability allows a remote attacker to cause a heap buffer overflow during the processing of DNSSEC responses. By sending a specially crafted DNSSEC response, a malicious server or an attacker tampering with network traffic can trigger this flaw. This could lead to a denial of service, making the Unbound service unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "unbound: Unbound: Heap buffer overflow via malicious DNSSEC response",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw where Unbound, when acting as a recursive DNS resolver, is vulnerable to a heap buffer overflow. A remote attacker could exploit this by operating a malicious name server or by intercepting and manipulating DNS responses, potentially leading to a denial of service or arbitrary code execution. This risk is heightened in deployments where Unbound processes queries from untrusted sources.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-81634"
},
{
"category": "external",
"summary": "RHBZ#2535054",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535054"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-81634",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-81634"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-81634",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81634"
},
{
"category": "external",
"summary": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81634.txt",
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81634.txt"
}
],
"release_date": "2026-09-16T08:30:15.428000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T10:22:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68590"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "unbound: Unbound: Heap buffer overflow via malicious DNSSEC response"
},
{
"cve": "CVE-2026-81642",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-09-16T08:55:11.330689+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535059"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Unbound\u0027s DNSSEC validator. A remote attacker can exploit this vulnerability by controlling a malicious zone and sending a specially crafted DNSKEY record. This can lead to a heap buffer overflow, potentially resulting in a denial of service or remote code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "unbound: Unbound: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-81642"
},
{
"category": "external",
"summary": "RHBZ#2535059",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535059"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-81642",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-81642"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-81642",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81642"
},
{
"category": "external",
"summary": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81642.txt",
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81642.txt"
}
],
"release_date": "2026-09-16T08:30:58.604000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T10:22:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68590"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "unbound: Unbound: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY"
},
{
"cve": "CVE-2026-82717",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-09-16T08:51:07.266602+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535051"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Unbound. Improper handling of buffer positions and compression pointers in Unbound\u0027s CNAME synthesis allows a remote attacker to corrupt heap memory via upstream DNS responses. This vulnerability can result in a denial of service (DoS) or, under specific conditions, remote code execution (RCE).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "unbound: Unbound: Remote Code Execution Vulnerability in CNAME Synthesis",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Unbound that could lead to remote code execution due to heap memory corruption during CNAME synthesis. As Unbound is a critical DNS resolver component in Red Hat environments, successful exploitation could severely impact service availability and integrity. The complexity of exploiting heap memory corruption may limit immediate widespread attacks.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-82717"
},
{
"category": "external",
"summary": "RHBZ#2535051",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535051"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-82717",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-82717"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-82717",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82717"
},
{
"category": "external",
"summary": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-82717.txt",
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-82717.txt"
}
],
"release_date": "2026-09-16T08:31:59.417000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T10:22:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68590"
},
{
"category": "workaround",
"details": "To mitigate this restrict Unbound to trusted clients and limit which upstream name servers it can query. If Unbound is unused, disable or remove the service. Apply process/cgroup limits to contain crash impact.",
"product_ids": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "unbound: Unbound: Remote Code Execution Vulnerability in CNAME Synthesis"
},
{
"cve": "CVE-2026-82720",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2026-09-16T08:55:38.842470+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535060"
}
],
"notes": [
{
"category": "description",
"text": "A use-after-free vulnerability in Unbound\u0027s DNS-over-HTTPS (DoH) stream cleanup code allows a remote attacker to cause a denial of service (DoS). When DoH support is compiled, sending a specially crafted DoH connection under specific failure conditions\u2014such as an RPZ drop query or heavy traffic\u2014causes the Unbound process to terminate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "unbound: Unbound: Denial of Service via use-after-free in DoH stream cleanup",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate impact use-after-free vulnerability in Unbound, when configured with DNS-over-HTTPS (DoH) support, can lead to a denial of service. The flaw occurs during specific failure conditions like RPZ drops or heavy traffic, causing the Unbound process to terminate. While direct user control over reads is limited, the vulnerability can still disrupt service in affected Red Hat products where Unbound is compiled with DoH support.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-82720"
},
{
"category": "external",
"summary": "RHBZ#2535060",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535060"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-82720",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-82720"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-82720",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82720"
},
{
"category": "external",
"summary": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-82720.txt",
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-82720.txt"
}
],
"release_date": "2026-09-16T08:32:10.359000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T10:22:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68590"
},
{
"category": "workaround",
"details": "To mitigate this issue, disable DNS-over-HTTPS (DoH) support in Unbound if it is not required. This can typically be achieved by commenting out or removing the `do-https:` configuration block in the `unbound.conf` file and restarting the Unbound service. Disabling DoH may affect clients relying on this protocol for DNS resolution. A service restart is required for the changes to take effect.",
"product_ids": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "unbound: Unbound: Denial of Service via use-after-free in DoH stream cleanup"
},
{
"cve": "CVE-2026-85501",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-16T08:54:15.428838+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535057"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Unbound. This vulnerability, termed \u0027ReTrap\u0027, allows a remote attacker to launch algorithmic complexity attacks on the Domain Name System Security Extensions (DNSSEC) validation process. By serving malicious zones or responses, an attacker can exploit various mechanisms, such as mismatched DNSKEY records, deeply nested domains, or excessive invalid NSEC records. Successful exploitation leads to a degradation of service, effectively causing a Denial of Service (DoS) for affected Unbound resolvers.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "unbound: Unbound: Denial of Service via algorithmic complexity attacks on DNSSEC",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate flaw in Unbound can lead to a denial of service due to algorithmic complexity attacks on DNSSEC. An attacker can exploit this by serving malicious DNS zones, causing Unbound to consume excessive resources during DNSSEC validation, thereby degrading service availability. This affects Red Hat products utilizing Unbound for DNSSEC resolution, where the default configuration validates the additional section of DNS responses.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-85501"
},
{
"category": "external",
"summary": "RHBZ#2535057",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535057"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-85501",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-85501"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-85501",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85501"
},
{
"category": "external",
"summary": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-85501.txt",
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-85501.txt"
}
],
"release_date": "2026-09-16T08:32:25.398000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-17T10:22:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68590"
},
{
"category": "workaround",
"details": "To mitigate implement hard caps on iterative processing loops and resource allocations per request. Apply rate limiting and set strict connection/processing timeouts to prevent a single complex operation from tying up worker threads. For this specific flaw, administrators can also configure system-level resource constraints (like CPU cgroups) for the service.",
"product_ids": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src",
"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64",
"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "unbound: Unbound: Denial of Service via algorithmic complexity attacks on DNSSEC"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…