RHSA-2026:97121MediumCVSS 6.5

Red Hat Security Advisory: unbound security, bug fix, and enhancement update

Published
November 10, 2026
Last Modified
November 12, 2026

🔗 CVE IDs covered (14)

CVE-2026-44608 →CVE-2026-46582 →CVE-2026-50046 →CVE-2026-52863 →CVE-2026-55717 →CVE-2026-56444 →CVE-2026-42923 →CVE-2026-42960 →CVE-2026-44687 →CVE-2026-50045 →CVE-2026-50243 →CVE-2026-50248 →CVE-2026-55708 →CVE-2026-56416 →

📋 Description

CVE-2026-42923 — unbound: Unbound DNSSEC Validator NSEC3 Hash Calculation Limit Bypass via Negative Cache Code Path Leading to DoS CVE-2026-42960 — unbound: Unbound DNS Cache Poisoning via Promiscuous Additional Section RRSet Acceptance CVE-2026-44608 — unbound: Unbound: Denial of Service due to locking inconsistency during RPZ XFR reload CVE-2026-44687 — unbound: Unbound: Denial of Service due to 'harden-below-nxdomain' logic bypass CVE-2026-46582 — unbound: Unbound: Information disclosure via DNSSEC wildcard replay CVE-2026-50045 — unbound: Unbound: Denial of Service via DNSSEC query amplification bypass CVE-2026-50046 — unbound: Unbound: Denial of Service due to freed pointer dereference in DNS-over-TLS handling CVE-2026-50243 — unbound: Unbound: Insecure DNS redirection via spoofed DNS answers CVE-2026-50248 — unbound: Unbound: DNS response policy replacement via hostname spoofing CVE-2026-52863 — unbound: Unbound: Denial of service due to memory corruption under specific configurations. CVE-2026-55708 — unbound: Unbound: Information disclosure due to local policy bypass via unbound-control CVE-2026-55717 — unbound: Unbound: Denial of Service via crafted DNS responses with expired records CVE-2026-56416 — unbound: Unbound: Heap buffer overflow via malformed DNSSEC record CVE-2026-56444 — unbound: Unbound: Denial of Service due to incorrect client reply accounting with specific serve-expired configuration

🎯 Affected products104

  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux BaseOS (v. 10)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • python3-unbound-0:1.26.1-2.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3-unbound-0:1.26.1-2.el10_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3-unbound-0:1.26.1-2.el10_3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3-unbound-0:1.26.1-2.el10_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3-unbound-debuginfo-0:1.26.1-2.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3-unbound-debuginfo-0:1.26.1-2.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • python3-unbound-debuginfo-0:1.26.1-2.el10_3.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • python3-unbound-debuginfo-0:1.26.1-2.el10_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3-unbound-debuginfo-0:1.26.1-2.el10_3.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • python3-unbound-debuginfo-0:1.26.1-2.el10_3.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • python3-unbound-debuginfo-0:1.26.1-2.el10_3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3-unbound-debuginfo-0:1.26.1-2.el10_3.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • python3-unbound-debuginfo-0:1.26.1-2.el10_3.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • python3-unbound-debuginfo-0:1.26.1-2.el10_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3-unbound-debuginfo-0:1.26.1-2.el10_3.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • python3-unbound-debuginfo-0:1.26.1-2.el10_3.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • unbound-0:1.26.1-2.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • unbound-0:1.26.1-2.el10_3.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • unbound-0:1.26.1-2.el10_3.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • unbound-0:1.26.1-2.el10_3.src as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • unbound-0:1.26.1-2.el10_3.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • unbound-anchor-0:1.26.1-2.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • unbound-anchor-0:1.26.1-2.el10_3.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • unbound-anchor-0:1.26.1-2.el10_3.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • unbound-anchor-0:1.26.1-2.el10_3.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • unbound-anchor-debuginfo-0:1.26.1-2.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • unbound-anchor-debuginfo-0:1.26.1-2.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • +74 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, avoid using `rpz-nsip` or `rpz-nsdname` triggers within Response Policy Zones (RPZ) that are configured for zone transfer (XFR) reloads. Alternatively, configure Unbound to use local RPZ files instead of XFR for these zones, as local RPZ files do not trigger the vulnerability. A restart of the Unbound service may be required for configuration changes to take effect, which could temporarily interrupt DNS resolution. Workaround: Disable the harden-below-nxdomain option in the Unbound configuration to prevent the logic bypass that leads to the denial of service. Note that disabling this option may reduce the overall DNSSEC hardening provided by Unbound. Edit /etc/unbound/unbound.conf and set the following in the server: section: harden-below-nxdomain: no Restart the Unbound service for the changes to take effect: systemctl restart unbound Warning: Restarting the Unbound service will temporarily interrupt local DNS resolution. Workaround: To mitigate this issue, disable the serve-expired feature by setting serve-expired: no in the Unbound configuration if it is not strictly required. This entirely removes the vulnerable code path where the cache poisoning occurs. Workaround: Restrict recursive DNS access strictly to trusted networks using firewall access controls, reloading the service to apply changes. Additionally, configure Rate Limiting on outbound traffic to throttle anomalous spikes and mitigate amplification risks. Workaround: To mitigate this issue, avoid configuring Unbound with a `#authname` suffix in DNS-over-TLS (DoT) forwarding or stub zones if not strictly required. If the `#authname` suffix is necessary, restrict network access to the Unbound instance to trusted clients only. This may involve configuring firewall rules to limit inbound connections to the DoT port (typically 853) from known, secure sources. After modifying Unbound's configuration, the service must be reloaded or restarted for the changes to take effect. This action may temporarily interrupt DNS resolution services. Workaround: If IP-based rewriting is unused, leave module-config configured as "validator iterator" and do not configure response-ip redirects or RPZ-IP triggers. If these features are required, ensure validator is placed before respip in module-config and restrict upstream peer access to reduce exposure to spoofed DNS answers. Workaround: Configure Response Policy Zones (RPZ) and secondary zone primary endpoints using explicit IP addresses rather than hostnames to prevent A/AAAA spoofing or resolution flaws. Additionally, restrict network access for zone transfers to trusted sources and reload or restart the unbound service for configuration changes to take effect. Workaround: To mitigate this issue, avoid configuring Unbound with a combination of 'respip' or 'rpz' modules, subquery attachment features (such as respip CNAME redirection, dns64, or subnetcache), and 'access-control-view' if these functionalities are not strictly required. Disabling these specific configurations will prevent the conditions under which memory corruption can occur. Any changes to Unbound's configuration will require a service restart to take effect, which may temporarily interrupt DNS resolution services. Workaround: Do not run unbound-control view_local_data / view_local_datas on named views that started with no local-data; put local-data (or the RFC 1918 / AS112 / .onion / .localhost local-zones) in unbound.conf so the tree is built at startup with the defaults. If views or remote control are unused, leave control-enable: no and keep the control socket admin-only. Block Unbound from sending those names to the public Internet. Workaround: Ensure serve-expired remains disabled (default), or set serve-expired-client-timeout: 0 to bypass the vulnerable callback path. If serving expired answers is necessary, remove any response-ip CNAME redirect rules and RPZ rpz-cname-override entries. Additionally, use access-control to restrict query access, preventing untrusted clients from triggering the flaw via attacker-controlled names. Workaround: To mitigate this issue, consider disabling DNSSEC validation in Unbound if it is not strictly required for your environment. This can be achieved by ensuring `module-config: "iterator"` is used in `unbound.conf` and that no `trust-anchor` or `auto-trust-anchor-file` directives are present. Disabling DNSSEC validation will reduce the security assurances provided by DNSSEC. Alternatively, configure Unbound to only perform DNSSEC validation for trusted zones. A restart of the Unbound service is required for changes to take effect. Workaround: To mitigate this issue, ensure that Unbound is configured with `serve-expired-client-timeout` not greater than `discard-timeout` when `serve-expired: yes` is enabled. Alternatively, disable the `serve-expired` feature if it is not required. Red Hat's default configurations for Unbound prevent this vulnerability from being exploited.

🔗 References (8)