The Red Hat security advisory RHSA-2026:19752 updates multiple Unbound RPM packages in Red Hat Hardened Images to address several vulnerabilities, including CVE-2026-42959. This vulnerability arises from the use of an incorrect counter to calculate write offsets in DNSSEC chase-reply messages, which creates uninitialized array slots that are later dereferenced, causing immediate process crashes. This flaw can be triggered remotely via a crafted DNS query without authentication, leading to denial-of-service by crashing the Unbound resolver process. The advisory notes the severity as Important and highlights the lack of effective mitigations besides applying the update. The update includes version 1.25.1-0.1.hum1 of Unbound packages for aarch64 and x86_64 architectures. No CVSS score is provided by Red Hat, but the impact is significant due to potential service disruption.

Successful exploitation of the vulnerability causes the Unbound DNS resolver process to crash, resulting in denial-of-service for any application or infrastructure relying on Unbound for DNS resolution. This disruption can affect all dependent services. The vulnerability can be triggered remotely without authentication or user interaction. There is no indication of confidentiality or integrity impact beyond potential memory reads or code execution if the uninitialized pointer is misused, but the primary impact is availability loss due to process crashes. No known exploits are reported in the wild.

Red Hat provides updated RPM packages (unbound-1.25.1-0.1.hum1 and related) to fix the vulnerabilities. Applying these updates is the recommended remediation. Currently, no effective mitigations or workarounds meet Red Hat's criteria for ease of use, applicability, or stability. Users should follow Red Hat's update instructions at https://images.redhat.com/ to apply the fixes. Monitoring or other mitigations are not indicated as effective for this issue.