This Red Hat security advisory (RHSA-2026:43588) covers a bug fix and enhancement update for Red Hat Hardened Images RPMs, including multiple Unbound packages (version 1.25.2-0.1.hum1). Among the addressed issues is CVE-2026-40691, a denial of service vulnerability in Unbound when configured with DNSCrypt support. A remote attacker can send a crafted DNSCrypt query over TCP to trigger a heap overflow, causing a server crash and disrupting DNS resolution. Red Hat states that their supported Unbound builds do not include DNSCrypt support, so this vulnerability does not impact those versions. The advisory lists numerous other CVEs addressed by this update but does not explicitly confirm patch availability for all. The update RPMs are available for aarch64 and x86_64 architectures. Red Hat recommends applying the update as detailed on their images portal. No known exploits in the wild have been reported.

The primary impact is denial of service caused by a remote attacker sending crafted DNSCrypt queries to Unbound servers built with DNSCrypt support, leading to a server crash and disruption of DNS services. This could prevent legitimate users from resolving DNS queries. However, Red Hat's supported Unbound versions are not compiled with DNSCrypt support, so they are not affected by this specific vulnerability. Other listed CVEs may have varying impacts, but details are not provided in this advisory. No known active exploitation has been reported.

Red Hat has released updated RPM packages for Unbound and related components as part of the Red Hat Hardened Images update. Users should apply these updates following Red Hat's official guidance at https://images.redhat.com/. Since Red Hat's supported Unbound versions do not include DNSCrypt support, the specific denial of service vulnerability (CVE-2026-40691) does not affect them. No additional mitigations are specified in the advisory. Patch status for all CVEs is not explicitly confirmed; users should monitor Red Hat advisories for updates.