Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

This update for unbound fixes the following issues: Update to version 1.25.2. Security issues fixed: - CVE-2026-14586: DoS via assertion in `libngtcp2` for DNS-over-QUIC environments with high concurrency (bsc#1271879). - CVE-2026-32665: Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass (bsc#1271873). - CVE-2026-40691: DoS due to heap overflow via single bad DNSCrypt query over TCP (bsc#1271875). - CVE-2026-41637: Degradation of resolution service due to improperly accounted client-terminated DNS-over-QUIC queries (bsc#1271891). - CVE-2026-42955: Ghost domain window can be extended by up to one cached TTL configured value for A/AAAA glue records (bsc#1271892). - CVE-2026-44621: Libunbound applications configured with `unwanted-reply-threshold` could eventually be abruptly terminated (bsc#1271876). - CVE-2026-44687: Off-by-one error in `harden-below-nxdomain` logic can shadow a stub/forward zone by a legitimate parent's `NXDOMAIN` (bsc#1271893). - CVE-2026-44690: Cross-zone wildcard cache poisoning via `RRSIG.labels` manipulation (bsc#1271877). - CVE-2026-46582: Replay of a wildcard `rrset` as another piece of data triggers poisoning in the server expired reply path (bsc#1271894). - CVE-2026-50045: `max-global-quota` bypass via single client queries for a deeply nested name under a DNSSEC-signed parent (bsc#1271878). - CVE-2026-50046: Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (bsc#1271882). - CVE-2026-50243: `response-ip`/`rpz` can rewrite BOGUS answers instead of returning SERVFAIL (bsc#1271880). - CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in auth/rpz zones (bsc#1271881). - CVE-2026-50251: Attacker supplied `0.0.0.0`/`::` glue triggers defensive full-cache flush (bsc#1271883). - CVE-2026-50252: Possible cache poisoning attack by mapping source port population per thread (bsc#1271884). - CVE-2026-54478: DNS Cookie bypass when proxy-protocol with with `answer-cookie:yes` is used (bsc#1271895). - CVE-2026-55708: Privacy/configuration issue when adding local data in views through `unbound-control` (bsc#1271896). - CVE-2026-55717: `serve-expired-client-timeout` and `response-ip` CNAME redirect could lead to a crash (bsc#1271886). - CVE-2026-55973: DoS due to stack overflow triggered crash when `dns-error-reporting: yes` is set (bsc#1271874). - CVE-2026-55990: Crash via crafted client UDP query due to DNSCrypt faulty configuration (bsc#1271887). - CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control reacheable assertion failure in `libngtcp2` (bsc#1271888). - CVE-2026-56416: Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name (bsc#1271889). - CVE-2026-56444: Degradation of resolution service when `discard-timeout` and `serve-expired-client-timeout` are combined in unusual configuration (bsc#1271890). Other updates and bugfixes: - Version 1.25.2: + Features: * TTL behavior changes: cached records reaching TTL 0 are expired; TTL 0 upstream answers are no longer cached by cachedb; serve-expired-reply-ttl is now capped by the original TTL value; TTL decoding updated to adhere to RFC 8767 section 4 * Add new statistics: num.queries.replyaddr_limit and requestlist.current.replies * Add 'log-thread-id' configuration option to log the system-wide Linux thread ID for easier debugging * Add ECC-GOST12 support per RFC 9558 (available as contrib/gost12.patch) * Allow synthesized DNAME TTL=0 to be served from cache within a 1-second grace period, reducing recursion for TTL=0 DNAMEs (RFC 2308) * Fix DoT/DoH/DoQ to reload certificates on config reload without requiring a full restart; fast_reload now supports changes to tls-service-key, tls-service-pem and tls-cert-bundle * Allow ip@port notation in control-interface configuration * Add iter-scrub-rrsig option (default: 8) to limit the number of RRSIGs processed by the scrubber * Add 'tls-protocols' configuration option to select which TLS protocol versions are used; TLSv1.2 is re-enabled by default * Add pthread_setname_np support for named threads + Bug Fixes: * Fix handle leak in pythonmod on pythonmod_init * Fix crash when mesh_detect_cycle_found() is called with no mesh state * Fix modstack_call_init to use the original string when it has changed * Fix fr_atomic_copy_cfg * Fix auth-zone empty label for $ORIGIN when downloading via HTTP * Fix respip and dns64 to be usable simultaneously; RPZ now works with DNS64 * Fix HTTPS and QUIC not being enabled when port is listed in interface-automatic-ports * Allow wait-limit-cookie: 0 to disable cookie-validated wait limits * Fix FIPS mode in OpenSSL causing unit test failure * Fix discard-timeout to only drop UDP, not stream connections * Reply with SERVFAIL when the wait-limit is exceeded * A

• CWE-617Reachable Assertion (opens in a new tab)

  Base weakness

  The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

  How to prevent and test

  1. Implementation

     Make sensitive open/close operation non reachable by directly user-controlled data (e.g. open/close resources)

  2. Implementation · Input Validation

     Perform input validation on user data.

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-125Out-of-bounds Read (opens in a new tab)

  Base weaknessCWE Top 25 (2025): #8

  The product reads data past the end, or before the beginning, of the intended buffer.

  How to prevent and test

  1. Implementation · Input Validation

     Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

  2. Architecture and Design · Language Selection

     Use a language that provides appropriate memory abstractions.

  OWASP Cheat Sheets

  • XML Security (opens in a new tab)
  • Mass Assignment (opens in a new tab)

  OWASP ASVS 4.0.3

  • V13.3.1 (opens in a new tab)
  • V5.1.4 (opens in a new tab)
  • V5.1.3 (opens in a new tab)

  Attack patterns

  • Overread Buffers (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-770Allocation of Resources Without Limits or Throttling (opens in a new tab)

  Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #25

  The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

  How to prevent and test

  1. Requirements

     Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.

  2. Architecture and Design

     Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

  3. Architecture and Design

     Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended.

  OWASP Cheat Sheets

  • Abuse Case (opens in a new tab)

  OWASP ASVS 4.0.3

  • V8.1.4 (opens in a new tab)
  • V13.4.1 (opens in a new tab)
  • V11.1.4 (opens in a new tab)

  Attack patterns

  • XML Ping of the Death (opens in a new tab)
  • Exponential Data Expansion (opens in a new tab)
  • Serialized Data Parameter Blowup (opens in a new tab)
  • Serialized Data with Nested Payloads (opens in a new tab)
  • Oversized Serialized Data Payloads (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-911Improper Update of Reference Count (opens in a new tab)

  Base weaknessLikelihood of exploit: Medium

  The product uses a reference count to manage a resource, but it does not update or incorrectly updates the reference count.

• CWE-354Improper Validation of Integrity Check Value (opens in a new tab)

  Base weaknessLikelihood of exploit: Medium

  The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.

  How to prevent and test

  1. Implementation

     Ensure that the checksums present in messages are properly checked in accordance with the protocol specification before they are parsed and used.

  OWASP Cheat Sheets

  • XML Security (opens in a new tab)
  • REST Security (opens in a new tab)
  • JSON Web Token for Java (opens in a new tab)

  OWASP ASVS 4.0.3

  • V11.1.7 (opens in a new tab)
  • V13.3.2 (opens in a new tab)
  • V3.5.3 (opens in a new tab)

  Attack patterns

  • Checksum Spoofing (opens in a new tab)
  • Padding Oracle Crypto Attack (opens in a new tab)
  • Manipulating Writeable Configuration Files (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-358Improperly Implemented Security Check for Standard (opens in a new tab)

  Base weakness

  The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.

• CWE-416Use After Free (opens in a new tab)

  Variant weaknessLikelihood of exploit: HighCWE Top 25 (2025): #7

  The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

  How to prevent and test

  1. Architecture and Design · Language Selection

     Choose a language that provides automatic memory management.

  2. Implementation · Attack Surface Reduction

     When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

  OWASP Cheat Sheets

  • XML Security (opens in a new tab)
  • Mass Assignment (opens in a new tab)

  OWASP ASVS 4.0.3

  • V13.3.1 (opens in a new tab)
  • V5.1.4 (opens in a new tab)
  • V5.1.3 (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-835Loop with Unreachable Exit Condition ('Infinite Loop') (opens in a new tab)

  Base weakness

  The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

• CWE-1098Data Element containing Pointer Item without Proper Copy Control Element (opens in a new tab)

  Base weakness

  The code contains a data element with a pointer that does not have an associated copy or constructor method.

• CWE-303Incorrect Implementation of Authentication Algorithm (opens in a new tab)

  Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)

  The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.

  How to prevent and test

  OWASP Cheat Sheets

  • OWASP Authentication (opens in a new tab)

  OWASP ASVS 4.0.3

  • V2.8.5 (opens in a new tab)
  • V2.8.4 (opens in a new tab)
  • V9.2.3 (opens in a new tab)

  Attack patterns

  • Reflection Attack in Authentication Protocol (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-805Buffer Access with Incorrect Length Value (opens in a new tab)

  Base weaknessLikelihood of exploit: High

  The product uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer.

  How to prevent and test

  1. Requirements · Language Selection

     Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

  2. Architecture and Design · Libraries or Frameworks

     Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

  3. Operation · Build and Compilation · Environment Hardening

     Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index…

  OWASP Cheat Sheets

  • XML Security (opens in a new tab)
  • Mass Assignment (opens in a new tab)

  OWASP ASVS 4.0.3

  • V13.3.1 (opens in a new tab)
  • V5.1.4 (opens in a new tab)
  • V5.1.3 (opens in a new tab)

  Attack patterns

  • Overflow Buffers (opens in a new tab)
  • SOAP Array Overflow (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-190Integer Overflow or Wraparound (opens in a new tab)

  Base weaknessLikelihood of exploit: Medium

  The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

  How to prevent and test

  1. Requirements

     Ensure that all protocols are strictly defined, such that all out-of-bounds behavior can be identified simply, and require strict conformance to the protocol.

  2. Requirements · Language Selection

     Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

  3. Architecture and Design · Libraries or Frameworks

     Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

  OWASP Cheat Sheets

  • XML Security (opens in a new tab)
  • Mass Assignment (opens in a new tab)

  OWASP ASVS 4.0.3

  • V5.4.3 (opens in a new tab)
  • V13.3.1 (opens in a new tab)
  • V5.1.4 (opens in a new tab)

  Attack patterns

  • Forced Integer Overflow (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-772Missing Release of Resource after Effective Lifetime (opens in a new tab)

  Base weaknessLikelihood of exploit: High

  The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

  How to prevent and test

  1. Requirements · Language Selection

     Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

  2. Implementation

     It is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free resources in a function. If you allocate resources that you intend to free upon completion of the function, you must be sure to free the resources at all exit points for that function including…

  3. Operation · Architecture and Design · Resource Limitation

     Use resource-limiting settings provided by the operating system or environment. For example, when managing system resources in POSIX, setrlimit() can be used to set limits for certain types of resources, and getrlimit() can determine how many resources are available.

  Attack patterns

  • HTTP DoS (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-406Insufficient Control of Network Message Volume (Network Amplification) (opens in a new tab)

  Class weakness

  The product does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the product to transmit more traffic than should be allowed for that actor.

  How to prevent and test

  1. Architecture and Design · Separation of Privilege

     An application must make network resources available to a client commensurate with the client's access level.

  2. Policy

     Define a clear policy for network resource allocation and consumption.

  3. Implementation

     An application must, at all times, keep track of network resources and meter their usage appropriately.

  OWASP Cheat Sheets

  • File Upload (opens in a new tab)

  OWASP ASVS 4.0.3

  • V12.1.1 (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-193Off-by-one Error (opens in a new tab)

  Base weakness

  A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

  How to prevent and test

  1. Implementation

     When copying character arrays or using character manipulation methods, the correct size parameter must be used to account for the null terminator that needs to be added at the end of the array.

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-348Use of Less Trusted Source (opens in a new tab)

  Base weakness

  The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.

  How to prevent and test

  OWASP Cheat Sheets

  • XML Security (opens in a new tab)
  • REST Security (opens in a new tab)
  • JSON Web Token for Java (opens in a new tab)
  • REST Assessment (opens in a new tab)
  • Cross-Site Request Forgery Prevention (opens in a new tab)

  OWASP ASVS 4.0.3

  • V13.3.2 (opens in a new tab)
  • V3.5.3 (opens in a new tab)
  • V13.2.6 (opens in a new tab)

  Attack patterns

  • Cache Poisoning (opens in a new tab)
  • DNS Cache Poisoning (opens in a new tab)
  • User-Controlled Filename (opens in a new tab)
  • Manipulating Web Input to File System Calls (opens in a new tab)
  • AJAX Footprinting (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-345Insufficient Verification of Data Authenticity (opens in a new tab)

  Class weaknessOWASP Top 10 A08:2025: Software or Data Integrity Failures (opens in a new tab)

  The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

  MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.

  How to prevent and test

  OWASP Cheat Sheets

  • XML Security (opens in a new tab)
  • REST Security (opens in a new tab)
  • JSON Web Token for Java (opens in a new tab)
  • REST Assessment (opens in a new tab)
  • Cross-Site Request Forgery Prevention (opens in a new tab)

  OWASP ASVS 4.0.3

  • V13.3.2 (opens in a new tab)
  • V3.5.3 (opens in a new tab)
  • V13.2.6 (opens in a new tab)

  Attack patterns

  • JSON Hijacking (aka JavaScript Hijacking) (opens in a new tab)
  • Cache Poisoning (opens in a new tab)
  • DNS Cache Poisoning (opens in a new tab)
  • Spoofing of UDDI/ebXML Messages (opens in a new tab)
  • Application API Message Manipulation via Man-in-the-Middle (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-349Acceptance of Extraneous Untrusted Data With Trusted Data (opens in a new tab)

  Base weakness

  The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.

  How to prevent and test

  OWASP Cheat Sheets

  • XML Security (opens in a new tab)
  • REST Security (opens in a new tab)
  • JSON Web Token for Java (opens in a new tab)
  • REST Assessment (opens in a new tab)
  • Cross-Site Request Forgery Prevention (opens in a new tab)

  OWASP ASVS 4.0.3

  • V13.3.2 (opens in a new tab)
  • V3.5.3 (opens in a new tab)
  • V13.2.6 (opens in a new tab)

  Attack patterns

  • Cache Poisoning (opens in a new tab)
  • DNS Cache Poisoning (opens in a new tab)
  • Manipulating Writeable Configuration Files (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-213Exposure of Sensitive Information Due to Incompatible Policies (opens in a new tab)

  Base weaknessOWASP Top 10 A04:2021: Insecure Design (opens in a new tab)

  The product's intended functionality exposes information to certain actors in accordance with the developer's security policy, but this information is regarded as sensitive according to the intended security policies of other stakeholders such as the product's administrator, users, or others whose information is being processed.

  How to prevent and test

  OWASP Cheat Sheets

  • Error Handling (opens in a new tab)
  • Logging (opens in a new tab)

  OWASP ASVS 4.0.3

  • V8.3.4 (opens in a new tab)
  • V14.3.3 (opens in a new tab)
  • V7.3.3 (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-476NULL Pointer Dereference (opens in a new tab)

  Base weaknessLikelihood of exploit: MediumCWE Top 25 (2025): #13OWASP Top 10 A10:2025: Mishandling of Exceptional Conditions (opens in a new tab)

  The product dereferences a pointer that it expects to be valid but is NULL.

  How to prevent and test

  1. Implementation

     For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished.

  2. Requirements

     Select a programming language that is not susceptible to these issues.

  3. Implementation

     Check the results of all functions that return a value and verify that the value is non-null before acting upon it.

  OWASP Cheat Sheets

  • Logging (opens in a new tab)
  • Error Handling (opens in a new tab)

  OWASP ASVS 4.0.3

  • V11.1.7 (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-787Name not in the CWE catalogue (opens in a new tab)

• access.redhat.com/errata/RHSA-2026:43588 (opens in a new tab)
• images.redhat.com (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-40691 (opens in a new tab)
• access.redhat.com/security/updates/classification/ (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-55717 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-56416 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-50251 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-41637 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-52863 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-55990 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-42955 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-55708 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-50243 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-50252 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-46582 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-56444 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-55991 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-50046 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-54478 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-14586 (opens in a new tab)
• suse.com/support/security/rating/ (opens in a new tab)
• ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21550-1.json (opens in a new tab)
• bugzilla.suse.com/1271873 (opens in a new tab)
• bugzilla.suse.com/1271874 (opens in a new tab)
• bugzilla.suse.com/1271875 (opens in a new tab)
• bugzilla.suse.com/1271876 (opens in a new tab)
• bugzilla.suse.com/1271877 (opens in a new tab)
• bugzilla.suse.com/1271878 (opens in a new tab)
• bugzilla.suse.com/1271879 (opens in a new tab)
• bugzilla.suse.com/1271880 (opens in a new tab)
• bugzilla.suse.com/1271881 (opens in a new tab)
• bugzilla.suse.com/1271882 (opens in a new tab)
• bugzilla.suse.com/1271883 (opens in a new tab)
• bugzilla.suse.com/1271884 (opens in a new tab)
• bugzilla.suse.com/1271886 (opens in a new tab)
• bugzilla.suse.com/1271887 (opens in a new tab)
• bugzilla.suse.com/1271888 (opens in a new tab)
• bugzilla.suse.com/1271889 (opens in a new tab)
• bugzilla.suse.com/1271890 (opens in a new tab)
• bugzilla.suse.com/1271891 (opens in a new tab)
• ftp.suse.com/pub/projects/security/csaf/suse-su-2026_23050-1.json (opens in a new tab)
• suse.com/support/update/announcement/2026/suse-su-202623050-1/ (opens in a new tab)
• lists.suse.com/pipermail/sle-security-updates/2026-August/028255.html (opens in a new tab)

• CVE-2026-14586: CWE-617: Reachable Assertion in NLnet Labs UnboundMediumVulnerability07/22/2026
• In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes… (CVE-2026-44690)MediumVulnerability07/22/2026
• Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement updateHighVulnerability07/22/2026
• CVE-2026-46582: CWE-358: Improperly Implemented Security Check for Standard in NLnet Labs UnboundLowVulnerability07/22/2026
• CVE-2026-44690: CWE-345: Insufficient Verification of Data Authenticity in NLnet Labs UnboundHighVulnerability07/22/2026