The unbound DNS resolver packages in Red Hat Enterprise Linux 10 contain three notable security flaws: (1) a heap overflow and crash caused by handling multiple NSID, cookie, and padding EDNS options (CVE-2026-42944), (2) a denial of service vulnerability in the DNSSEC validator due to an incorrect write offset counter in chase-reply messages (CVE-2026-42959), and (3) a use-after-free vulnerability in the DNSSEC validator related to deep copy pointer overwrite, which can lead to denial of service and possible remote code execution (CVE-2026-33278). These issues are addressed in the updated unbound packages provided by Red Hat. The advisory covers multiple architectures and product variants. The update is classified as important by Red Hat Product Security.

Successful exploitation of these vulnerabilities could cause unbound to crash (denial of service) or, in the case of CVE-2026-33278, potentially allow remote code execution. This impacts the availability and integrity of DNS resolution services on affected systems. No known active exploits have been reported, but the presence of a use-after-free vulnerability with possible remote code execution elevates the risk.

Red Hat has released updated unbound packages that address these vulnerabilities. Users of affected Red Hat Enterprise Linux 10 and related products should apply the security update as described in the Red Hat advisory RHSA-2026:23231. Detailed update instructions are available at https://access.redhat.com/articles/11258. Since this is an on-premises product, remediation requires applying the vendor-provided patches. There are no indications that no action is required or that the issue is already mitigated without patching.