The unbound DNS resolver packages in Red Hat Enterprise Linux 10 prior to version 10.2 are affected by two security vulnerabilities: CVE-2024-33655, known as the DNSBomb vulnerability, and CVE-2025-11411, which allows domain hijacking via promiscuous records. These issues could impact the DNS resolution process. Red Hat has released an updated unbound package (1.24.2-7.el10) that addresses these vulnerabilities and includes additional changes such as disabling TLS 1.2 by default. The advisory covers multiple architectures including x86_64, s390x, ppc64le, and aarch64. The update is rated with moderate security impact by Red Hat Product Security.

The vulnerabilities could allow an attacker to exploit the DNS resolver to cause denial of service (DNSBomb) or domain hijacking through promiscuous DNS records. The advisory rates the impact as moderate. There are no known exploits in the wild at the time of the advisory. The issues affect DNS resolution integrity and availability in affected versions of unbound on Red Hat Enterprise Linux 10.

Red Hat has released an official security update to unbound version 1.24.2-7.el10 that fixes the DNSBomb vulnerability (CVE-2024-33655) and the domain hijacking vulnerability (CVE-2025-11411). Users should apply this update promptly to affected systems running Red Hat Enterprise Linux 10 versions prior to 10.2. Detailed update instructions are available in the Red Hat advisory and knowledge base article https://access.redhat.com/articles/11258. No additional mitigations are indicated by the vendor.