Red Hat Security Advisory: unbound security update

The unbound packages in Red Hat Enterprise Linux 9 provide validating, recursive, and caching DNS or DNSSEC resolver functionality. Four security issues have been fixed: CVE-2026-41292 (Denial of Service via excessive EDNS options), CVE-2026-40622 (Cache manipulation via 'ghost domain names' attack), CVE-2026-44390 (Denial of Service due to excessive resource consumption with large DNS Resource Record Sets), and CVE-2026-42534 (Denial of Service due to degraded resolution performance in jostle logic). These vulnerabilities could allow denial of service conditions or cache manipulation attacks against the DNS resolver. Red Hat has issued an important security advisory with updated packages to remediate these vulnerabilities.

The vulnerabilities can lead to denial of service conditions affecting DNS resolution services or allow cache manipulation attacks that may impact DNS integrity. This could disrupt DNS operations or potentially allow attackers to influence DNS responses. The advisory rates the security impact as Important (high severity). No known exploits in the wild have been reported at this time.

Red Hat has released updated unbound packages that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:36777 and the referenced article https://access.redhat.com/articles/11258. Applying these official patches will remediate the issues. No additional mitigation steps are indicated by the vendor.