Red Hat Security Advisory: unbound security update

The unbound packages in Red Hat Enterprise Linux 10 provide a validating, recursive, and caching DNS or DNSSEC resolver. Several vulnerabilities have been identified and fixed: CVE-2026-41292 allows denial of service via excessive EDNS options; CVE-2026-40622 enables cache manipulation through a 'ghost domain names' attack; CVE-2026-44390 causes denial of service due to excessive resource consumption with large DNS Resource Record Sets; and CVE-2026-42534 results in denial of service due to degraded resolution performance in jostle logic. These vulnerabilities affect Red Hat Enterprise Linux 10 and its variants on multiple architectures including x86_64, s390x, ppc64le, and aarch64. Red Hat has released updated packages to address these issues.

The vulnerabilities can lead to denial of service conditions and cache manipulation in the unbound DNS resolver, potentially impacting DNS resolution reliability and integrity on affected systems. The cache manipulation vulnerability could allow an attacker to influence DNS responses. Red Hat rates the security impact as Important, indicating a high severity but not critical. There are no known exploits in the wild at this time.

Red Hat has released updated unbound packages for Red Hat Enterprise Linux 10 and related products that address these vulnerabilities. Users should apply the security update as detailed in the Red Hat advisory (RHSA-2026:36320) to remediate these issues. For update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor.