Threat Intelligence Database

A security vulnerability (CVE-2026-44690) affecting the unbound DNS resolver in Red Hat Enterprise Linux 8 allows cache poisoning due to insufficient validation of RRSIG labels and premature cache writes. This vulnerability could allow an attacker to poison the DNS cache, potentially leading to incorrect DNS responses. Red Hat has issued an important security advisory with updates to fix this issue. The vulnerability affects multiple architectures of Red Hat Enterprise Linux 8 and Extended Life Cycle 8.10. No CVSS score is provided, but the severity is rated as high by Red Hat. A security update is available and should be applied to affected systems to remediate the issue.

NLnet Labs Unbound versions up to and including 1.25.0 contain a vulnerability in handling DNS replies with very large resource record sets (RRsets) requiring name compression. Maliciously crafted upstream DNS responses with large RRsets that lack shared suffixes above the root cause Unbound to spend excessive CPU time applying name compression, leading to degraded performance and potential denial of service. The issue arises because the compression counter is not incremented in certain code paths, allowing unbounded processing. This vulnerability is addressed in Unbound version 1.25.1, which includes a patch to increment the compression counter regardless of compression tree lookup success. Red Hat has released security advisories providing updated packages that fix this vulnerability for their hardened images and Red Hat Enterprise Linux 10 distributions.

NLnet Labs Unbound up to and including version 1.25.0 contains a vulnerability in its jostle logic that can degrade DNS resolution performance. The flaw allows retransmitted duplicate queries to reset the aging timer of slow queries, preventing their replacement and potentially causing denial of resolution service under coordinated attack. Cache and local data responses are not affected. Unbound 1.25.1 includes a patch that fixes this by attaching a fixed start time to queries, enabling proper aging and replacement logic.