Threat Intelligence Database

A moderate severity vulnerability (CVE-2026-50252) affecting the unbound DNS resolver in Red Hat Enterprise Linux 10 allows DNS cache poisoning via UDP source port predictability. This flaw could enable an attacker to manipulate DNS responses by predicting the UDP source port used in DNS queries. Red Hat has released an update to address this issue in unbound packages for various architectures and extended update support versions of RHEL 10. Users are advised to apply the provided security update to mitigate the risk.

Red Hat has issued a security advisory for the unbound DNS resolver addressing a cache poisoning vulnerability (CVE-2026-44690) caused by insufficient RRSIG.Labels validation and premature cache writes. This vulnerability could allow an attacker to poison the DNS cache. The advisory also mentions a denial of service issue via malformed EDNS Report-Channel option (CVE-2026-55973). The update is rated as Important by Red Hat Product Security and affects Red Hat Enterprise Linux 8 versions. A security update is available to remediate these issues.

Multiple security vulnerabilities have been identified in the unbound DNS resolver packages used in Red Hat Enterprise Linux 8. These include denial of service issues caused by excessive EDNS options, large DNS resource record sets, and degraded resolution performance, as well as a cache manipulation vulnerability via a 'ghost domain names' attack. Red Hat has issued an important security advisory with updates addressing these issues.

Multiple security vulnerabilities have been identified in the unbound DNS resolver packages used in Red Hat Enterprise Linux 9. These include denial of service issues caused by excessive EDNS options, large DNS resource record sets, and degraded resolution performance, as well as a cache manipulation vulnerability via 'ghost domain names'. Red Hat has released security updates addressing these issues.

Multiple security vulnerabilities affecting the unbound DNS resolver in Red Hat Enterprise Linux 10 have been addressed. These include denial of service issues caused by excessive EDNS options, large DNS resource record sets, and degraded resolution performance, as well as a cache manipulation vulnerability via 'ghost domain names'. The vulnerabilities have been rated with a security impact of Important by Red Hat Product Security. Updates are available to remediate these issues in Red Hat Enterprise Linux 10 and related CodeReady Linux Builder products across multiple architectures.

NLnet Labs Unbound versions up to and including 1.25.0 contain a vulnerability related to inefficient algorithmic complexity in handling DNS replies with very large resource record sets (RRsets). This flaw can cause Unbound to spend excessive time applying name compression, potentially leading to degraded performance or denial of service. The issue arises when records do not share a suffix above the root, causing an unbounded operation in name compression. A fix was introduced in version 1.25.1 that correctly increments the compression counter regardless of compression tree lookup results, addressing this vulnerability.

NLnet Labs Unbound versions up to and including 1.25.0 contain a vulnerability in the jostle logic that can degrade DNS resolution performance. This occurs because retransmitted duplicate queries renew the age of slow queries, preventing their replacement and causing performance degradation. An attacker controlling a slow or malicious authoritative DNS server can exploit this to degrade resolution performance or cause denial of resolution service. Cache and local data responses are unaffected. The issue is fixed in Unbound version 1.25.1, which attaches an immutable start time to queries to enable correct aging and replacement logic.

Red Hat has issued a moderate severity security advisory for the unbound DNS resolver packages addressing two vulnerabilities: CVE-2024-33655 (DNSBomb) and CVE-2025-11411 (domain hijacking via promiscuous records). These vulnerabilities affect Red Hat Enterprise Linux 10 versions prior to 10.2 and related CodeReady Linux Builder packages. The update to unbound version 1.24.2-7.el10 includes fixes for these issues and disables TLS 1.2 by default. Users of affected versions should apply the update to mitigate these vulnerabilities.

A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged attacker to manipulate a running instance, potentially altering forwarders, allowing them to track all queries forwarded by the local resolver, and, in some cases, disrupting resolving altogether.