RLSA-2026:97121: Moderate: unbound security, bug fix, and enhancement update
The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.
Security Fix(es):
unbound: Unbound DNS Cache Poisoning via Promiscuous Additional Section RRSet Acceptance (CVE-2026-42960)
unbound: Unbound DNSSEC Validator NSEC3 Hash Calculation Limit Bypass via Negative Cache Code Path Leading to DoS (CVE-2026-42923)
unbound: Unbound: Denial of Service due to locking inconsistency during RPZ XFR reload (CVE-2026-44608)
Bug Fix(es) and Enhancement(s):
Update to latest 1.26 (JIRA:Rocky Linux-246536)
[Rocky Linux-10][AppStream] Packages present in comps but missing from repo: unbound (JIRA:Rocky Linux-171309)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/unbound-utilsto a version that resolves this vulnerability.Fixed in 0:1.26.1-2.el10_3 - Upgrade
Upgrade
rocky-linux/unbound-anchor-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.26.1-2.el10_3 - Upgrade
Upgrade
rocky-linux/unbound-libsto a version that resolves this vulnerability.Fixed in 0:1.26.1-2.el10_3 - Upgrade
Upgrade
rocky-linux/unbound-develto a version that resolves this vulnerability.Fixed in 0:1.26.1-2.el10_3 - Upgrade
Upgrade
rocky-linux/unbound-anchorto a version that resolves this vulnerability.Fixed in 0:1.26.1-2.el10_3 - Upgrade
Upgrade
rocky-linux/unboundto a version that resolves this vulnerability.Fixed in 0:1.26.1-2.el10_3 - Upgrade
Upgrade
rocky-linux/python3-unboundto a version that resolves this vulnerability.Fixed in 0:1.26.1-2.el10_3 - Upgrade
Upgrade
rocky-linux/unbound-utils-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.26.1-2.el10_3 - Upgrade
Upgrade
rocky-linux/unbound-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.26.1-2.el10_3 - Upgrade
Upgrade
rocky-linux/python3-unbound-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.26.1-2.el10_3 - Upgrade
Upgrade
rocky-linux/unbound-libs-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.26.1-2.el10_3 - Upgrade
Upgrade
rocky-linux/unbound-dracutto a version that resolves this vulnerability.Fixed in 0:1.26.1-2.el10_3 - Upgrade
Upgrade
rocky-linux/unbound-debugsourceto a version that resolves this vulnerability.Fixed in 0:1.26.1-2.el10_3 - Upgrade
Upgrade
unboundto a version that resolves this vulnerability.Fixed in 1.26
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which deployments are most relevant to these fixes?
Systems running the Rocky Linux unbound resolver packages are relevant, including unbound itself and related libraries, utilities, anchor components, development packages, Python bindings, and debuginfo packages. The issues concern DNS cache handling, DNSSEC validation, and RPZ XFR reload behavior.
What level of attacker access is indicated by the supplied severity vector?
The vector indicates network-based exploitation with no privileges or user interaction required, but with high attack complexity. The stated potential impact is integrity modification and limited availability impact, with no confidentiality impact.
Are configuration-specific exposure conditions identified?
The advisory identifies an RPZ XFR reload locking issue and issues involving DNS cache and DNSSEC negative-cache processing. It does not state whether these features are enabled by default or provide configuration-based mitigations.
What should be updated?
Update the Rocky Linux unbound package set as applicable to the system, including unbound and any installed related unbound packages listed in the advisory. The release also updates Unbound to the latest 1.26 version.