RLSA-2026:97497: Moderate: unbound security, bug fix, and enhancement update
The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.
Security Fix(es):
unbound: Unbound DNS Cache Poisoning via Promiscuous Additional Section RRSet Acceptance (CVE-2026-42960)
unbound: Unbound DNSSEC Validator NSEC3 Hash Calculation Limit Bypass via Negative Cache Code Path Leading to DoS (CVE-2026-42923)
unbound: Unbound: Denial of Service due to locking inconsistency during RPZ XFR reload (CVE-2026-44608)
Bug Fix(es) and Enhancement(s):
Update to latest 1.26 [rhel-9] (JIRA:Rocky Linux-246537)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/python3-unboundto a version that resolves this vulnerability.Fixed in 0:1.26.1-1.el9_9 - Upgrade
Upgrade
rocky-linux/python3-unbound-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.26.1-1.el9_9 - Upgrade
Upgrade
rocky-linux/unboundto a version that resolves this vulnerability.Fixed in 0:1.26.1-1.el9_9 - Upgrade
Upgrade
rocky-linux/unbound-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.26.1-1.el9_9 - Upgrade
Upgrade
rocky-linux/unbound-debugsourceto a version that resolves this vulnerability.Fixed in 0:1.26.1-1.el9_9 - Upgrade
Upgrade
rocky-linux/unbound-develto a version that resolves this vulnerability.Fixed in 0:1.26.1-1.el9_9 - Upgrade
Upgrade
rocky-linux/unbound-dracutto a version that resolves this vulnerability.Fixed in 0:1.26.1-1.el9_9 - Upgrade
Upgrade
rocky-linux/unbound-libsto a version that resolves this vulnerability.Fixed in 0:1.26.1-1.el9_9 - Upgrade
Upgrade
rocky-linux/unbound-libs-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.26.1-1.el9_9 - Upgrade
Upgrade
unboundto a version that resolves this vulnerability.Fixed in 1.26
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which systems are exposed to these issues?
Systems running the affected Unbound packages as validating, recursive, or caching DNS/DNSSEC resolvers are relevant. The advisory applies to the Rocky Linux 9 package update identified as updating Unbound to the latest 1.26 release.
What capabilities does an attacker need?
The supplied CVSS vector indicates network reachability, no privileges, and no user interaction are required, although exploitation has high attack complexity. The listed impacts include DNS cache poisoning and denial of service.
Are default installations affected?
The advisory does not state whether the affected conditions are enabled in a default Unbound configuration. It specifically identifies an RPZ XFR reload locking issue, so deployments using RPZ XFR reload functionality should assess that configuration.
How can I determine whether remediation is needed?
Check whether the system runs Unbound packages and whether it has received the Rocky Linux 9 update that brings Unbound to the latest 1.26 release. The advisory does not provide the prior vulnerable package versions, so package-update status is the available indicator.