Loading story…
Red Hat, AlmaLinux, Rocky Linux, and Oracle Linux issued Unbound updates for CVE-2026-50252, a DNS cache-poisoning flaw caused by predictable UDP source ports. The issue can be exploited from an adjacent network and has high integrity and availability impact; affected enterprise Linux packages include Unbound libraries, development packages, dracut components, and Python bindings. Red Hat provides unbound-1.24.2-7.el10_2.5 for supported RHEL 10 and 10.2 deployments across x86_64, ARM64, s390x, and ppc64le, while corresponding downstream advisories cover AlmaLinux, Rocky Linux 9/10, and Oracle Linux 9. No public exploitation has been reported.
Separately, NLnet Labs released Unbound 1.26.1 to fix nine vulnerabilities in upstream versions through 1.26.0, including critical DNSSEC validator heap overflow CVE-2026-81642. A malicious DNS-zone operator could trigger the flaw when a vulnerable resolver processes queries for the zone, causing denial of service and potentially remote code execution; CVE-2026-82717 is a second heap-corruption issue that may permit RCE in certain builds. Administrators should promptly apply their distribution’s security updates and upgrade upstream-managed Unbound deployments to 1.26.1 or use vendor source patches where immediate upgrades are not feasible.
See real exploitation activity before you spend the cycle.
9 events from the most recent confirmed update back to the earliest known activity.
Rocky Linux published security patches for Rocky Linux 9 and Rocky Linux 10 Unbound packages to address CVE-2026-50252.
An AlmaLinux 10 security update associated with RHSA-2026:68291 became available for affected Unbound-related packages across AlmaLinux repositories and variants.
Oracle published a security update for Oracle Linux 9 Unbound packages to remediate CVE-2026-50252.
Red Hat published Moderate-severity advisory RHSA-2026:68291 for RHEL 10, supplying Unbound 1.24.2-7.el10_2.5 packages that remediate CVE-2026-50252. The update covers supported RHEL 10 architectures and associated CodeReady Linux Builder repositories.
The reporter verified NLnet Labs' patch for CVE-2026-81642.
NLnet Labs provided a patch for the critical Unbound DNSSEC-validator heap-overflow vulnerability CVE-2026-81642.
Yuqi Qiu, who found the issue with Xiang Li of Nankai University's AOSP Lab, reported CVE-2026-81642 to NLnet Labs. The flaw is a DNSSEC-validator heap overflow triggerable by an operator of a malicious DNS zone.
CVE-2026-50252, affecting Unbound packages and enabling DNS cache poisoning through predictable UDP source ports, was published. The issue has adjacent-network attack requirements and high integrity and availability impacts.
NLnet Labs released Unbound 1.26.1 to remediate nine vulnerabilities affecting releases through 1.26.0, including critical CVE-2026-81642 and heap-corruption flaw CVE-2026-82717. The release also addressed multiple denial-of-service and service-degradation flaws, and changed the default for val-clean-additional to off as part of the ReTrap remediation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
8 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcetenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourceaccess.redhat.com
Open sourcenlnetlabs.nl
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
NLnet Labs has addressed multiple vulnerabilities in the **Unbound** DNS resolver, including **`CVE-2026-33278`**, a high-severity flaw in the DNSSEC validator that can cause denial of service and potentially **remote code execution**. The bug affects Unbound versions **`1.19.1` through `1.25.0`** and stems from a deep-copy error that overwrites a destination pointer, later triggering a dangling-pointer dereference. The issue is tracked under **`CWE-416`** and **`CWE-672`** and carries high potential impact to confidentiality, integrity, and availability. Exploitation requires an attacker to control a malicious signed DNS zone and induce a vulnerable Unbound instance to query it while a **DS sub-query** is suspended because of **NSEC3 computational budget exhaustion**. Belgium's Centre for Cybersecurity warned that the Unbound vulnerabilities could enable denial-of-service and urged organizations to patch immediately. The vendor has fixed the issue in **Unbound `1.25.1`**, making upgrade a priority for operators using affected resolver versions.
Jun 29, 2026
NLnet Labs released **Unbound 1.25.2** as a security update to address multiple vulnerabilities in the Unbound DNS resolver, according to an advisory published on the `oss-sec` mailing list. The fixes cover a broad set of issues across high-, medium-, and low-severity CVEs, including denial-of-service conditions affecting **DNS-over-QUIC** and **DNSCrypt**, cache-poisoning risks, memory corruption, buffer overflows, assertion failures, and bugs that could degrade resolver availability. The advisory says several flaws are tied to specific Unbound features and configurations, including `dns-error-reporting`, `response-ip/rpz`, `serve-expired-client-timeout`, `discard-timeout`, and `unwanted-reply-threshold`. NLnet Labs also addressed problems involving `libngtcp2` behavior under DNS-over-QUIC conditions and added hardening related to an earlier fix for **CVE-2026-40622**, making the release a significant security update for operators running exposed or feature-rich Unbound deployments.
Jul 23, 2026
Red Hat released Important security updates for BIND addressing **CVE-2024-1975** and **CVE-2024-1737**, denial-of-service flaws affecting DNS resolvers and authoritative servers. CVE-2024-1975 allows clients to exhaust CPU resources with streams of SIG(0)-signed requests when a server hosts a `KEY` record or a validating resolver has cached one. CVE-2024-1737 causes severe database and query-performance degradation when a single hostname contains very large numbers of resource records. Affected upstream BIND releases include 9.11 through 9.11.37, 9.16 through 9.16.50, 9.18 through 9.18.27, and 9.19 through 9.19.24, with CVE-2024-1975 also affecting releases from 9.0.0 onward. The fixes are available across supported RHEL 8 and RHEL 9 update channels and OpenShift Container Platform 4.12 through 4.16. Red Hat advisories provide updated packages including `9.11.36-16.el8_10.2` for RHEL 8, `9.11.36-8.el8_8.6` for RHEL 8.8 channels, and `9.16.23-11.el9_2.5` for RHEL 9.2; selected RHEL 8.6 and RHEL 9.2 channels also remediate **CVE-2024-4076**, an assertion-failure condition when serving stale cache data and authoritative-zone content. Organizations should apply the applicable BIND updates promptly, prioritizing exposed recursive resolvers and authoritative DNS infrastructure.
Aug 27, 2026