Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Red Hat Unbound may let attackers read DNS data

published 25 days ago

Summary

The Unbound DNS resolver and its library in Red Hat can be tricked into revealing internal DNS information to an attacker. This could expose details about your network that should stay private. Update Unbound and Unbound-libs to the latest Red Hat package to close the risk.

What to do

Update redhat unbound to version 0:1.20.0-18.el10_0.13.
Update redhat unbound-libs to version 0:1.20.0-18.el10_0.13.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:enterprise_linux_eus:10.0	redhat	unbound	< 0:1.20.0-18.el10_0.13 Fix: upgrade to 0:1.20.0-18.el10_0.13
Red Hat:enterprise_linux_eus:10.0	redhat	unbound-libs	< 0:1.20.0-18.el10_0.13 Fix: upgrade to 0:1.20.0-18.el10_0.13

Original advisory text

Red Hat Security Advisory: unbound security update

References

https://access.redhat.com/errata/RHSA-2026:71459 Vendor Advisory
https://access.redhat.com/security/updates/classification/#critical Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2535059 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71459.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-81642 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-81642 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-81642 Vendor Advisory
https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81642.txt Third Party Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Timeline

Published24 Sep 2026

Updated24 Sep 2026

First seen24 Sep 2026

Sources

RHSA-2026:71459 · OSV

Track software like this

Free during beta