Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
Rocky Linux Unbound could let attackers run code
published 24 days ago
Summary
The Unbound DNS service on Rocky Linux can be tricked into executing malicious code through specially crafted DNS responses. This could allow an attacker to take control of the server or cause it to crash. Update Unbound to the latest version as soon as possible to protect your system.
What to do
- Update rocky unbound to version 0:1.24.2-3.el9_8.8.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Rocky Linux:9 | rocky | unbound |
< 0:1.24.2-3.el9_8.8 Fix: upgrade to 0:1.24.2-3.el9_8.8
|
Original advisory text
Critical: unbound security update
The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.
Security Fix(es):
* unbound: Unbound: Remote Code Execution Vulnerability in CNAME Synthesis (CVE-2026-82717)
* unbound: Unbound: Heap buffer overflow via malicious DNSSEC response (CVE-2026-81634)
* unbound: Unbound: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (CVE-2026-81642)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* unbound: Unbound: Remote Code Execution Vulnerability in CNAME Synthesis (CVE-2026-82717)
* unbound: Unbound: Heap buffer overflow via malicious DNSSEC response (CVE-2026-81634)
* unbound: Unbound: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (CVE-2026-81642)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://errata.rockylinux.org/RLSA-2026:71487 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2535051 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2535054 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2535059 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:71487 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published25 Sep 2026
Updated30 Sep 2026
First seen30 Sep 2026
Sources
RLSA-2026:71487 · OSV
Track software like this
Free during beta