Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
Rocky Unbound may allow remote code execution
published 24 days ago
Summary
The Unbound DNS service on Rocky Linux can be tricked by specially crafted DNS responses, causing the software to crash or run malicious code. This could let an attacker take control of the server that provides DNS lookups. Apply the latest security update for Unbound as soon as possible to fix the problem.
What to do
- Update rocky unbound to version 0:1.24.2-7.el10_2.6.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Rocky Linux:10 | rocky | unbound |
< 0:1.24.2-7.el10_2.6 Fix: upgrade to 0:1.24.2-7.el10_2.6
|
Original advisory text
Critical: unbound security update
The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.
Security Fix(es):
* unbound: Unbound: Remote Code Execution Vulnerability in CNAME Synthesis (CVE-2026-82717)
* unbound: Unbound: Heap buffer overflow via malicious DNSSEC response (CVE-2026-81634)
* unbound: Unbound: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (CVE-2026-81642)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* unbound: Unbound: Remote Code Execution Vulnerability in CNAME Synthesis (CVE-2026-82717)
* unbound: Unbound: Heap buffer overflow via malicious DNSSEC response (CVE-2026-81634)
* unbound: Unbound: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (CVE-2026-81642)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://errata.rockylinux.org/RLSA-2026:71419 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2535051 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2535054 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2535059 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:71419 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published25 Sep 2026
Updated25 Sep 2026
First seen25 Sep 2026
Sources
RLSA-2026:71419 · OSV
Track software like this
Free during beta