6.6
Medium
CVE-2026-41292 NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to…
Description
NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS options can hold Unbound threads hostage while they are parsing and creating internal data structures for the options. Coordinated attacks can result in degradation and/or denial of service. Unbound 1.25.1 contains a patch with a fix to limit acceptable incoming EDNS options (100).
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| unbound 1.25 | earliest → < 1.25.1 | 1.25.1 |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 6 | Versions not published | |
| Red Hat Enterprise Linux 7 | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat Hardened Images 1.25 | earliest → < 1.25.1-2.hum1 | 1.25.1-2.hum1 |
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat OpenStack Platform 16.2 | Versions not published |
Show the 5 other branches Hide the 5 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat OpenStack Platform 17.1 | Versions not published | |
| Red Hat OpenStack Platform 18.0 | Versions not published | |
| Red Hat Data Grid 8 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Versions not published | |
| Red Hat OpenShift Container Platform 4.22 4.22 | earliest → < 4.22.9.8.202608130832-0 | 4.22.9.8.202608130832-0 |
References
- www.nlnetlabs.nl www.nlnetlabs.nl
Timeline
- Published
- Last modified
Other CVEs of unbound
The 58 CVEs of unbound →
CVE-2026-97206
NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable…
7.5
High
CVE-2026-96405
NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual…
5.3
Medium
CVE-2026-50106
When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional…
6.5
Medium
CVE-2026-35501
When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an…
3.7
Low