ELSA-2026-68291

ELSA-2026-68291 - unbound security update

Type:	SECURITY
Impact:	MODERATE
Release Date:	2026-09-17

Description

[1.24.2-20]
- Backport additional fix of locks during initialization

[1.24.2-19]
- Fix CVE-2026-50252: prevent cache poisoning via shared ports

[1.24.2-18]
- Add unit tests for CVE-2026-{44690,55973}

[1.24.2-17]
- Fix CVE-2026-55973: dns-error-reporting stack buffer overflow

[1.24.2-16]
- Fix CVE-2026-44690 - Cross-zone wildcard cache poisoning

[1.24.2-15]
- Fix CVE-2026-42534: Jostle logic bypass degrades resolution performance

[1.24.2-14]
- Fix CVE-2026-41292: DoS via excessive EDNS options

[1.24.2-13]
- Add upstream unit test for CVE-2026-40622

[1.24.2-12]
- Fix CVE-2026-44390: DoS with large RRsets

[1.24.2-11]
- Fix CVE-2026-40622: cache manipulation via 'ghost domain names' attack

Related CVEs

CVE-2026-50252

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 10 (aarch64)	unbound-1.24.2-7.el10_2.5.src.rpm	4314b4cd5c142e51aa967c4c08b585c178242a4e6ad012f7c18fba7dca200319	-	ol10_aarch64_appstream
	unbound-1.24.2-7.el10_2.5.src.rpm	4314b4cd5c142e51aa967c4c08b585c178242a4e6ad012f7c18fba7dca200319	-	ol10_aarch64_codeready_builder
	python3-unbound-1.24.2-7.el10_2.5.aarch64.rpm	3ab31046fca10c77ccddbf6b05884fb9b5b76f23dbe94211557c7643b35994a6	-	ol10_aarch64_appstream
	unbound-1.24.2-7.el10_2.5.aarch64.rpm	37c8417b706332fb4a35d5796b9fc628cb552961997db803a867d857f4a43b51	-	ol10_aarch64_appstream
	unbound-anchor-1.24.2-7.el10_2.5.aarch64.rpm	a579b98ae759d4a169da38f6e36e96cf5c58ca237b7c7e68031b3eee6faa99f4	-	ol10_aarch64_appstream
	unbound-devel-1.24.2-7.el10_2.5.aarch64.rpm	e6148f5da6dafa03bb4910e8c6264ada841c83f0f160890af6319cf6777eddd1	-	ol10_aarch64_codeready_builder
	unbound-dracut-1.24.2-7.el10_2.5.aarch64.rpm	fc52fbff7ea4e7a4909ab7be9aa039f4567b7a5b370b097f81cf4813faa47b1d	-	ol10_aarch64_appstream
	unbound-libs-1.24.2-7.el10_2.5.aarch64.rpm	4e3396947d93d50351df056a33d32247add45ab3f43e2dd9428e785cf97fa521	-	ol10_aarch64_appstream
	unbound-utils-1.24.2-7.el10_2.5.aarch64.rpm	f1e95d62ed540f5ddfe304e375dc5d80f46cb867e0edaaa0d89fe52bc24c3e2e	-	ol10_aarch64_appstream
Oracle Linux 10 (x86_64)	unbound-1.24.2-7.el10_2.5.src.rpm	4314b4cd5c142e51aa967c4c08b585c178242a4e6ad012f7c18fba7dca200319	-	ol10_x86_64_appstream
	unbound-1.24.2-7.el10_2.5.src.rpm	4314b4cd5c142e51aa967c4c08b585c178242a4e6ad012f7c18fba7dca200319	-	ol10_x86_64_codeready_builder
	python3-unbound-1.24.2-7.el10_2.5.x86_64.rpm	3f5fc06a300b3d9b56245694a6f92b8ab780c3835ad1d0d4794a7910ee7a37c5	-	ol10_x86_64_appstream
	unbound-1.24.2-7.el10_2.5.x86_64.rpm	9c6f670e58c5fe9a720fd6e031ace6e71963328c10fe2e8ee6417ecade789d33	-	ol10_x86_64_appstream
	unbound-anchor-1.24.2-7.el10_2.5.x86_64.rpm	5610e151d9d1363195e8cc99d0191ab76c028295f1d1d83437c5ae272827ce4c	-	ol10_x86_64_appstream
	unbound-devel-1.24.2-7.el10_2.5.x86_64.rpm	67737ad4e7254cd0ff66b2291811b5b08f92da817c1e4da56a03084f5e168dd8	-	ol10_x86_64_codeready_builder
	unbound-dracut-1.24.2-7.el10_2.5.x86_64.rpm	5353676735cda81a4a91f603b7b5dc1157beaa90b4e37745687c2869c5ba443b	-	ol10_x86_64_appstream
	unbound-libs-1.24.2-7.el10_2.5.x86_64.rpm	79166ff99526af922069a07f0350e9869c5c25ca135dbf6f8b649159aecc8ebf	-	ol10_x86_64_appstream
	unbound-utils-1.24.2-7.el10_2.5.x86_64.rpm	8678763034515fdd4608c95e10cfedb49a4e4b726d38a426c2547dd3e9a93d73	-	ol10_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team