CLSA-2026-1780477611
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1780477611.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1780477611
- Upstream
- Published
- 2026-06-03T09:07:07Z
- Modified
- 2026-10-26T09:43:51Z
- Summary
- unbound: Fix of 5 CVEs
- Details
-
- CVE-2026-42960: prevent cache poisoning via promiscuous additional-section records by marking glue only for NS RRsets in the authority section [ELSCVE-130594]
- CVE-2026-42944: fix heap overflow and crash with multiple NSID and PADDING EDNS options by deduplicating options and adding bounds checks in attach_edns_record_max_msg_sz [ELSCVE-130649]
- CVE-2026-41292: cap parsed EDNS options at MAX_PARSED_EDNS_OPTIONS (100) to prevent DoS via long option lists [ELSCVE-130636]
- CVE-2026-42959: fix out-of-bounds write in val_fill_reply by indexing the destination array with chase->ns_numrrsets instead of orig->ns_numrrsets [ELSCVE-130615]
- CVE-2026-40622: prevent ghost-domain TTL extension by clamping newd->ttl to cached->ttl in the higher-trust branch of need_to_update_rrset [ELSCVE-129354]
- References
-
- https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1780477611.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-40622
- https://nvd.nist.gov/vuln/detail/CVE-2026-41292
- https://nvd.nist.gov/vuln/detail/CVE-2026-42944
- https://nvd.nist.gov/vuln/detail/CVE-2026-42959
- https://nvd.nist.gov/vuln/detail/CVE-2026-42960
Affected packages
TuxCare:AlmaLinux:9.2 / python3-unbound
Package
- Name
- python3-unbound
- Purl
- pkg:rpm/tuxcare/python3-unbound?distro=almalinux-9.2
TuxCare:AlmaLinux:9.2 / unbound
Package
- Name
- unbound
- Purl
- pkg:rpm/tuxcare/unbound?distro=almalinux-9.2
TuxCare:AlmaLinux:9.2 / unbound-devel
Package
- Name
- unbound-devel
- Purl
- pkg:rpm/tuxcare/unbound-devel?distro=almalinux-9.2