Bug 2479825 (CVE-2026-42923)

Summary: CVE-2026-42923 unbound: Unbound DNSSEC Validator NSEC3 Hash Calculation Limit Bypass via Negative Cache Code Path Leading to DoS
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, security-response-team, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Unbound's DNSSEC validator where the code path for consulting the negative cache for DS records does not honor the limit on NSEC3 hash calculations introduced in version 1.19.1. An adversary who controls a DNSSEC-signed zone can sign NSEC3 records with high iteration counts for child delegations, causing Unbound to perform excessive hash computations while holding a global lock on the negative cache. This temporarily blocks other resolver threads from accessing the negative cache, leading to degraded DNS resolution performance for the duration of the attack.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2480119, 2481463    
Bug Blocks:    
Deadline: 2026-05-20   

Description OSIDB Bzimport 2026-05-19 12:29:05 UTC 
Uncontrolled Resource Consumption vulnerability in the DNSSEC validator of the Unbound DNS resolver. The flaw is caused by the negative cache DS record code path not taking into account the limit on NSEC3 hash calculations introduced in Unbound 1.19.1. An adversary that controls a DNSSEC-signed zone can exploit this by signing NSEC3 records with acceptably high iterations for child delegations and querying a vulnerable Unbound. Unbound will keep performing the allowed hash calculations on the NSEC3 records without applying the mitigation limit. As a side effect, a global lock for the negative cache is held for the duration of the hashing, blocking other threads that need to consult the negative cache. Coordinated attacks could escalate the impact to a full denial-of-service.