Bug 2503063 (CVE-2026-44690)

Summary:	CVE-2026-44690 unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, security-response-team, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Unbound. Insufficient validation of the RRSIG.Labels field, combined with premature cache writes during RFC 8198 aggressive NSEC processing, can lead to cache poisoning. This vulnerability allows a malicious actor, controlling a single delegated zone, to poison arbitrary sibling zones under NSEC-signed parent domains. The primary impact is the integrity of DNS resolution, potentially leading to users being directed to malicious websites or services.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2507650
Bug Blocks:
Deadline:	2026-07-22

Description OSIDB Bzimport 2026-07-20 21:57:14 UTC

Insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison 
arbitrary sibling zones under NSEC-signed parent domains. Unbound 1.25.2 includes fixes to add lower-bound check in RRSIG labels, move cache write stricly after validation and adding bailiwick check when updating wildcards.

Comment 2 errata-xmlrpc 2026-08-17 18:16:02 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:55784 https://access.redhat.com/errata/RHSA-2026:55784

Comment 3 errata-xmlrpc 2026-08-17 21:16:04 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:55841 https://access.redhat.com/errata/RHSA-2026:55841

Comment 4 errata-xmlrpc 2026-08-17 23:03:29 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:55892 https://access.redhat.com/errata/RHSA-2026:55892

Comment 5 errata-xmlrpc 2026-09-01 21:38:44 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.22

Via RHSA-2026:60440 https://access.redhat.com/errata/RHSA-2026:60440