CVE-2026-41292
Description
A flaw was found in Unbound. A remote attacker can exploit this vulnerability by sending queries with an excessive number of EDNS (Extension Mechanisms for DNS) options. This can cause Unbound threads to be held hostage while parsing and creating internal data structures for these options. Coordinated attacks can lead to resource exhaustion, resulting in a degradation of service or a denial of service (DoS) for legitimate users.
Statement
A flaw of Important severity was found in Unbound, the validating recursive DNS resolver shipped in Red Hat Enterprise Linux and included in other Red Hat products such as Red Hat OpenShift Container Platform and Red Hat In-Vehicle OS. A remote attacker requiring no privileges or user interaction can send DNS queries containing an excessive number of EDNS (Extension Mechanisms for DNS) options, which can hold Unbound worker threads hostage while they parse the options and create internal data structures for them. Coordinated attacks of this kind can exhaust server resources, resulting in degradation of service or denial of service for legitimate users; confidentiality and integrity are not affected. The Red Hat severity of Important (CVSS:3.1 score of 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is consistent with the NIST and upstream CVSS:3.1 scores, although the upstream CVSS:4.0 base score is lower (6.6, Moderate). Only product streams that ship the affected unbound component are impacted; several streams have been assessed as not affected in current triage. Fixes for the affected streams are being pursued by the responsible component maintainers.
Mitigation
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
Until patched, restrict the resolver to authorized client networks via firewall and apply DNS rate limiting per source IP. Service watchdog and cgroup limits provide resilience but are not a substitute for patching.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | 7.5 | 7.5 |
| Attack Vector | Network | Network | Network |
| Attack Complexity | Low | Low | Low |
| Privileges Required | None | None | None |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | None | None |
| Integrity Impact | None | None | None |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other); Reduce Performance
This issue can make the product perform more slowly. If an attacker can influence the number of iterations in the loop, then this performance problem might allow a denial of service by consuming more platform resources than intended.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
