Backport fix for CVE-2026-50252 from upstream commit
804cff4c to unbound-1.16.2. The patch introduces a shared_ports
structure with per-thread source port population mapping and
proper locking, preventing cache poisoning attacks through
source port prediction.
CVE: CVE-2026-50252
Upstream patches:
- 804cff4c15.patch
Resolves: RHEL-243471
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Test was modified to remove the iter-scrub-promiscuous option from the
unbound config as that option is not implemented in unbound 1.16.2.
Resolves: RHEL-212801
Backport fix for CVE-2026-44690 (cross-zone wildcard cache
poisoning via RRSIG.labels manipulation) from upstream commit
f7637a4f1 to unbound-1.16.2. The patch adds validation that
the wildcard canonical parent is within the RRSIG signer's
authority before caching, checks that the RRSIG label count
is not lower than the signer name's label count, and postpones
the wildcard cache update until after the NSEC/NSEC3 proof
succeeds.
CVE: CVE-2026-44690
Upstream patches:
- f7637a4f18.patch
Resolves: RHEL-212801
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Key was updated in config files, but not properly in unbound-anchor too.
That should contain new key as well.
Resolves: RHEL-131172
(cherry picked from commit 03575da4cc85a14edb99a0f640bfe2787682ab2a)
Make z-stream build, which is not needed for RHEL. But Errata is needed
to propagate the change to CentOS public repositories.
Resolves: RHEL-25500 RHEL-25428 RHEL-25423
If the user has already modified configuration file unbound.conf, our
change of defaults would not affect them. Let's move the change to extra
file, which will be applied even when main config file were not
modified.
Correct new config snippet typo in CVE id
; Resolves: CVE-2024-1488
Resolves: RHEL-25500
