SB20260921143 - Red Hat Enterprise Linux 9 update for unbound

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260921143

SB20260921143 - Red Hat Enterprise Linux 9 update for unbound

Published: September 21, 2026

Security Bulletin ID SB20260921143
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Use of insufficiently random values (CVE-ID: CVE-2026-50252)

CWE-ID: CWE-330 - Use of Insufficiently Random Values

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to conduct DNS cache poisoning attacks.

The vulnerability exists due to improper randomness management in UDP source port selection when handling DNS queries with the SO_REUSEPORT configuration option enabled. A remote attacker can send queries and observe outgoing source ports to conduct DNS cache poisoning attacks.

The issue occurs because worker threads use disjoint UDP source port subsets, allowing observed outgoing source ports to reveal which thread processed the original query.


Remediation

Install update from vendor's website.

References