Red Hat Updates Unbound Resolver on RHEL 8
Tech GuruQuick Answer
Red Hat's RHSA-2026:69120 fixes CVE-2026-50252 in RHEL 8 Unbound packages with build 1.16.2-5.14.el8_10.2. The flaw reduces the unpredictability of outgoing UDP source ports, which can enable DNS cache poisoning. Red Hat rates the update Moderate; the CVSS score is 6.5 Medium.
Confirm Scope And Apply The Supported Fix
What to do now: Inventory Unbound resolver instances and dependent applications, match the RHEL 8 package to the advisory, install the fixed build, and validate DNS resolution and the configured security controls.
Last verified: 2026-09-21 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | RHEL 8 AppStream Unbound resolver packages, build family el8_10 |
|---|---|
| Advisory | RHSA-2026:69120 |
| CVE | CVE-2026-50252 |
| Authoritative release date | 2026-09-21 06:15:07 UTC |
| Authority revision date | 2026-09-21 06:15:42 UTC |
| Affected versions | Unbound packages in the advisory's RHEL 8 AppStream scope before the listed fixed build. |
| Fixed version | unbound 1.16.2-5.14.el8_10.2 |
| CVSS base score | 6.5 (CVSS v3.1) |
| CVSS severity | Medium |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
Red Hat attributes the flaw to Unbound's SO_REUSEPORT implementation: attackers can associate UDP ports with particular worker threads, reducing source-port unpredictability. Forged DNS information may then poison the cache and redirect traffic or disclose information. The advisory does not establish that any particular resolver's cache has already been poisoned.
What To Validate Now
- Inventory. Record each RHEL 8 Unbound package, resolver role, network exposure, configured security controls, and applications that rely on it.
- Establish applicability. Match the exact Unbound build and repository to RHSA-2026:69120. Assess resolver exposure and trust separately from the Medium severity label.
- Remediate. Apply unbound 1.16.2-5.14.el8_10.2 through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Confirm the updated package and supported activation steps; test representative DNS and configured DNSSEC behavior, resolver health, and dependent application lookups.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
