Red Hat Unbound Updates Expand Across RHEL 7 and 8
Tech GuruQuick Answer
Unbound resolver fixes are available for the listed RHEL 7 and 8 streams, but the packages are not interchangeable. Match the host's release and entitlement to the three RHSA entries below. The RHEL 8.10 advisory now lists three CVEs; the RHEL 7 and 8.8 notices focus on CVE-2026-81642.
Confirm Scope And Apply The Supported Fix
Next step: Identify each resolver's RHEL stream and installed RPM release, then use its entitled repository. Plan for DNS continuity while restarting the updated service, and test signed and unsigned lookups before returning it to normal traffic.
Last verified: 2026-09-28 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | RHEL 7 ELS, RHEL 8.8 E4S/TUS, and RHEL 8.10 Unbound resolver packages |
|---|---|
| Advisory | RHSA-2026:70754 / RHSA-2026:72199 / RHSA-2026:72264 |
| CVE | CVE-2026-81642 (all three listed RHSAs); CVE-2026-81634 and CVE-2026-82717 additionally appear in RHSA-2026:70754. |
| Authoritative release date | RHSA-2026:70754: 2026-09-23 14:12:22 UTC; RHSA-2026:72199: 2026-09-26 18:08:45 UTC; RHSA-2026:72264: 2026-09-27 19:04:57 UTC |
| Authority revision date | RHSA-2026:70754: 2026-09-23 14:12:51 UTC; RHSA-2026:72199: 2026-09-26 21:28:28 UTC; RHSA-2026:72264: 2026-09-27 21:27:19 UTC |
| Affected versions | The exact entitled RHEL 7, RHEL 8.8 E4S/TUS, and RHEL 8.10 Unbound package builds before the branch-specific fixed packages in the three advisories. |
| Fixed version | unbound 1.6.6-5.el7_9.2 / 1.16.2-5.el8_8.6 / 1.16.2-5.14.el8_10.4 |
| CVSS base score | 9.8 (CVSS v3.1) |
| CVSS severity | Critical |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
CVE-2026-81642 concerns a DNSKEY-processing buffer overflow with possible denial of service or code execution. RHSA-2026:70754 additionally lists CVE-2026-81634 and CVE-2026-82717. Use each RHSA's package and vulnerability mapping rather than treating the combined list as identical coverage on every branch.
What To Validate Now
- Inventory. Locate entitled RHEL 7 ELS, RHEL 8.8 E4S/TUS, and RHEL 8.10 systems with Unbound packages; record entitlement, package version, enabled resolver service, exposure, owner, and dependencies.
- Establish applicability. Compare each entitled system with the exact product and package scope in the matching RHSA. Do not infer applicability from the RHEL or Unbound family alone.
- Remediate. Apply unbound 1.6.6-5.el7_9.2, 1.16.2-5.el8_8.6, or 1.16.2-5.14.el8_10.4 through the supported repository for the matching entitled branch.
- Validate. Check the installed RPM and the running resolver after restart. Test normal resolution, DNSSEC validation, forwarding and local zones you use, plus resolver failover. Keep query captures limited and sanitized because they can expose user activity and internal names.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
