CVE-2026-50046

A use-after-free flaw was found in Unbound's DNS-over-TLS (DoT) forwarded query handling. A remote attacker can exploit a timing error during TLS handshake failures on a server under load to trigger a daemon crash, resulting in a Denial of Service (DoS).

Unbound installations within Red Hat environments are vulnerable to a denial of service, leading to a daemon crash, only when specifically configured with DNS-over-TLS (DoT) forwarding or stub zones that include an #authname suffix. Exploitation by a remote attacker necessitates precise timing during transient network failures. Default Unbound configurations, which do not employ DoT forwarding or stub zones with #authname, are not affected. Hence, this is rated having low impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid configuring Unbound with a #authname suffix in DNS-over-TLS (DoT) forwarding or stub zones if not strictly required. If the #authname suffix is necessary, restrict network access to the Unbound instance to trusted clients only. This may involve configuring firewall rules to limit inbound connections to the DoT port (typically 853) from known, secure sources. After modifying Unbound's configuration, the service must be reloaded or restarted for the changes to take effect. This action may temporarily interrupt DNS resolution services.