{ "document": { "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/centos6els/vex/2026/cve-2026-109125-els_os-centos6els.json" } ], "tracking": { "current_release_date": "2026-10-28T10:59:26Z", "generator": { "date": "2026-10-28T10:59:26Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2026-109125-ELS_OS-CENTOS6ELS", "initial_release_date": "2026-10-21T09:17:00Z", "revision_history": [ { "date": "2026-10-21T09:17:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-10-28T10:59:26Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "Security update on CVE-2026-109125" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Community Enterprise Operating System 6", "product": { "name": "Community Enterprise Operating System 6", "product_id": "CentOS-6", "product_identification_helper": { "cpe": "cpe:2.3:o:centos:centos:6:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Community Enterprise Operating System" }, { "branches": [ { "category": "product_version", "name": "unbound-python-0:1.4.20-29.el6_10.1.x86_64", "product": { "name": "unbound-python-0:1.4.20-29.el6_10.1.x86_64", "product_id": "unbound-python-0:1.4.20-29.el6_10.1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/centos/unbound-python@1.4.20-29.el6_10.1?arch=x86_64" } } }, { "category": "product_version", "name": "unbound-devel-0:1.4.20-29.el6_10.1.x86_64", "product": { "name": "unbound-devel-0:1.4.20-29.el6_10.1.x86_64", "product_id": "unbound-devel-0:1.4.20-29.el6_10.1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/centos/unbound-devel@1.4.20-29.el6_10.1?arch=x86_64" } } }, { "category": "product_version", "name": "unbound-libs-0:1.4.20-29.el6_10.1.x86_64", "product": { "name": "unbound-libs-0:1.4.20-29.el6_10.1.x86_64", "product_id": "unbound-libs-0:1.4.20-29.el6_10.1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/centos/unbound-libs@1.4.20-29.el6_10.1?arch=x86_64" } } }, { "category": "product_version", "name": "unbound-0:1.4.20-29.el6_10.1.x86_64", "product": { "name": "unbound-0:1.4.20-29.el6_10.1.x86_64", "product_id": "unbound-0:1.4.20-29.el6_10.1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/centos/unbound@1.4.20-29.el6_10.1?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "unbound-python-0:1.4.20-29.el6_10.1.i686", "product": { "name": "unbound-python-0:1.4.20-29.el6_10.1.i686", "product_id": "unbound-python-0:1.4.20-29.el6_10.1.i686", "product_identification_helper": { "purl": "pkg:rpm/centos/unbound-python@1.4.20-29.el6_10.1?arch=i686" } } }, { "category": "product_version", "name": "unbound-devel-0:1.4.20-29.el6_10.1.i686", "product": { "name": "unbound-devel-0:1.4.20-29.el6_10.1.i686", "product_id": "unbound-devel-0:1.4.20-29.el6_10.1.i686", "product_identification_helper": { "purl": "pkg:rpm/centos/unbound-devel@1.4.20-29.el6_10.1?arch=i686" } } }, { "category": "product_version", "name": "unbound-libs-0:1.4.20-29.el6_10.1.i686", "product": { "name": "unbound-libs-0:1.4.20-29.el6_10.1.i686", "product_id": "unbound-libs-0:1.4.20-29.el6_10.1.i686", "product_identification_helper": { "purl": "pkg:rpm/centos/unbound-libs@1.4.20-29.el6_10.1?arch=i686" } } }, { "category": "product_version", "name": "unbound-0:1.4.20-29.el6_10.1.i686", "product": { "name": "unbound-0:1.4.20-29.el6_10.1.i686", "product_id": "unbound-0:1.4.20-29.el6_10.1.i686", "product_identification_helper": { "purl": "pkg:rpm/centos/unbound@1.4.20-29.el6_10.1?arch=i686" } } } ], "category": "architecture", "name": "i686" } ], "category": "vendor", "name": "Red Hat, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product": { "name": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product_id": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/unbound-python@1.4.20-29.el6_10.1.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product": { "name": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product_id": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/unbound-devel@1.4.20-29.el6_10.1.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product": { "name": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product_id": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/unbound-libs@1.4.20-29.el6_10.1.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product": { "name": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product_id": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/unbound@1.4.20-29.el6_10.1.tuxcare.els2?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product": { "name": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product_id": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/unbound-python@1.4.20-29.el6_10.1.tuxcare.els2?arch=i686" } } }, { "category": "product_version", "name": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product": { "name": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product_id": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/unbound-devel@1.4.20-29.el6_10.1.tuxcare.els2?arch=i686" } } }, { "category": "product_version", "name": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product": { "name": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product_id": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/unbound-libs@1.4.20-29.el6_10.1.tuxcare.els2?arch=i686" } } }, { "category": "product_version", "name": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product": { "name": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product_id": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/unbound@1.4.20-29.el6_10.1.tuxcare.els2?arch=i686" } } } ], "category": "architecture", "name": "i686" } ], "category": "vendor", "name": "CloudLinux" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64" }, "product_reference": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-python-0:1.4.20-29.el6_10.1.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:unbound-python-0:1.4.20-29.el6_10.1.x86_64" }, "product_reference": "unbound-python-0:1.4.20-29.el6_10.1.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.i686 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.i686" }, "product_reference": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-python-0:1.4.20-29.el6_10.1.i686 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:unbound-python-0:1.4.20-29.el6_10.1.i686" }, "product_reference": "unbound-python-0:1.4.20-29.el6_10.1.i686", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.i686 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.i686" }, "product_reference": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-devel-0:1.4.20-29.el6_10.1.i686 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:unbound-devel-0:1.4.20-29.el6_10.1.i686" }, "product_reference": "unbound-devel-0:1.4.20-29.el6_10.1.i686", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64" }, "product_reference": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-devel-0:1.4.20-29.el6_10.1.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:unbound-devel-0:1.4.20-29.el6_10.1.x86_64" }, "product_reference": "unbound-devel-0:1.4.20-29.el6_10.1.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.i686 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.i686" }, "product_reference": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-libs-0:1.4.20-29.el6_10.1.i686 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:unbound-libs-0:1.4.20-29.el6_10.1.i686" }, "product_reference": "unbound-libs-0:1.4.20-29.el6_10.1.i686", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64" }, "product_reference": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-libs-0:1.4.20-29.el6_10.1.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:unbound-libs-0:1.4.20-29.el6_10.1.x86_64" }, "product_reference": "unbound-libs-0:1.4.20-29.el6_10.1.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.i686 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.i686" }, "product_reference": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-0:1.4.20-29.el6_10.1.i686 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:unbound-0:1.4.20-29.el6_10.1.i686" }, "product_reference": "unbound-0:1.4.20-29.el6_10.1.i686", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64" }, "product_reference": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-0:1.4.20-29.el6_10.1.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:unbound-0:1.4.20-29.el6_10.1.x86_64" }, "product_reference": "unbound-0:1.4.20-29.el6_10.1.x86_64", "relates_to_product_reference": "CentOS-6" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-109125", "cwe": { "id": "CWE-205", "name": "Observable Behavioral Discrepancy" }, "notes": [ { "category": "description", "text": "In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-threshold > 0' configurations (not a default configuration). If a response-like UDP datagram reaches the upstream source port currently used by a recursive query, but its TXID does not match any pending query, Unbound counts the packet as an unwanted reply. When the accumulated count reaches the configured threshold, Unbound clears the worker's RRset cache and message cache. This cache clear action does not destroy the current upstream UDP pending query. Therefore, an external observer can distinguish whether a candidate port matches the current upstream source port by checking whether an existing cached item has been cleared. This is a cache side-channel vulnerability that can be used to probe the upstream source port. Although the attack is not feasible on default configurations and the suggested value (10 million) makes it an ureliable attack on a public resolver, in scenarios where the attacker can keep a concurrent query window alive, the attacker can first filter the source port and then perform birthday-style guessing against the TXID, making cache poisoning a feasible attack path.", "title": "Vulnerability description" } ], "product_status": { "known_affected": [ "CentOS-6:unbound-0:1.4.20-29.el6_10.1.i686", "CentOS-6:unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "CentOS-6:unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "CentOS-6:unbound-0:1.4.20-29.el6_10.1.x86_64", "CentOS-6:unbound-devel-0:1.4.20-29.el6_10.1.i686", "CentOS-6:unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "CentOS-6:unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "CentOS-6:unbound-devel-0:1.4.20-29.el6_10.1.x86_64", "CentOS-6:unbound-libs-0:1.4.20-29.el6_10.1.i686", "CentOS-6:unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "CentOS-6:unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "CentOS-6:unbound-libs-0:1.4.20-29.el6_10.1.x86_64", "CentOS-6:unbound-python-0:1.4.20-29.el6_10.1.i686", "CentOS-6:unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "CentOS-6:unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "CentOS-6:unbound-python-0:1.4.20-29.el6_10.1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-109125" }, { "category": "external", "summary": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-109125.txt", "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-109125.txt" } ], "release_date": "2026-10-21T09:17:00Z", "remediations": [ { "category": "no_fix_planned", "date": "2026-10-24T11:23:21.564886Z", "details": "This vulnerability is only reachable when the non-default unwanted-reply-threshold option is explicitly set above 0; with the default (0/disabled) configuration, the cache side-channel is not present. Even when enabled, exploitation requires query access to observe cache state plus sustained delivery of response-like UDP traffic to the resolver’s current source port while a concurrent query remains active, followed by a high‑complexity birthday‑style TXID guessing phase—yielding at most a narrow cache‑poisoning avenue with no code execution. Given these prerequisites and limited impact, it can be safely deprioritized in managed enterprise VM/server deployments.", "product_ids": [ "CentOS-6:unbound-0:1.4.20-29.el6_10.1.i686", "CentOS-6:unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "CentOS-6:unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "CentOS-6:unbound-0:1.4.20-29.el6_10.1.x86_64", "CentOS-6:unbound-devel-0:1.4.20-29.el6_10.1.i686", "CentOS-6:unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "CentOS-6:unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "CentOS-6:unbound-devel-0:1.4.20-29.el6_10.1.x86_64", "CentOS-6:unbound-libs-0:1.4.20-29.el6_10.1.i686", "CentOS-6:unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "CentOS-6:unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "CentOS-6:unbound-libs-0:1.4.20-29.el6_10.1.x86_64", "CentOS-6:unbound-python-0:1.4.20-29.el6_10.1.i686", "CentOS-6:unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "CentOS-6:unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "CentOS-6:unbound-python-0:1.4.20-29.el6_10.1.x86_64" ] } ] } ] }