{ "document": { "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/centos6els/vex/2026/cve-2026-96405-els_os-centos6els.json" } ], "tracking": { "current_release_date": "2026-10-28T10:59:25Z", "generator": { "date": "2026-10-28T10:59:25Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2026-96405-ELS_OS-CENTOS6ELS", "initial_release_date": "2026-10-21T09:17:00Z", "revision_history": [ { "date": "2026-10-21T09:17:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-10-28T10:59:25Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "Security update on CVE-2026-96405" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Community Enterprise Operating System 6", "product": { "name": "Community Enterprise Operating System 6", "product_id": "CentOS-6", "product_identification_helper": { "cpe": "cpe:2.3:o:centos:centos:6:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Community Enterprise Operating System" }, { "branches": [ { "category": "product_version", "name": "unbound-python-0:1.4.20-29.el6_10.1.x86_64", "product": { "name": "unbound-python-0:1.4.20-29.el6_10.1.x86_64", "product_id": "unbound-python-0:1.4.20-29.el6_10.1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/centos/unbound-python@1.4.20-29.el6_10.1?arch=x86_64" } } }, { "category": "product_version", "name": "unbound-devel-0:1.4.20-29.el6_10.1.x86_64", "product": { "name": "unbound-devel-0:1.4.20-29.el6_10.1.x86_64", "product_id": "unbound-devel-0:1.4.20-29.el6_10.1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/centos/unbound-devel@1.4.20-29.el6_10.1?arch=x86_64" } } }, { "category": "product_version", "name": "unbound-libs-0:1.4.20-29.el6_10.1.x86_64", "product": { "name": "unbound-libs-0:1.4.20-29.el6_10.1.x86_64", "product_id": "unbound-libs-0:1.4.20-29.el6_10.1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/centos/unbound-libs@1.4.20-29.el6_10.1?arch=x86_64" } } }, { "category": "product_version", "name": "unbound-0:1.4.20-29.el6_10.1.x86_64", "product": { "name": "unbound-0:1.4.20-29.el6_10.1.x86_64", "product_id": "unbound-0:1.4.20-29.el6_10.1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/centos/unbound@1.4.20-29.el6_10.1?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "unbound-python-0:1.4.20-29.el6_10.1.i686", "product": { "name": "unbound-python-0:1.4.20-29.el6_10.1.i686", "product_id": "unbound-python-0:1.4.20-29.el6_10.1.i686", "product_identification_helper": { "purl": "pkg:rpm/centos/unbound-python@1.4.20-29.el6_10.1?arch=i686" } } }, { "category": "product_version", "name": "unbound-devel-0:1.4.20-29.el6_10.1.i686", "product": { "name": "unbound-devel-0:1.4.20-29.el6_10.1.i686", "product_id": "unbound-devel-0:1.4.20-29.el6_10.1.i686", "product_identification_helper": { "purl": "pkg:rpm/centos/unbound-devel@1.4.20-29.el6_10.1?arch=i686" } } }, { "category": "product_version", "name": "unbound-libs-0:1.4.20-29.el6_10.1.i686", "product": { "name": "unbound-libs-0:1.4.20-29.el6_10.1.i686", "product_id": "unbound-libs-0:1.4.20-29.el6_10.1.i686", "product_identification_helper": { "purl": "pkg:rpm/centos/unbound-libs@1.4.20-29.el6_10.1?arch=i686" } } }, { "category": "product_version", "name": "unbound-0:1.4.20-29.el6_10.1.i686", "product": { "name": "unbound-0:1.4.20-29.el6_10.1.i686", "product_id": "unbound-0:1.4.20-29.el6_10.1.i686", "product_identification_helper": { "purl": "pkg:rpm/centos/unbound@1.4.20-29.el6_10.1?arch=i686" } } } ], "category": "architecture", "name": "i686" } ], "category": "vendor", "name": "Red Hat, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product": { "name": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product_id": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/unbound-python@1.4.20-29.el6_10.1.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product": { "name": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product_id": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/unbound-devel@1.4.20-29.el6_10.1.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product": { "name": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product_id": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/unbound-libs@1.4.20-29.el6_10.1.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product": { "name": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product_id": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/unbound@1.4.20-29.el6_10.1.tuxcare.els2?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product": { "name": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product_id": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/unbound-python@1.4.20-29.el6_10.1.tuxcare.els2?arch=i686" } } }, { "category": "product_version", "name": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product": { "name": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product_id": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/unbound-devel@1.4.20-29.el6_10.1.tuxcare.els2?arch=i686" } } }, { "category": "product_version", "name": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product": { "name": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product_id": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/unbound-libs@1.4.20-29.el6_10.1.tuxcare.els2?arch=i686" } } }, { "category": "product_version", "name": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product": { "name": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product_id": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/unbound@1.4.20-29.el6_10.1.tuxcare.els2?arch=i686" } } } ], "category": "architecture", "name": "i686" } ], "category": "vendor", "name": "CloudLinux" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64" }, "product_reference": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-python-0:1.4.20-29.el6_10.1.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:unbound-python-0:1.4.20-29.el6_10.1.x86_64" }, "product_reference": "unbound-python-0:1.4.20-29.el6_10.1.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.i686 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.i686" }, "product_reference": "unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-python-0:1.4.20-29.el6_10.1.i686 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:unbound-python-0:1.4.20-29.el6_10.1.i686" }, "product_reference": "unbound-python-0:1.4.20-29.el6_10.1.i686", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.i686 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.i686" }, "product_reference": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-devel-0:1.4.20-29.el6_10.1.i686 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:unbound-devel-0:1.4.20-29.el6_10.1.i686" }, "product_reference": "unbound-devel-0:1.4.20-29.el6_10.1.i686", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64" }, "product_reference": "unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-devel-0:1.4.20-29.el6_10.1.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:unbound-devel-0:1.4.20-29.el6_10.1.x86_64" }, "product_reference": "unbound-devel-0:1.4.20-29.el6_10.1.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.i686 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.i686" }, "product_reference": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-libs-0:1.4.20-29.el6_10.1.i686 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:unbound-libs-0:1.4.20-29.el6_10.1.i686" }, "product_reference": "unbound-libs-0:1.4.20-29.el6_10.1.i686", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64" }, "product_reference": "unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-libs-0:1.4.20-29.el6_10.1.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:unbound-libs-0:1.4.20-29.el6_10.1.x86_64" }, "product_reference": "unbound-libs-0:1.4.20-29.el6_10.1.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.i686 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.i686" }, "product_reference": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-0:1.4.20-29.el6_10.1.i686 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:unbound-0:1.4.20-29.el6_10.1.i686" }, "product_reference": "unbound-0:1.4.20-29.el6_10.1.i686", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64" }, "product_reference": "unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "unbound-0:1.4.20-29.el6_10.1.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:unbound-0:1.4.20-29.el6_10.1.x86_64" }, "product_reference": "unbound-0:1.4.20-29.el6_10.1.x86_64", "relates_to_product_reference": "CentOS-6" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-96405", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "description", "text": "NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious actor with recursive-query access and control of an ordinarily delegated authority that serves specially crafted replies can exploit the vulnerability and degrade Unbound's general performance.", "title": "Vulnerability description" } ], "product_status": { "known_affected": [ "CentOS-6:unbound-0:1.4.20-29.el6_10.1.i686", "CentOS-6:unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "CentOS-6:unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "CentOS-6:unbound-0:1.4.20-29.el6_10.1.x86_64", "CentOS-6:unbound-devel-0:1.4.20-29.el6_10.1.i686", "CentOS-6:unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "CentOS-6:unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "CentOS-6:unbound-devel-0:1.4.20-29.el6_10.1.x86_64", "CentOS-6:unbound-libs-0:1.4.20-29.el6_10.1.i686", "CentOS-6:unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "CentOS-6:unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "CentOS-6:unbound-libs-0:1.4.20-29.el6_10.1.x86_64", "CentOS-6:unbound-python-0:1.4.20-29.el6_10.1.i686", "CentOS-6:unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "CentOS-6:unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "CentOS-6:unbound-python-0:1.4.20-29.el6_10.1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-96405" }, { "category": "external", "summary": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-96405.txt", "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-96405.txt" } ], "release_date": "2026-10-21T09:17:00Z", "remediations": [ { "category": "no_fix_planned", "date": "2026-10-24T11:23:21.948259Z", "details": "Deprioritize: exploitation requires both recursive‑query access to the resolver and control of a delegated authoritative zone to return specially crafted chained compression pointers; by default Unbound only permits recursion from localhost, so untrusted clients cannot trigger it unless administrators explicitly broaden access. The issue only degrades performance (availability only) with no confidentiality or integrity impact, and it carries high attack complexity relative to the limited effect. In centrally managed VM/server deployments where resolvers are internal-facing or access-restricted, the practical exploitability is low.", "product_ids": [ "CentOS-6:unbound-0:1.4.20-29.el6_10.1.i686", "CentOS-6:unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "CentOS-6:unbound-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "CentOS-6:unbound-0:1.4.20-29.el6_10.1.x86_64", "CentOS-6:unbound-devel-0:1.4.20-29.el6_10.1.i686", "CentOS-6:unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "CentOS-6:unbound-devel-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "CentOS-6:unbound-devel-0:1.4.20-29.el6_10.1.x86_64", "CentOS-6:unbound-libs-0:1.4.20-29.el6_10.1.i686", "CentOS-6:unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "CentOS-6:unbound-libs-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "CentOS-6:unbound-libs-0:1.4.20-29.el6_10.1.x86_64", "CentOS-6:unbound-python-0:1.4.20-29.el6_10.1.i686", "CentOS-6:unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.i686", "CentOS-6:unbound-python-0:1.4.20-29.el6_10.1.tuxcare.els2.x86_64", "CentOS-6:unbound-python-0:1.4.20-29.el6_10.1.x86_64" ] } ] } ] }