{"schema":"vulnpedia.research/1","cve":"CVE-2026-80225","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-80225.txt","tags":["vendor-advisory","Patch","Vendor Advisory","vendor-reference"],"source":"mitre","sourceId":"NLnet Labs","modified":"2026-09-16T08:30:04.246Z","origins":[{"source":"mitre","sourceId":"NLnet Labs","modified":"2026-09-16T08:30:04.246Z","url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-80225.txt"},{"source":"nvd","sourceId":"CVE-2026-80225","modified":"2026-09-23T19:57:08.517","url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-80225.txt"},{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-80225.txt"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-80225","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-80225"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535055","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535055"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80225","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-80225"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80225","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80225"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:68590","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://access.redhat.com/errata/RHSA-2026:68590"}]},{"source":"euvd","sourceId":"EUVD-2026-80289","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-80289","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-80289","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-80289"}]}],"packages":[],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json","productId":"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@aarch64","product":"python3-unbound-0:1.26.1-1.hum1@aarch64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:68590"},{"category":"workaround","details":"To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"53\" protocol=\"tcp\" accept'` and `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"853\" protocol=\"tcp\" accept'`. After adding rules, apply them with `firewall-cmd --reload`. Replace `<TRUSTED_NETWORK>` with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections."}],"purl":"pkg:rpm/redhat/python3-unbound@1.26.1-1.hum1?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json"}]},{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json","productId":"Red Hat Hardened Images:python3-unbound-0:1.26.1-1.hum1@x86_64","product":"python3-unbound-0:1.26.1-1.hum1@x86_64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:68590"},{"category":"workaround","details":"To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"53\" protocol=\"tcp\" accept'` and `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"853\" protocol=\"tcp\" accept'`. After adding rules, apply them with `firewall-cmd --reload`. Replace `<TRUSTED_NETWORK>` with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections."}],"purl":"pkg:rpm/redhat/python3-unbound@1.26.1-1.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json"}]},{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json","productId":"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@aarch64","product":"unbound-0:1.26.1-1.hum1@aarch64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:68590"},{"category":"workaround","details":"To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"53\" protocol=\"tcp\" accept'` and `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"853\" protocol=\"tcp\" accept'`. After adding rules, apply them with `firewall-cmd --reload`. Replace `<TRUSTED_NETWORK>` with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections."}],"purl":"pkg:rpm/redhat/unbound@1.26.1-1.hum1?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json"}]},{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json","productId":"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@src","product":"unbound-0:1.26.1-1.hum1@src as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:68590"},{"category":"workaround","details":"To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"53\" protocol=\"tcp\" accept'` and `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"853\" protocol=\"tcp\" accept'`. After adding rules, apply them with `firewall-cmd --reload`. Replace `<TRUSTED_NETWORK>` with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections."}],"purl":"pkg:rpm/redhat/unbound@1.26.1-1.hum1?arch=src&distro=hummingbird-20251124&repository_id=public-hummingbird-source-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json"}]},{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json","productId":"Red Hat Hardened Images:unbound-0:1.26.1-1.hum1@x86_64","product":"unbound-0:1.26.1-1.hum1@x86_64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:68590"},{"category":"workaround","details":"To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"53\" protocol=\"tcp\" accept'` and `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"853\" protocol=\"tcp\" accept'`. After adding rules, apply them with `firewall-cmd --reload`. Replace `<TRUSTED_NETWORK>` with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections."}],"purl":"pkg:rpm/redhat/unbound@1.26.1-1.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json"}]},{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json","productId":"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@aarch64","product":"unbound-anchor-0:1.26.1-1.hum1@aarch64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:68590"},{"category":"workaround","details":"To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"53\" protocol=\"tcp\" accept'` and `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"853\" protocol=\"tcp\" accept'`. After adding rules, apply them with `firewall-cmd --reload`. Replace `<TRUSTED_NETWORK>` with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections."}],"purl":"pkg:rpm/redhat/unbound-anchor@1.26.1-1.hum1?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json"}]},{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json","productId":"Red Hat Hardened Images:unbound-anchor-0:1.26.1-1.hum1@x86_64","product":"unbound-anchor-0:1.26.1-1.hum1@x86_64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:68590"},{"category":"workaround","details":"To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"53\" protocol=\"tcp\" accept'` and `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"853\" protocol=\"tcp\" accept'`. After adding rules, apply them with `firewall-cmd --reload`. Replace `<TRUSTED_NETWORK>` with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections."}],"purl":"pkg:rpm/redhat/unbound-anchor@1.26.1-1.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json"}]},{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json","productId":"Red Hat Hardened Images:unbound-devel-0:1.26.1-1.hum1@aarch64","product":"unbound-devel-0:1.26.1-1.hum1@aarch64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:68590"},{"category":"workaround","details":"To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"53\" protocol=\"tcp\" accept'` and `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"853\" protocol=\"tcp\" accept'`. After adding rules, apply them with `firewall-cmd --reload`. Replace `<TRUSTED_NETWORK>` with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections."}],"purl":"pkg:rpm/redhat/unbound-devel@1.26.1-1.hum1?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json"}]},{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json","productId":"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@aarch64","product":"unbound-dracut-0:1.26.1-1.hum1@aarch64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:68590"},{"category":"workaround","details":"To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"53\" protocol=\"tcp\" accept'` and `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"853\" protocol=\"tcp\" accept'`. After adding rules, apply them with `firewall-cmd --reload`. Replace `<TRUSTED_NETWORK>` with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections."}],"purl":"pkg:rpm/redhat/unbound-dracut@1.26.1-1.hum1?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json"}]},{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json","productId":"Red Hat Hardened Images:unbound-dracut-0:1.26.1-1.hum1@x86_64","product":"unbound-dracut-0:1.26.1-1.hum1@x86_64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:68590"},{"category":"workaround","details":"To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"53\" protocol=\"tcp\" accept'` and `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"853\" protocol=\"tcp\" accept'`. After adding rules, apply them with `firewall-cmd --reload`. Replace `<TRUSTED_NETWORK>` with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections."}],"purl":"pkg:rpm/redhat/unbound-dracut@1.26.1-1.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json"}]},{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json","productId":"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@aarch64","product":"unbound-libs-0:1.26.1-1.hum1@aarch64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:68590"},{"category":"workaround","details":"To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"53\" protocol=\"tcp\" accept'` and `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"853\" protocol=\"tcp\" accept'`. After adding rules, apply them with `firewall-cmd --reload`. Replace `<TRUSTED_NETWORK>` with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections."}],"purl":"pkg:rpm/redhat/unbound-libs@1.26.1-1.hum1?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json"}]},{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json","productId":"Red Hat Hardened Images:unbound-libs-0:1.26.1-1.hum1@x86_64","product":"unbound-libs-0:1.26.1-1.hum1@x86_64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:68590"},{"category":"workaround","details":"To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"53\" protocol=\"tcp\" accept'` and `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"853\" protocol=\"tcp\" accept'`. After adding rules, apply them with `firewall-cmd --reload`. Replace `<TRUSTED_NETWORK>` with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections."}],"purl":"pkg:rpm/redhat/unbound-libs@1.26.1-1.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json"}]},{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json","productId":"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms","product":"unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:68590"},{"category":"workaround","details":"To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"53\" protocol=\"tcp\" accept'` and `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"853\" protocol=\"tcp\" accept'`. After adding rules, apply them with `firewall-cmd --reload`. Replace `<TRUSTED_NETWORK>` with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections."}],"purl":"pkg:rpm/redhat/unbound-munin@1.26.1-1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json"}]},{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json","productId":"Red Hat Hardened Images:unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"unbound-munin-0:1.26.1-1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:68590"},{"category":"workaround","details":"To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"53\" protocol=\"tcp\" accept'` and `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"853\" protocol=\"tcp\" accept'`. After adding rules, apply them with `firewall-cmd --reload`. Replace `<TRUSTED_NETWORK>` with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections."}],"purl":"pkg:rpm/redhat/unbound-munin@1.26.1-1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json"}]},{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json","productId":"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@aarch64","product":"unbound-utils-0:1.26.1-1.hum1@aarch64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:68590"},{"category":"workaround","details":"To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"53\" protocol=\"tcp\" accept'` and `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"853\" protocol=\"tcp\" accept'`. After adding rules, apply them with `firewall-cmd --reload`. Replace `<TRUSTED_NETWORK>` with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections."}],"purl":"pkg:rpm/redhat/unbound-utils@1.26.1-1.hum1?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json"}]},{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json","productId":"Red Hat Hardened Images:unbound-utils-0:1.26.1-1.hum1@x86_64","product":"unbound-utils-0:1.26.1-1.hum1@x86_64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:68590"},{"category":"workaround","details":"To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"53\" protocol=\"tcp\" accept'` and `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"853\" protocol=\"tcp\" accept'`. After adding rules, apply them with `firewall-cmd --reload`. Replace `<TRUSTED_NETWORK>` with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections."}],"purl":"pkg:rpm/redhat/unbound-utils@1.26.1-1.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json"}]},{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json","productId":"red_hat_enterprise_linux_10:python3-unbound","product":"python3-unbound as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"53\" protocol=\"tcp\" accept'` and `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"853\" protocol=\"tcp\" accept'`. After adding rules, apply them with `firewall-cmd --reload`. Replace `<TRUSTED_NETWORK>` with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/python3-unbound","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json"}]},{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json","productId":"red_hat_enterprise_linux_10:unbound-anchor","product":"unbound-anchor as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"53\" protocol=\"tcp\" accept'` and `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"853\" protocol=\"tcp\" accept'`. After adding rules, apply them with `firewall-cmd --reload`. Replace `<TRUSTED_NETWORK>` with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/unbound-anchor","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json"}]},{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json","productId":"red_hat_enterprise_linux_10:unbound-dracut","product":"unbound-dracut as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"53\" protocol=\"tcp\" accept'` and `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"853\" protocol=\"tcp\" accept'`. After adding rules, apply them with `firewall-cmd --reload`. Replace `<TRUSTED_NETWORK>` with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/unbound-dracut","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json"}]},{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json","productId":"red_hat_enterprise_linux_10:unbound-utils","product":"unbound-utils as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"53\" protocol=\"tcp\" accept'` and `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"853\" protocol=\"tcp\" accept'`. After adding rules, apply them with `firewall-cmd --reload`. Replace `<TRUSTED_NETWORK>` with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/unbound-utils","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json"}]},{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json","productId":"red_hat_enterprise_linux_6:unbound","product":"unbound as a component of Red Hat Enterprise Linux 6","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"53\" protocol=\"tcp\" accept'` and `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"853\" protocol=\"tcp\" accept'`. After adding rules, apply them with `firewall-cmd --reload`. Replace `<TRUSTED_NETWORK>` with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections."},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:rpm/redhat/unbound","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json"}]},{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json","productId":"red_hat_enterprise_linux_6:unbound-libs","product":"unbound-libs as a component of Red Hat Enterprise Linux 6","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"53\" protocol=\"tcp\" accept'` and `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"853\" protocol=\"tcp\" accept'`. After adding rules, apply them with `firewall-cmd --reload`. Replace `<TRUSTED_NETWORK>` with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections."},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:rpm/redhat/unbound-libs","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json"}]},{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json","productId":"red_hat_enterprise_linux_6:unbound.src","product":"unbound.src as a component of Red Hat Enterprise Linux 6","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"53\" protocol=\"tcp\" accept'` and `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"853\" protocol=\"tcp\" accept'`. After adding rules, apply them with `firewall-cmd --reload`. Replace `<TRUSTED_NETWORK>` with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections."},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:rpm/redhat/unbound?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json"}]},{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json","productId":"red_hat_enterprise_linux_7:unbound-devel","product":"unbound-devel as a component of Red Hat Enterprise Linux 7","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"53\" protocol=\"tcp\" accept'` and `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"853\" protocol=\"tcp\" accept'`. After adding rules, apply them with `firewall-cmd --reload`. Replace `<TRUSTED_NETWORK>` with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/unbound-devel","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json"}]},{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json","productId":"red_hat_enterprise_linux_7:unbound-python","product":"unbound-python as a component of Red Hat Enterprise Linux 7","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"53\" protocol=\"tcp\" accept'` and `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"853\" protocol=\"tcp\" accept'`. After adding rules, apply them with `firewall-cmd --reload`. Replace `<TRUSTED_NETWORK>` with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/unbound-python","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json"}]},{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json","productId":"red_hat_enterprise_linux_8:python3-unbound","product":"python3-unbound as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"53\" protocol=\"tcp\" accept'` and `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"853\" protocol=\"tcp\" accept'`. After adding rules, apply them with `firewall-cmd --reload`. Replace `<TRUSTED_NETWORK>` with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/python3-unbound","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json"}]},{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json","productId":"red_hat_enterprise_linux_8:unbound-devel","product":"unbound-devel as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"53\" protocol=\"tcp\" accept'` and `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"853\" protocol=\"tcp\" accept'`. After adding rules, apply them with `firewall-cmd --reload`. Replace `<TRUSTED_NETWORK>` with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/unbound-devel","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json"}]},{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json","productId":"red_hat_enterprise_linux_8:unbound.src","product":"unbound.src as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"53\" protocol=\"tcp\" accept'` and `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"853\" protocol=\"tcp\" accept'`. After adding rules, apply them with `firewall-cmd --reload`. Replace `<TRUSTED_NETWORK>` with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/unbound?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json"}]},{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json","productId":"red_hat_enterprise_linux_9:unbound","product":"unbound as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"53\" protocol=\"tcp\" accept'` and `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"853\" protocol=\"tcp\" accept'`. After adding rules, apply them with `firewall-cmd --reload`. Replace `<TRUSTED_NETWORK>` with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/unbound","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json"}]},{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json","productId":"red_hat_enterprise_linux_9:unbound-dracut","product":"unbound-dracut as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"53\" protocol=\"tcp\" accept'` and `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"853\" protocol=\"tcp\" accept'`. After adding rules, apply them with `firewall-cmd --reload`. Replace `<TRUSTED_NETWORK>` with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/unbound-dracut","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json"}]},{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json","productId":"red_hat_enterprise_linux_9:unbound.src","product":"unbound.src as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"53\" protocol=\"tcp\" accept'` and `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"853\" protocol=\"tcp\" accept'`. After adding rules, apply them with `firewall-cmd --reload`. Replace `<TRUSTED_NETWORK>` with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/unbound?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json"}]},{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json","productId":"red_hat_openshift_container_platform_4:openshift/ose-rhel-coreos-9","product":"openshift/ose-rhel-coreos-9 as a component of Red Hat OpenShift Container Platform 4","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, restrict network access to the Unbound DNS resolver to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Unbound service ports (e.g., TCP port 53 for DNS over TCP, TCP port 853 for DNS over TLS). For example, using `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"53\" protocol=\"tcp\" accept'` and `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_NETWORK>\" port port=\"853\" protocol=\"tcp\" accept'`. After adding rules, apply them with `firewall-cmd --reload`. Replace `<TRUSTED_NETWORK>` with the IP address or network range of trusted clients. Reloading firewall rules may temporarily interrupt network connections."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/ose-rhel-coreos-9@4.22.9.8.202609081748-0?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-9","origins":[{"source":"redhat","sourceId":"CVE-2026-80225","modified":"2026-09-23T20:29:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80225.json"}]}],"vendorCoverage":{"total":48,"shown":32,"omitted":16,"source":"redhat"}}