Amazon Linux 2 (EOS) Security Advisory: ALAS2UNBOUND-1.17-2026-012
Advisory Released Date: 2026-10-14
Advisory Updated Date: 2026-10-14
FAQs regarding Amazon Linux ALAS/CVE Severity
Amazon Linux–vended DNS resolvers shipped with an older DNSSEC root signing key. For hosts configured with DNSSEC validation enabled, this could result in DNS resolution failures, including for names in unsigned zones. This applies where the resolver is still using the trust anchor shipped in the package; resolvers that already picked up the new root key via RFC 5011 are unaffected.
On 11 October 2026 at 14:00 UTC the DNS root zone began signing with KSK-2024 (key tag 38696), replacing KSK-2017 (key tag 20326). The packaged trust anchor files contained only KSK-2017, so an affected resolver cannot validate the root DNSKEY RRset and returns SERVFAIL.
The updated packages include an updated root signing key.
Affected Packages:
unbound
Note:
This advisory is applicable to Amazon Linux 2 - Unbound-1.17 Extra. Visit this page to learn more about Amazon Linux 2 (AL2) Extras and this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update unbound or yum update --advisory ALAS2UNBOUND-1.17-2026-012 to update your system.
aarch64:
unbound-1.17.0-2.amzn2.0.15.aarch64
unbound-devel-1.17.0-2.amzn2.0.15.aarch64
unbound-libs-1.17.0-2.amzn2.0.15.aarch64
unbound-anchor-1.17.0-2.amzn2.0.15.aarch64
unbound-utils-1.17.0-2.amzn2.0.15.aarch64
python2-unbound-1.17.0-2.amzn2.0.15.aarch64
python3-unbound-1.17.0-2.amzn2.0.15.aarch64
unbound-debuginfo-1.17.0-2.amzn2.0.15.aarch64
src:
unbound-1.17.0-2.amzn2.0.15.src
x86_64:
unbound-1.17.0-2.amzn2.0.15.x86_64
unbound-devel-1.17.0-2.amzn2.0.15.x86_64
unbound-libs-1.17.0-2.amzn2.0.15.x86_64
unbound-anchor-1.17.0-2.amzn2.0.15.x86_64
unbound-utils-1.17.0-2.amzn2.0.15.x86_64
python2-unbound-1.17.0-2.amzn2.0.15.x86_64
python3-unbound-1.17.0-2.amzn2.0.15.x86_64
unbound-debuginfo-1.17.0-2.amzn2.0.15.x86_64