Amazon Linux 2023 Security Advisory: ALAS2023-2026-3222
Advisory Released Date: 2026-10-14
Advisory Updated Date: 2026-10-14
Severity:
Important
References:
FAQs regarding Amazon Linux ALAS/CVE Severity
FAQs regarding Amazon Linux ALAS/CVE Severity
Issue Overview:
Amazon Linux–vended DNS resolvers shipped with an older DNSSEC root signing key. For hosts configured with DNSSEC validation enabled, this could result in DNS resolution failures, including for names in unsigned zones. This applies where the resolver is still using the trust anchor shipped in the package; resolvers that already picked up the new root key via RFC 5011 are unaffected.
On 11 October 2026 at 14:00 UTC the DNS root zone began signing with KSK-2024 (key tag 38696), replacing KSK-2017 (key tag 20326). The packaged trust anchor files contained only KSK-2017, so an affected resolver cannot validate the root DNSKEY RRset and returns SERVFAIL.
The updated packages include an updated root signing key.
Affected Packages:
unbound
Issue Correction:
Run dnf update unbound --releasever 2023.12.20261013 or dnf update --advisory ALAS2023-2026-3222 --releasever 2023.12.20261013 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
New Packages:
aarch64:
unbound-debugsource-1.17.1-1.amzn2023.0.16.aarch64
unbound-utils-debuginfo-1.17.1-1.amzn2023.0.16.aarch64
unbound-debuginfo-1.17.1-1.amzn2023.0.16.aarch64
python3-unbound-debuginfo-1.17.1-1.amzn2023.0.16.aarch64
unbound-anchor-1.17.1-1.amzn2023.0.16.aarch64
unbound-anchor-debuginfo-1.17.1-1.amzn2023.0.16.aarch64
python3-unbound-1.17.1-1.amzn2023.0.16.aarch64
unbound-libs-debuginfo-1.17.1-1.amzn2023.0.16.aarch64
unbound-1.17.1-1.amzn2023.0.16.aarch64
unbound-libs-1.17.1-1.amzn2023.0.16.aarch64
unbound-devel-1.17.1-1.amzn2023.0.16.aarch64
unbound-utils-1.17.1-1.amzn2023.0.16.aarch64
src:
unbound-1.17.1-1.amzn2023.0.16.src
x86_64:
python3-unbound-debuginfo-1.17.1-1.amzn2023.0.16.x86_64
unbound-debuginfo-1.17.1-1.amzn2023.0.16.x86_64
unbound-libs-debuginfo-1.17.1-1.amzn2023.0.16.x86_64
unbound-anchor-debuginfo-1.17.1-1.amzn2023.0.16.x86_64
python3-unbound-1.17.1-1.amzn2023.0.16.x86_64
unbound-utils-1.17.1-1.amzn2023.0.16.x86_64
unbound-debugsource-1.17.1-1.amzn2023.0.16.x86_64
unbound-libs-1.17.1-1.amzn2023.0.16.x86_64
unbound-utils-debuginfo-1.17.1-1.amzn2023.0.16.x86_64
unbound-1.17.1-1.amzn2023.0.16.x86_64
unbound-anchor-1.17.1-1.amzn2023.0.16.x86_64
unbound-devel-1.17.1-1.amzn2023.0.16.x86_64