AI analysis
NLnet Labs Unbound up to and including 1.26.0 contains a heap buffer overflow (CWE-122) in its DNS response processing. The flaw is triggered when CNAME synthesis during an upstream response forces the resolver to rewrite a max TTL value in the packet buffer; a compression pointer that points to the overwritten value invalidates the domain name, sending processing down an error path that does not properly advance the buffer position and overflows the heap. Because exploitation depends heavily on heap memory layout, the realistic outcome is progressive heap corruption that eventually crashes the resolver, but on specific systems and compilation options it could enable remote code execution. Any operator running Unbound 1.26.0 or earlier, including resolvers embedded in distributions, appliances, and ISP infrastructure, is affected. No public proof-of-concept is known, the issue is not in CISA's KEV, and no exploitation has been reported.
What to do: Upgrade all Unbound deployments to the first release published after 1.26.0 (verify the fixed version in NLnet Labs' advisory) as soon as it is available. Interim mitigations include restricting recursion to trusted clients and treating any unexpected resolver crashes as potentially related. Note that per the vendor, remote code execution requires specific heap layouts and compilation options, so denial of service via resolver crash is the more likely impact.
Affected
| NLnet Labs Unbound | all versions up to and including 1.26.0 |
Estimated exposure
massmillions of deployments overall, with hundreds of thousands of Unbound resolver instances visible in public internet scans — Unbound is one of the most widely deployed open-source recursive/caching DNS resolvers, bundled as the default local resolver in several OS distributions and used by ISPs and enterprises, and internet-wide port-53 scans routinely show…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.