Heap buffer overflow in NLnet Labs Unbound DNSKEY digesting enables DoS and RCE
Unbound, NLnet Labs' widely used validating recursive DNS resolver, contains a buffer overflow (CWE-122) in the DNSSEC validator's DNSKEY digesting routine. A crafted DNSKEY record whose owner name uses a compression pointer back into its own RDATA overflows the digest buffer while the resolver is validating the zone. An attacker who controls a malicious authoritative zone and can cause a vulnerable Unbound resolver to query it can crash the service (denial of service) and, using attacker-controlled data, potentially achieve remote code execution on the resolver host. All Unbound deployments up to and including version 1.26.0 that perform DNSSEC validation are affected. No public proof-of-concept or confirmed in-the-wild exploitation is currently known, and the issue is not in CISA's KEV catalog.
· NLnet Labs Unbound up to and including 1.26.0mass
NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code
NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code execution as a result of deep copying a data structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-copies response messages to preserve them across memory region teardown. A…
· nlnetlabs unbound—
Heap Buffer Overflow in NLnet Labs Unbound DNS Resolver May Lead to RCE
NLnet Labs Unbound up to and including 1.26.0 contains a heap buffer overflow (CWE-122) in its DNS response processing. The flaw is triggered when CNAME synthesis during an upstream response forces the resolver to rewrite a max TTL value in the packet buffer; a compression pointer that points to the overwritten value invalidates the domain name, sending processing down an error path that does not properly advance the buffer position and overflows the heap. Because exploitation depends heavily on heap memory layout, the realistic outcome is progressive heap corruption that eventually crashes the resolver, but on specific systems and compilation options it could enable remote code execution. Any operator running Unbound 1.26.0 or earlier, including resolvers embedded in distributions, appliances, and ISP infrastructure, is affected. No public proof-of-concept is known, the issue is not in CISA's KEV, and no exploitation has been reported.
· NLnet Labs Unbound all versions up to and including 1.26.0mass
Heap Buffer Overflow in NLnet Labs Unbound DNS Resolver via Crafted DNS Responses
NLnet Labs Unbound, up to and including version 1.26.0, contains a heap buffer overflow (CWE-122) in its RRSet canonicalisation routine, where the buffer length check fails to include the first owner name. The flaw is triggered when the resolver processes a maximum-length (255-character) query name together with a large DNS response received over TCP, causing the heap buffer to overflow. A malicious actor operating a hostile authoritative name server, or an attacker able to tamper with a DNS response in transit, can trigger the condition; because canonicalisation happens before DNSSEC validation, DNSSEC does not protect affected deployments. Per the CVSS vector, the impact is availability: the resolver process can crash, producing denial of service for the clients and networks that depend on it. Anyone running Unbound as a recursive resolver or caching forwarder at version 1.26.0 or earlier is affected; no public proof-of-concept or confirmed in-the-wild exploitation is currently known.
· NLnet Labs Unbound up to and including 1.26.0mass
Use-after-free in NLnet Labs Unbound DNS-over-QUIC (DoQ) enables remote crash
NLnet Labs Unbound 1.22.0 through 1.26.1, when compiled for DNS-over-QUIC with '--with-libngtcp2', contains a use-after-free (CWE-416) in DoQ stream handling: ngtcp2's retransmission buffer keeps a shallow pointer into the per-stream output buffer holding the DNS response, and a client RESET_STREAM frees that buffer while the retransmission entries persist. When the next PTO (probe timeout) fires, ngtcp2 re-encodes the outstanding STREAM frame by copying from the freed buffer. An unauthenticated attacker who can query the resolver over DoQ triggers this simply by withholding ACKs, sending RESET_STREAM, and waiting for PTO; a spray of roughly 20 such queries can cause an abnormal server exit (denial of service), and the CVSS confidentiality score of High reflects possible leakage of freed heap memory into retransmitted packets. Only operators running Unbound 1.22.0–1.26.1 with DoQ support compiled in and enabled are affected; deployments without libngtcp2/DoQ are not exposed to this flaw. No public proof-of-concept is known and the issue is not on CISA KEV; it is also distinct from recent headlines about a separate Unbound DNSSEC validator flaw.
· NLnet Labs Unbound (DNS-over-QUIC builds, compiled with --with-libngtcp2) 1.22.0 through and including 1.26.1large
Use-After-Free in NLnet Labs Unbound DNS-over-HTTPS Can Crash Resolver
NLnet Labs Unbound versions 1.12.0 through 1.26.0 contain a use-after-free (CWE-416) in the DNS-over-HTTPS code path, but only when the binary was compiled with the '--with-libnghttp2' option. When a failure occurs on one DoH stream - such as an RPZ rule dropping a query or session jostling under heavy client traffic - the entire DoH session is torn down without properly accounting for the other streams in that session, resulting in use-after-free accesses. An attacker who can satisfy the prerequisites (an RPZ drop rule in place or heavy client traffic) can trigger the flaw with a single DoH connection and appropriate traffic; the reads are not attacker-controlled and typically lead only to early returns, but a hardened allocator can detect the invalid access and deliberately terminate the process, causing denial of service. Only operators running DoH-enabled Unbound builds are affected, and confidentiality and integrity are not impacted. No public proof-of-concept or in-the-wild exploitation is known and the flaw is not in CISA KEV; it is distinct from the separately headlined Unbound DNSSEC validator RCE issue.
· NLnet Labs Unbound 1.12.0 through 1.26.0 (inclusive), when compiled with '--with-libnghttp2' for DNS-over-HTTPS supportlarge
Unbounded-read DoS in NLnetLabs Unbound TCP/DoT lets one client stall a worker
NLnetLabs Unbound up to and including 1.26.0 has a degradation-of-service flaw in its TCP and DNS-over-TLS (DoT) reading procedure, which performs consecutive reads from a connection without any limit (CWE-770). An attacker who opens a TCP/DoT connection and continuously streams queries for distinct, uncached names faster than the server can write responses can monopolize a single worker's entire event loop for as long as its writes stay ahead of the drain. The attacker gains the ability to slow or stall DNS resolution handled by that worker, degrading availability only (CVSS 5.3, availability impact low, no confidentiality or integrity impact). All Unbound deployments with TCP or DoT service enabled are affected, including the many ISP, enterprise and firewall/router-bundled instances. No public proof-of-concept or known in-the-wild exploitation has been reported, and the issue is not on CISA's KEV list.
· NLnet Labs Unbound up to and including 1.26.0mass
Algorithmic Complexity DoS (ReTrap) in NLnet Labs Unbound DNSSEC Validation
CVE-2026-85501 covers the 'ReTrap' class of algorithmic complexity attacks against DNSSEC validation in NLnet Labs Unbound up to and including 1.26.0, where maliciously crafted DNS data forces the resolver into disproportionately expensive validation work. An attacker who controls a zone (or can make a client trigger lookups into one) can abuse several mechanisms: TagTrap (floods of mismatched DNSKEY, RRSIG and DS records against the (Zone, Algo, KeyTag) matching logic), DelegationTrap (deeply nested domains that require iterative DNSKEY/DS validation from the root downward), NsecTrap (large numbers of invalid NSEC records that each must be validated), and AdditionalTrap (Unbound by default validates the ADDITIONAL section, which can be padded to waste validation resources). The result is CPU/resource exhaustion and degraded DNS resolution, i.e., denial of service; the assigned CVSS 5.3 (AV:N/AC:L/PR:N/UI:N, A:L) indicates no confidentiality or integrity impact. Any Unbound deployment performing DNSSEC validation is affected, including ISP, enterprise and OS-bundled resolvers. No public proof-of-concept or confirmed in-the-wild exploitation is known and it is not in CISA KEV; note that some media coverage describes a critical/RCE Unbound flaw, but the documented impact for this CVE is availability only.
· NLnet Labs Unbound up to and including 1.26.0mass
Tampered Zone Data Served Before ZONEMD Verification in NLnet Labs Unbound
NLnet Labs Unbound versions 1.13.2 through 1.26.1 contain a data-authenticity flaw (CWE-345) in the ZONEMD integrity check for configured zones (zonemd-check set to yes) that sit below, but not at, a DNSSEC trust anchor. Because the DS/DNSKEY lookups required for ZONEMD validation happen asynchronously, there is an attack window in which tampered zone contents are served to clients or written to a configured zonefile before verification completes; if such a zonefile is written while the check failed, the tampered data are reloaded on startup and served until verification concludes again, and even after a failed check the data persist on disk for future reloads. An attacker positioned to tamper with the zone source data can therefore have bogus DNS records accepted by clients, yielding high integrity impact but no confidentiality or availability impact; the official CVSS 3.1 score is 4.4 medium (AV:N/AC:H/PR:H/UI:N). Only operators running Unbound authoritative-style (auth-zone) configurations with ZONEMD checking enabled for subordinate zones are affected. No public proof-of-concept or known exploitation exists, and although one headline calls it a critical RCE flaw, the vendor's own scoring describes an integrity issue, not code execution.
· NLnet Labs Unbound 1.13.2 up to and including 1.26.1niche
NLnetLabs Unbound serve-expired flaw bypasses DNSBomb wait-limit defense (DoS)
NLnetLabs Unbound versions 1.20.0 through 1.26.0 contain a flaw on the 'serve-expired' code path that double-decrements the per-client-IP 'wait-limit' counter, one of the countermeasures introduced against the DNSBomb amplification issue (CVE-2024-33655). An attacker who controls an authoritative zone with a short TTL alternates 'slow' queries that the attacker's authoritative server never answers with 'pump' queries for expired cached names, which are answered immediately via serve-expired and decrement the counter twice. By repeating this pattern, the attacker keeps the per-client counter at or below the configured wait-limit indefinitely and can accumulate an arbitrary number of pending queries from a single source IP, up to the global mesh quota (num-queries-per-thread). This undermines a DNSBomb defense and erodes resolver availability; the flaw is rated CVSS 3.7 (low), with network vector, high attack complexity, and low availability-only impact. Any operator running Unbound 1.20.0-1.26.0 is exposed, most critically recursive resolvers with serve-expired enabled; no public PoC is known, it is not in CISA KEV, and no exploitation has been reported.
· NLnet Labs Unbound 1.20.0 through and including 1.26.0 (serve-expired code path)mass