Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone

NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code execution as a result of deep copying a data structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-copies response messages to preserve them across memory region teardown. A struct-assignment bug overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep copying the data structure.

NLnetLabs Unbound versions 1.20.0 through 1.26.0 contain a flaw on the 'serve-expired' code path that double-decrements the per-client-IP 'wait-limit' counter, one of the countermeasures introduced against the DNSBomb amplification issue (CVE-2024-33655). An attacker who controls an authoritative zone with a short TTL alternates 'slow' queries that the attacker's authoritative server never answers with 'pump' queries for expired cached names, which are answered immediately via serve-expired and decrement the counter twice. By repeating this pattern, the attacker keeps the per-client counter at or below the configured wait-limit indefinitely and can accumulate an arbitrary number of pending queries from a single source IP, up to the global mesh quota (num-queries-per-thread). This undermines a DNSBomb defense and erodes resolver availability; the flaw is rated CVSS 3.7 (low), with network vector, high attack complexity, and low availability-only impact. Any operator running Unbound 1.20.0-1.26.0 is exposed, most critically recursive resolvers with serve-expired enabled; no public PoC is known, it is not in CISA KEV, and no exploitation has been reported.

Do: Upgrade to an NLnet Labs Unbound release newer than 1.26.0 that addresses CVE-2026-77860 as soon as one is available. As an interim mitigation, disable serve-expired ('serve-expired: no') since the flaw lives entirely on that code path, and review wait-limit and num-queries-per-thread settings. Monitor resolver logs for a single source IP alternating never-answered 'slow' queries with queries for expired cached names; note this is a separate, low-severity issue from the Unbound DNSSEC validator RCE reported in recent headlines.

NLnet Labs Unbound versions 1.13.2 through 1.26.1 contain a data-authenticity flaw (CWE-345) in the ZONEMD integrity check for configured zones (zonemd-check set to yes) that sit below, but not at, a DNSSEC trust anchor. Because the DS/DNSKEY lookups required for ZONEMD validation happen asynchronously, there is an attack window in which tampered zone contents are served to clients or written to a configured zonefile before verification completes; if such a zonefile is written while the check failed, the tampered data are reloaded on startup and served until verification concludes again, and even after a failed check the data persist on disk for future reloads. An attacker positioned to tamper with the zone source data can therefore have bogus DNS records accepted by clients, yielding high integrity impact but no confidentiality or availability impact; the official CVSS 3.1 score is 4.4 medium (AV:N/AC:H/PR:H/UI:N). Only operators running Unbound authoritative-style (auth-zone) configurations with ZONEMD checking enabled for subordinate zones are affected. No public proof-of-concept or known exploitation exists, and although one headline calls it a critical RCE flaw, the vendor's own scoring describes an integrity issue, not code execution.

Do: Upgrade all Unbound instances to a release newer than 1.26.1, per NLnet Labs' advisory for CVE-2026-77955. As an interim mitigation, disable ZONEMD checking (set zonemd-check to no) for zones below a trust anchor, and audit any configured zonefiles for tampered data written during failed verification, deleting them so they are not reloaded at startup.

NLnet Labs Unbound 1.22.0 through 1.26.1, when compiled for DNS-over-QUIC with '--with-libngtcp2', contains a use-after-free (CWE-416) in DoQ stream handling: ngtcp2's retransmission buffer keeps a shallow pointer into the per-stream output buffer holding the DNS response, and a client RESET_STREAM frees that buffer while the retransmission entries persist. When the next PTO (probe timeout) fires, ngtcp2 re-encodes the outstanding STREAM frame by copying from the freed buffer. An unauthenticated attacker who can query the resolver over DoQ triggers this simply by withholding ACKs, sending RESET_STREAM, and waiting for PTO; a spray of roughly 20 such queries can cause an abnormal server exit (denial of service), and the CVSS confidentiality score of High reflects possible leakage of freed heap memory into retransmitted packets. Only operators running Unbound 1.22.0–1.26.1 with DoQ support compiled in and enabled are affected; deployments without libngtcp2/DoQ are not exposed to this flaw. No public proof-of-concept is known and the issue is not on CISA KEV; it is also distinct from recent headlines about a separate Unbound DNSSEC validator flaw.

Do: Upgrade Unbound to the patched release from NLnet Labs as soon as it is available (anything beyond 1.26.1 after confirming the fix in the release notes/advisory). As interim mitigations, disable DoQ listeners or rebuild without '--with-libngtcp2', and restrict DoQ access (network ACLs, firewall) to trusted clients. Check your build configuration and whether UDP/QUIC DoQ endpoints are exposed externally, and monitor resolver processes for abnormal restarts.

NLnetLabs Unbound up to and including 1.26.0 has a degradation-of-service flaw in its TCP and DNS-over-TLS (DoT) reading procedure, which performs consecutive reads from a connection without any limit (CWE-770). An attacker who opens a TCP/DoT connection and continuously streams queries for distinct, uncached names faster than the server can write responses can monopolize a single worker's entire event loop for as long as its writes stay ahead of the drain. The attacker gains the ability to slow or stall DNS resolution handled by that worker, degrading availability only (CVSS 5.3, availability impact low, no confidentiality or integrity impact). All Unbound deployments with TCP or DoT service enabled are affected, including the many ISP, enterprise and firewall/router-bundled instances. No public proof-of-concept or known in-the-wild exploitation has been reported, and the issue is not on CISA's KEV list.

Do: Upgrade all Unbound instances to the first release after 1.26.0 as published by NLnetLabs (check the NLnetLabs advisory for the fixed version). As an interim mitigation, restrict which clients can reach the TCP/53 and DoT (853) listeners using access-control rules or firewall policy, and limit queries or connections per client where supported. Operators should monitor per-worker CPU and DNS response latency for signs of a single connection monopolizing an event loop.

NLnet Labs Unbound, up to and including version 1.26.0, contains a heap buffer overflow (CWE-122) in its RRSet canonicalisation routine, where the buffer length check fails to include the first owner name. The flaw is triggered when the resolver processes a maximum-length (255-character) query name together with a large DNS response received over TCP, causing the heap buffer to overflow. A malicious actor operating a hostile authoritative name server, or an attacker able to tamper with a DNS response in transit, can trigger the condition; because canonicalisation happens before DNSSEC validation, DNSSEC does not protect affected deployments. Per the CVSS vector, the impact is availability: the resolver process can crash, producing denial of service for the clients and networks that depend on it. Anyone running Unbound as a recursive resolver or caching forwarder at version 1.26.0 or earlier is affected; no public proof-of-concept or confirmed in-the-wild exploitation is currently known.

Do: Upgrade Unbound to a release newer than 1.26.0 as soon as NLnet Labs publishes the patched version, and monitor the vendor's advisory page for the exact fixed release. Because exploitation requires a malicious authoritative name server or an on-path attacker tampering with responses, treat upstream DNS traffic as untrusted in threat models and watch for unexplained resolver crashes or restarts as an indicator of attempted exploitation. Note that enabling or relying on DNSSEC validation does not mitigate this issue, since canonicalisation occurs before validation.

Unbound, NLnet Labs' widely used validating recursive DNS resolver, contains a buffer overflow (CWE-122) in the DNSSEC validator's DNSKEY digesting routine. A crafted DNSKEY record whose owner name uses a compression pointer back into its own RDATA overflows the digest buffer while the resolver is validating the zone. An attacker who controls a malicious authoritative zone and can cause a vulnerable Unbound resolver to query it can crash the service (denial of service) and, using attacker-controlled data, potentially achieve remote code execution on the resolver host. All Unbound deployments up to and including version 1.26.0 that perform DNSSEC validation are affected. No public proof-of-concept or confirmed in-the-wild exploitation is currently known, and the issue is not in CISA's KEV catalog.

Do: Upgrade Unbound to the patched release announced by NLnet Labs (any version beyond 1.26.0 containing the fix) as soon as it is available, and confirm the running version with 'unbound -V'. Until patching, restrict recursion to trusted clients, monitor NLnet Labs' advisory for fixed versions and workarounds, and treat unexplained resolver crashes or restarts as suspicious.

NLnet Labs Unbound up to and including 1.26.0 contains a heap buffer overflow (CWE-122) in its DNS response processing. The flaw is triggered when CNAME synthesis during an upstream response forces the resolver to rewrite a max TTL value in the packet buffer; a compression pointer that points to the overwritten value invalidates the domain name, sending processing down an error path that does not properly advance the buffer position and overflows the heap. Because exploitation depends heavily on heap memory layout, the realistic outcome is progressive heap corruption that eventually crashes the resolver, but on specific systems and compilation options it could enable remote code execution. Any operator running Unbound 1.26.0 or earlier, including resolvers embedded in distributions, appliances, and ISP infrastructure, is affected. No public proof-of-concept is known, the issue is not in CISA's KEV, and no exploitation has been reported.

Do: Upgrade all Unbound deployments to the first release published after 1.26.0 (verify the fixed version in NLnet Labs' advisory) as soon as it is available. Interim mitigations include restricting recursion to trusted clients and treating any unexpected resolver crashes as potentially related. Note that per the vendor, remote code execution requires specific heap layouts and compilation options, so denial of service via resolver crash is the more likely impact.

NLnet Labs Unbound versions 1.12.0 through 1.26.0 contain a use-after-free (CWE-416) in the DNS-over-HTTPS code path, but only when the binary was compiled with the '--with-libnghttp2' option. When a failure occurs on one DoH stream - such as an RPZ rule dropping a query or session jostling under heavy client traffic - the entire DoH session is torn down without properly accounting for the other streams in that session, resulting in use-after-free accesses. An attacker who can satisfy the prerequisites (an RPZ drop rule in place or heavy client traffic) can trigger the flaw with a single DoH connection and appropriate traffic; the reads are not attacker-controlled and typically lead only to early returns, but a hardened allocator can detect the invalid access and deliberately terminate the process, causing denial of service. Only operators running DoH-enabled Unbound builds are affected, and confidentiality and integrity are not impacted. No public proof-of-concept or in-the-wild exploitation is known and the flaw is not in CISA KEV; it is distinct from the separately headlined Unbound DNSSEC validator RCE issue.

Do: Check whether your unbound binary was built with '--with-libnghttp2' (visible via 'unbound -V'); if so, upgrade to the newest NLnet Labs release after 1.26.0 that contains the fix. As interim mitigation, avoid RPZ 'drop' actions on DoH-facing instances or terminate DoH in a front-end proxy in front of unbound, and run unbound under a supervisor (e.g., systemd with automatic restart) so a triggered crash results only in a brief outage.

CVE-2026-85501 covers the 'ReTrap' class of algorithmic complexity attacks against DNSSEC validation in NLnet Labs Unbound up to and including 1.26.0, where maliciously crafted DNS data forces the resolver into disproportionately expensive validation work. An attacker who controls a zone (or can make a client trigger lookups into one) can abuse several mechanisms: TagTrap (floods of mismatched DNSKEY, RRSIG and DS records against the (Zone, Algo, KeyTag) matching logic), DelegationTrap (deeply nested domains that require iterative DNSKEY/DS validation from the root downward), NsecTrap (large numbers of invalid NSEC records that each must be validated), and AdditionalTrap (Unbound by default validates the ADDITIONAL section, which can be padded to waste validation resources). The result is CPU/resource exhaustion and degraded DNS resolution, i.e., denial of service; the assigned CVSS 5.3 (AV:N/AC:L/PR:N/UI:N, A:L) indicates no confidentiality or integrity impact. Any Unbound deployment performing DNSSEC validation is affected, including ISP, enterprise and OS-bundled resolvers. No public proof-of-concept or confirmed in-the-wild exploitation is known and it is not in CISA KEV; note that some media coverage describes a critical/RCE Unbound flaw, but the documented impact for this CVE is availability only.

Do: Upgrade Unbound to a release newer than 1.26.0 once NLnet Labs publishes the patched version, and check the vendor advisory for the exact fixed release. Interim mitigations: restrict recursion (access-control) to trusted clients, apply query/response rate limiting, and consider disabling validation of the ADDITIONAL section if operationally feasible; only resolvers with DNSSEC validation enabled are affected. Monitor resolver CPU and query patterns for signs of complexity-based DoS.