PT-2026-42131 · Nlnet · Unbound

Qifan Zhang · Published 2026-05-20 · Updated 2026-05-20 · CVE-2026-42944

Mitre

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Red

NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options ('nsid', 'answer-cookie', 'pad-responses' (default)) need to be enabled for the vulnerability to be exploited. An adversary who can query Unbound can exploit the vulnerability by attaching multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options to the query. A flaw in the size calculation of the EDNS field truncates the correct value which allows the encoder to overflow the available space when writing. Those two combined lead to a heap overflow write of Unbound controlled data and eventually a crash. Unbound 1.25.1 contains a patch with a fix to de-duplicate the EDNS options and a fix to prevent truncation of the EDNS field size calculation.

Fix

Memory Corruption

Weakness Enumeration

CWE-197

CWE-787

Related Identifiers

CVE-2026-42944

Affected Products

Unbound

References · 5

• https://nlnetlabs.nl/downloads/unbound/CVE-2026-42944.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42944 · Security Note
• https://twitter.com/OrangeMorishita/status/2057047743336681799 · Twitter Post
• https://twitter.com/oss_security/status/2057033378822492541 · Twitter Post
• https://twitter.com/OrangeMorishita/status/2057047822378455523 · Twitter Post