PT-2026-42135 · Nlnet+3 · Unbound+3

Qifan Zhang · Published 2026-05-20 · Updated 2026-06-18 · CVE-2026-44608

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.14.0 through 1.25.0

Description A locking inconsistency occurs when specific conditions are met: the system is multi-threaded, an RPZ (Response Policy Zone) XFR (Zone Transfer) reload is performed, and an RPZ zone contains rpz-nsip or rpz-nsdname triggers. If an XFR occurs while another thread is reading the RPZ zone, the reader may not hold the lock sufficiently, allowing the thread applying the XFR to free objects that the reader is accessing. This leads to a heap use-after-free (a situation where a program continues to use a pointer after it has been freed), which can result in a crash. Local RPZ files do not trigger this issue.

Recommendations Update to version 1.25.1.

Fix

DoS

Weakness Enumeration

CWE-413

Related Identifiers

CVE-2026-44608

ECHO-28D0-99D8-D11D

OPENSUSE-SU-2026:10903-1

OPENSUSE-SU-2026:21083-1

SUSE-SU-2026:21874-1

SUSE-SU-2026:21913-1

SUSE-SU-2026:22160-1

SUSE-SU-2026:22213-1

SUSE-SU-2026:2281-1

SUSE-SU-2026:2369-1

USN-8282-1

Affected Products

Freebsd

Linuxmint

Ubuntu

Unbound

References · 58

• https://osv.dev/vulnerability/SUSE-SU-2026:2369-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-40622 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-44608 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-42960 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-44608 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33278 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8282-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-44608 · Security Note
• https://nlnetlabs.nl/downloads/unbound/CVE-2026-44608.txt · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-44608 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10903-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8282-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-42923 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-44608 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-41292 · Vendor Advisory