Description (CNA)
NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options ('nsid', 'answer-cookie', 'pad-responses' (default)) need to be enabled for the vulnerability to be exploited. An adversary who can query Unbound can exploit the vulnerability by attaching multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options to the query. A flaw in the size calculation of the EDNS field truncates the correct value which allows the encoder to overflow the available space when writing. Those two combined lead to a heap overflow write of Unbound controlled data and eventually a crash. Unbound 1.25.1 contains a patch with a fix to de-duplicate the EDNS options and a fix to prevent truncation of the EDNS field size calculation.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| NLnet Labs / Unbound | affected 1.14.0 before 1.25.1 |
CWE
CWE-197, CWE-787
References
ADP enrichment
No English description supplied.
No references supplied.
A flaw was found in Unbound, a Domain Name System (DNS) resolver. A remote attacker could trigger a heap overflow by sending specially crafted DNS reply packets. This occurs when Unbound attempts to encode multiple Name Server Identifier (NSID) or Extension Mechanisms for DNS (EDNS) Cookie options, or EDNS Padding options, and these options are enabled. Successful exploitation of this vulnerability could lead to a denial of service (DoS), making the Unbound service unavailable.
- https://access.redhat.com/security/cve/CVE-2026-42944
- https://bugzilla.redhat.com/show_bug.cgi?id=2479774
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42944.json
- https://access.redhat.com/errata/RHSA-2026:23231
- https://access.redhat.com/errata/RHSA-2026:24365
- https://access.redhat.com/errata/RHSA-2026:24369
- https://access.redhat.com/errata/RHSA-2026:19752