Stack Buffer Overflow in Unbound EDNS Report-Channel Processing (CVE-2026-55973)

When 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from an upstream response is processed, using the option's length as the length of the agent domain. If the agent domain is followed by garbage, those bytes are appended to the synthetic '_er.' report query name. During 'find_closest_of_type()', the query name is stripped using the query name length instead of stopping at the embedded root, causing a stack buffer overflow via 'dname_query_hash()' when it reads a garbage byte as a label length. One crafted upstream response from an attacker-controlled delegated zone is sufficient to terminate the daemon. Affected versions: - 1.23.0 - 1.25.1 We recommend updating to: 1.25.2. CVSS 7.5 · our assessment: this_week Reference: https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-55973.txt Details: https://vuln.today/cve/CVE-2026-55973