Skip to main content

NLnet Labs Unbound CVE-2026-42944

| EUVDEUVD-2026-31085 HIGH
Numeric Truncation Error (CWE-197)
2026-05-20 sep@nlnetlabs.nl GHSA-7mmq-q3m9-jrv7
Denial Of Service Unbound Nlnetlabs
8.7
CVSS 4.0 · Vendor: nlnetlabs
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify reachable Unbound resolver
  2. Delivery
    Craft DNS query with multiple NSID/Cookie/Padding EDNS options
  3. Exploit
    Send query to resolver
  4. Execution
    Trigger truncated EDNS size calculation
  5. Persist
    Heap overflow during reply encoding
  6. Impact
    Resolver process crashes, DNS service denied

Vulnerability Assessment

Weakness
CWE
CWE-197
ASVS 5.0
V15 - Secure Coding and Architecture Numeric truncation prevention
Exploitation Conditions

The target Unbound instance must have at least one of the following configuration options enabled: 'nsid', 'answer-cookie', or 'pad-responses' - and 'pad-responses' is enabled by default, so out-of-the-box installations are exposed without operator action. The attacker must be able to send DNS queries to the resolver, which for open, ISP-facing, or large internal resolvers is the standard service surface. No authentication, no user interaction, and no special platform are required; the limiting factor is purely network reachability to the resolver's listening port (typically UDP/TCP 53, or DoT/DoH where Unbound terminates encrypted DNS).
Impact

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VC:N/VI:N/VA:H confirms a remote, unauthenticated, low-complexity attack producing high availability impact only - consistent with the vendor's 'Denial Of Service' tag and the description of a crash rather than code execution. The 8.7 score reflects that any host able to send DNS queries to the resolver can trigger the bug; for open or large-population resolvers (ISP, enterprise, cloud), reachability is essentially universal. Mitigating factors: no EPSS score, no KEV listing, and no public exploit identified at time of analysis, so exploitation appears speculative rather than observed. The default-enabled 'pad-responses' setting means most installations are vulnerable without operator opt-in, which increases real-world priority above a typical DoS-only bug. Heap overflows can sometimes be escalated beyond crash, but the vendor explicitly characterizes the outcome as a crash and CVSS rates VC:N/VI:N - code execution should not be assumed without further research.
Exploit ScenarioDerived

An attacker sends a single crafted DNS query to a reachable Unbound resolver, attaching multiple NSID, DNS Cookie, and/or EDNS Padding options. When Unbound constructs the reply, the truncated size calculation causes the EDNS option encoder to overflow the heap allocation, crashing the resolver process and denying DNS service to all of its clients; the attack can be repeated to keep the resolver down. No public exploit code is identified at time of analysis, but the attack requires only the ability to query the resolver.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 20, 2026

Heap overflow denial-of-service in NLnet Labs Unbound recursive DNS resolver versions 1.14.0 through 1.25.0 allows remote unauthenticated attackers to crash the resolver by sending DNS queries containing multiple NSID, DNS Cookie, and/or EDNS Padding options. The flaw stems from a numeric truncation in EDNS field size calculation that lets attacker-influenced data overflow the response buffer. No public exploit identified at time of analysis and not listed in CISA KEV, but the impact is service-wide DNS outage for any user of an affected resolver.

RemediationAI

Vendor-released patch: upgrade to Unbound 1.25.1, which both de-duplicates EDNS options and corrects the truncated size calculation in the EDNS field encoder - see https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42944.txt. If immediate upgrade is not possible, the trigger surface can be removed by disabling the three affected response options: set 'pad-responses: no' (default is yes, so this is the most impactful workaround - note it eliminates response padding that helps obscure DNS-over-TLS/HTTPS message lengths from on-path observers), ensure 'nsid:' is unset or empty, and set 'answer-cookie: no' (this disables DNS Cookie protection against off-path spoofing and reflection, a real trade-off for resolvers that previously relied on it). Network-layer compensating controls - restricting which clients can query the resolver via access-control lists or firewall rules - reduce exposure on internal resolvers but do not help open or ISP-facing deployments.

Affected VersionsENISA

Unbound 1.14.0 <1.25.1

Affected Packages

euvd unbound fix: 1.25.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Unbound is a widely deployed validating, recursive, caching DNS resolver maintained by NLnet Labs and used in many Linux distributions, BSD systems, and DNS appliances. The vulnerability is rooted in CWE-197 (Numeric Truncation Error) in the EDNS (Extension Mechanisms for DNS, RFC 6891) option encoding path: when the resolver constructs reply packets containing multiple NSID (RFC 5001), DNS Cookie (RFC 7873), or EDNS Padding (RFC 7830) options, a size calculation truncates to a smaller integer width than the actual encoded length. The encoder then writes past the heap allocation it was sized for, producing a heap buffer overflow write of Unbound-controlled data that leads to a process crash. The affected option emitters are only reached when the 'nsid', 'answer-cookie', or 'pad-responses' configuration options are active; 'pad-responses' is enabled by default, making default deployments reachable.

Know when Unbound gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (nlnetlabs) PRIMARY 8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Red
SUSE 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 7.5 HIGH

Primary rating from Vendor (nlnetlabs).

CVSS VectorVendor: nlnetlabs

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

1
Patch available
May 20, 2026 - 11:02 EUVD

DescriptionCVE.org

NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options ('nsid', 'answer-cookie', 'pad-responses' (default)) need to be enabled for the vulnerability to be exploited. An adversary who can query Unbound can exploit the vulnerability by attaching multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options to the query. A flaw in the size calculation of the EDNS field truncates the correct value which allows the encoder to overflow the available space when writing. Those two combined lead to a heap overflow write of Unbound controlled data and eventually a crash. Unbound 1.25.1 contains a patch with a fix to de-duplicate the EDNS options and a fix to prevent truncation of the EDNS field size calculation.

Executive ViewAI

Why It Matters

NLnet Labs Unbound DNS resolver versions 1.14.0 through 1.25.0 contain a vulnerability allowing remote, unauthenticated attackers to crash the resolver and cause organization-wide DNS service outages. Organizations operating affected Unbound versions face potential complete network service failure with no vendor-released patch identified at time of analysis. This represents a critical operational risk requiring immediate protective measures.

Business Impact: High
Compensating Controls

Implement DNS query rate limiting to restrict attack scope and impact; deploy packet filtering and input validation to block DNS queries containing multiple EDNS options; enable real-time alerting for anomalous query patterns; configure DNS resolver redundancy with independent systems; restrict resolver network access via firewall segmentation where operationally feasible; establish daily monitoring of NLnet Labs security bulletins and vendor advisories.

Threat Intelligence Overview

EPSS Score
0.0%
Top 87% exploitable
Social Media
2
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Unbound

View all
CVE-2019-18934 HIGH POC
7.3 Nov 19

Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiv
CVE-2026-81642 CRITICAL
9.1 Sep 16

A crafted DNSKEY whose owner name is a compression pointer into its own RDATA overflows the digest buffer in the DNSSEC

CVE-2026-33278 CRITICAL
9.1 May 20

Use-after-free in the DNSSEC validator of NLnet Labs Unbound resolver versions 1.19.1 through 1.25.0 allows remote attac
CVE-2026-42959 HIGH
8.7 May 20

Remote denial of service in NLnet Labs Unbound recursive DNS resolver (versions up to and including 1.25.0) allows an at
CVE-2026-82717 HIGH
8.4 Sep 16

Heap-based memory corruption in NLnet Labs Unbound up to and including 1.26.0 lets a remote, unauthenticated attacker wh
CVE-2019-16866 HIGH
7.5 Oct 03

Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIF
CVE-2026-32665 HIGH
7.5 Jul 22

Remote denial of service in NLnet Labs Unbound 1.22.0 through 1.25.1 lets an unauthenticated client exhaust configured m
CVE-2026-55973 HIGH
7.5 Jul 22

Remote denial-of-service in NLnet Labs Unbound 1.23.0 through 1.25.1 lets an attacker who controls a delegated DNS zone

CVE-2026-40691 HIGH
7.5 Jul 22

Remote denial-of-service in NLnet Labs Unbound 1.9.0 through 1.25.1 allows an unauthenticated attacker to crash the recu
CVE-2026-81634 HIGH
7.5 Sep 16

Heap buffer overflow in NLnet Labs Unbound 1.26.0 and earlier can be triggered when a resolver processing a large TCP-fr
CVE-2026-85501 HIGH
7.5 Sep 16

Denial-of-service through algorithmic complexity attacks in NLnet Labs Unbound up to and including 1.26.0 can degrade or
CVE-2026-80225 HIGH
7.5 Sep 16

Degradation of service in NLnet Labs Unbound up to and including 1.26.0 allows an unauthenticated remote attacker to mon

Same weakness CWE-197 – Numeric Truncation Error

View all
CVE-2022-42475 CRITICAL POC
9.8
CVE-2025-6965 HIGH POC
7.2
CVE-2020-15202 CRITICAL POC
9.0
CVE-2026-63525 HIGH
7.8
CVE-2024-43639 CRITICAL
9.8
CVE-2026-87529 CRITICAL
9.6
CVE-2026-55142 MEDIUM
5.5
CVE-2026-109588 CRITICAL
9.3

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected
SUSE Linux Enterprise Micro 5.5 Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:19752 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-42944 ADVISORY https://ubuntu.com/security/notices/USN-8282-1 ADVISORY https://vuldb.com/vuln/364851 REF https://access.redhat.com/errata/RHSA-2026:23231 REF https://access.redhat.com/errata/RHSA-2026:24365 REF https://access.redhat.com/errata/RHSA-2026:24369 REF https://access.redhat.com/security/cve/CVE-2026-42944 REF https://bugzilla.redhat.com/show_bug.cgi?id=2479774 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42944.json REF https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42944.txt

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy