Skip to main content

Unbound libunbound CVE-2026-44621

| EUVDEUVD-2026-47667 MEDIUM
Improper Check for Unusual or Exceptional Conditions (CWE-754)
2026-07-22 NLnet Labs GHSA-3m86-wjgw-cgqc
Information Disclosure Red Hat Suse Unbound Nlnet Labs
5.9
CVSS 3.1 · Vendor: NLnet Labs
Share

Severity by source

Vendor (NLnet Labs) PRIMARY
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.9 MEDIUM

AC:H reflects need to control or spoof authoritative DNS responses; PR:N as no authentication to libunbound is needed; A:H for application crash; C/I:N as no data exposure or modification occurs.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.2 MEDIUM
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.9 MEDIUM
qualitative

Primary rating from Vendor (NLnet Labs).

CVSS VectorVendor: NLnet Labs

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch available
Jul 22, 2026 - 16:18 EUVD
Analysis Generated
Jul 22, 2026 - 13:49 vuln.today

DescriptionCVE.org

With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and libunbound needs to call 'libworker_alloc_cleanup' since the function is absent from the function call allow list. When an application using libunbound sets 'unwanted-reply-threshold' to any non-zero value and the iterator queries an authoritative that replies with enough wrong-transaction-ID UDP datagrams to cross the threshold, the 'libworker_alloc_cleanup' will eventually be called. Since the function is absent from the function call allow list, this leads to a fatal exit of libunbound and eventual termination of the embedding application.Unbound itself is not affected since its relevant function 'worker_alloc_cleanup' is registed in the allow list and proceeds to perform the documented cache flush.

AnalysisAI

Fatal application termination in NLnet Labs Unbound's libunbound library (up to and including 1.25.1) can be triggered remotely when the 'unwanted-reply-threshold' feature is enabled. An attacker controlling or able to spoof responses from an authoritative nameserver can flood the resolver with wrong-transaction-ID UDP datagrams until the threshold is crossed, causing libunbound to invoke 'libworker_alloc_cleanup' - a function absent from the internal allow list - resulting in a fatal exit that crashes the embedding application. Notably, standalone Unbound is unaffected because its counterpart function 'worker_alloc_cleanup' is correctly registered; only applications embedding libunbound are at risk. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Unbound implements an internal function call allow list as a security boundary for libunbound, the embeddable resolver library. When 'unwanted-reply-threshold' is configured to a non-zero value, the library monitors for unsolicited or mismatched UDP datagrams (wrong transaction IDs) from authoritative nameservers - a defense against DNS cache poisoning and amplification. Upon crossing the threshold, cleanup logic triggers 'libworker_alloc_cleanup', which handles memory and cache flushing for libunbound worker threads. This function was inadvertently omitted from the allow list, causing the allow-list enforcement mechanism itself to raise a fatal error. CWE-754 (Improper Check for Unusual or Exceptional Conditions) captures this class of bug: the library fails to handle the edge case where its own internal cleanup function is invoked via a code path that the allow list does not anticipate. The affected CPE is cpe:2.3:a:nlnet_labs:unbound:*:*:*:*:*:*:*:*, covering all versions through 1.25.1. Standalone Unbound correctly registers 'worker_alloc_cleanup' in its allow list and is not vulnerable.

RemediationAI

Consult the NLnet Labs advisory at https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-44621.txt for the official patched release. An exact fixed version beyond 1.25.1 is not independently confirmed in the available data - monitor the NLnet Labs release page for a corrected build and upgrade as soon as one is available. As an immediate compensating control, applications embedding libunbound should set 'unwanted-reply-threshold' to 0 (its default, which disables the feature) in their libunbound configuration; this prevents the vulnerable code path from ever being triggered and carries no functional cost if the feature was not deliberately relied upon. Applications that require the threshold feature for operational reasons should prioritize upgrading to the patched version, as disabling the feature removes a legitimate defense against transaction-ID spoofing attacks. Network-level mitigations such as filtering inbound UDP with mismatched transaction IDs at the authoritative-server boundary may reduce exposure but are not a substitute for patching.

More in Unbound

View all
CVE-2019-18934 HIGH POC
7.3 Nov 19

Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiv
CVE-2026-33278 CRITICAL
9.1 May 20

Use-after-free in the DNSSEC validator of NLnet Labs Unbound resolver versions 1.19.1 through 1.25.0 allows remote attac
CVE-2026-42959 HIGH
8.7 May 20

Remote denial of service in NLnet Labs Unbound recursive DNS resolver (versions up to and including 1.25.0) allows an at
CVE-2026-42944 HIGH
8.7 May 20

Heap overflow denial-of-service in NLnet Labs Unbound recursive DNS resolver versions 1.14.0 through 1.25.0 allows remot
CVE-2026-32665 HIGH
7.5 Jul 22

Remote denial of service in NLnet Labs Unbound 1.22.0 through 1.25.1 lets an unauthenticated client exhaust configured m
CVE-2026-55973 HIGH
7.5 Jul 22

Remote denial-of-service in NLnet Labs Unbound 1.23.0 through 1.25.1 lets an attacker who controls a delegated DNS zone

CVE-2026-40691 HIGH
7.5 Jul 22

Remote denial-of-service in NLnet Labs Unbound 1.9.0 through 1.25.1 allows an unauthenticated attacker to crash the recu
CVE-2026-44690 HIGH
7.5 Jul 22

DNS cache poisoning in NLnet Labs Unbound (1.7.0 through 1.25.1) lets an actor who controls a single delegated zone unde
CVE-2022-3204 HIGH
7.5 Sep 26

A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolv
CVE-2020-10772 HIGH
7.5 Nov 27

An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020
CVE-2020-12663 HIGH
7.5 May 19

Unbound before 1.10.1 has an infinite loop via malformed DNS answers received from upstream servers. Rated high severity
CVE-2020-12662 HIGH
7.5 May 19

Unbound before 1.10.1 has Insufficient Control of Network Message Volume, aka an "NXNSAttack" issue. Rated high severity

Same weakness CWE-754 – Improper Check for Unusual or Exceptional Conditions

View all
CVE-2024-4367 HIGH POC
8.8
CVE-2017-11144 HIGH
7.5
CVE-2026-24054 CRITICAL POC
10.0
CVE-2023-37303 CRITICAL POC
9.8
CVE-2017-17085 HIGH POC
7.5
CVE-2020-6385 HIGH POC
8.8
CVE-2023-21102 HIGH POC
7.8
CVE-2021-29607 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.5 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected

Share

CVE-2026-44621 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy