Skip to main content

NLnet Labs Unbound CVE-2026-52863

| EUVDEUVD-2026-47677 MEDIUM
Use After Free (CWE-416)
2026-07-22 NLnet Labs GHSA-5gh2-8ch2-g46c
Memory Corruption Buffer Overflow Use After Free Unbound Red Hat Suse
5.9
CVSS 3.1 · Vendor: NLnet Labs
Share

Severity by source

Vendor (NLnet Labs) PRIMARY
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.9 MEDIUM

Network-reachable via DNS queries (AV:N), but AC:H due to required non-default config intersection and load dependency; availability-only impact with no C or I effect.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.8 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Red Hat
5.9 MEDIUM
qualitative

Primary rating from Vendor (NLnet Labs).

CVSS VectorVendor: NLnet Labs

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch available
Jul 22, 2026 - 16:18 EUVD
Analysis Generated
Jul 22, 2026 - 13:54 vuln.today

DescriptionCVE.org

In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of the view name in effect that could lead to memory corruption if the owner of the original view name is jostled out when Unbound is under pressure. Unbound needs to be configured with one of 'respip'/'rpz' modules, together with a module that can attach subqueries (respip CNAME redirection, dns64, subnetcache) and a configured 'access-control-view' while Unbound is under pressure so that joslte logic kicks in and starts dropping slow queries. The subquery is getting a shallow copy of the view name and if the super query which owns the view name is jostled out, memory corruption can occur. Likelihood of a crash is low, since it relies heavily on the underlying memory allocator and the memory layout. Debug memory builds (e.g., ASAN) that catch the free terminate the server.

AnalysisAI

Memory corruption via use-after-free in NLnet Labs Unbound 1.25.0-1.25.1 can cause a DNS resolver crash under specific, non-default configurations when the server is under load. The flaw originates from a regression introduced in a fix enabling 'respip' and 'dns64' module interoperability: subqueries receive a shallow copy of the active view name, and if the parent query is evicted (jostled) before the subquery completes, the dangling reference causes memory corruption. No public exploit code exists and no confirmed active exploitation (CISA KEV) has been identified; the vendor explicitly describes crash likelihood as low due to dependence on memory layout and allocator behavior.

Technical ContextAI

Unbound is a validating, recursive DNS resolver maintained by NLnet Labs, widely deployed in ISPs and enterprise DNS infrastructure. The vulnerability (CWE-416: Use After Free) arises in the inter-module communication layer between 'respip'/'rpz' policy modules and modules that attach subqueries (dns64, respip CNAME redirection, subnetcache). When Unbound is under query load and jostle logic activates to drop slow queries, a parent query holding the authoritative reference to a view name string (selected via 'access-control-view') may be freed while a subquery holds a shallow pointer to that same string. The subsequent access to the freed memory region constitutes a classic use-after-free. CPE string cpe:2.3:a:nlnet_labs:unbound:*:*:*:*:*:*:*:* covers the affected range; precise affected versions are 1.25.0 and 1.25.1. Debug builds with memory sanitizers (e.g., ASAN) will immediately terminate the process, preventing silent corruption but causing a crash.

RemediationAI

Consult the NLnet Labs vendor advisory at https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-52863.txt for the exact patched release version; no patched version number was present in the available intelligence data, so upgrading to the latest stable release beyond 1.25.1 is the recommended primary action. If an immediate upgrade is not feasible, the vendor advisory outlines that the vulnerability requires concurrent presence of respip/rpz, a subquery-capable module, and access-control-view - disabling any one of these three configuration elements eliminates the vulnerable code path. Specifically, removing the dns64 module configuration or eliminating access-control-view directives from the Unbound configuration are the least disruptive workarounds, though each removes intended resolver functionality. Reducing query load via rate-limiting (e.g., ratelimit: and ratelimit-slabs: directives) may reduce the probability of jostle eviction, but does not eliminate the vulnerability. Running Unbound with ASAN or valgrind in staging can help detect the condition before production deployment.

More in Unbound

View all
CVE-2019-18934 HIGH POC
7.3 Nov 19

Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiv
CVE-2026-33278 CRITICAL
9.1 May 20

Use-after-free in the DNSSEC validator of NLnet Labs Unbound resolver versions 1.19.1 through 1.25.0 allows remote attac
CVE-2026-42959 HIGH
8.7 May 20

Remote denial of service in NLnet Labs Unbound recursive DNS resolver (versions up to and including 1.25.0) allows an at
CVE-2026-42944 HIGH
8.7 May 20

Heap overflow denial-of-service in NLnet Labs Unbound recursive DNS resolver versions 1.14.0 through 1.25.0 allows remot
CVE-2026-32665 HIGH
7.5 Jul 22

Remote denial of service in NLnet Labs Unbound 1.22.0 through 1.25.1 lets an unauthenticated client exhaust configured m
CVE-2026-55973 HIGH
7.5 Jul 22

Remote denial-of-service in NLnet Labs Unbound 1.23.0 through 1.25.1 lets an attacker who controls a delegated DNS zone

CVE-2026-40691 HIGH
7.5 Jul 22

Remote denial-of-service in NLnet Labs Unbound 1.9.0 through 1.25.1 allows an unauthenticated attacker to crash the recu
CVE-2026-44690 HIGH
7.5 Jul 22

DNS cache poisoning in NLnet Labs Unbound (1.7.0 through 1.25.1) lets an actor who controls a single delegated zone unde
CVE-2022-3204 HIGH
7.5 Sep 26

A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolv
CVE-2020-10772 HIGH
7.5 Nov 27

An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020
CVE-2020-12663 HIGH
7.5 May 19

Unbound before 1.10.1 has an infinite loop via malformed DNS answers received from upstream servers. Rated high severity
CVE-2020-12662 HIGH
7.5 May 19

Unbound before 1.10.1 has Insufficient Control of Network Message Volume, aka an "NXNSAttack" issue. Rated high severity

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Memory Corruption

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Micro 5.5 Not-Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Not-Affected

Share

CVE-2026-52863 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy