Unbound CVE-2026-55973

Exploitation requires that the target Unbound resolver (1.23.0-1.25.1) be running with the non-default option 'dns-error-reporting: yes' enabled, and that the attacker be able to return a crafted authoritative response from a delegated zone the resolver queries - i.e. control of a delegated zone in the resolution path. The trigger is a single upstream response containing a malformed EDNS Report-Channel option (code 18) whose declared length plus trailing garbage bytes overrun the synthetic '_er.' report query name. Limiting factors: the feature is off by default so most deployments are not exposed, and the attacker must get the victim to resolve a name under attacker-influenced delegation. No authentication is required (PR:N per the CVSS vector) and no user interaction beyond normal DNS resolution.

The signals are internally consistent but point to a conditional rather than a blanket threat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) correctly captures a network-reachable, unauthenticated crash with high availability impact and no confidentiality or integrity loss - so the vendor's 'Information Disclosure' tag appears mislabeled; this is a denial-of-service, not an info leak. The vector's AC:L understates two real preconditions that lie outside the attacker's single request: the target must have opted into the non-default 'dns-error-reporting: yes' setting, and the attacker must control (or influence a response from) a delegated zone the resolver actually queries. Those conditions materially shrink the exposed population, which is why my independent assessment raises attack complexity. No EPSS figure, no KEV listing, and no known POC were provided, so this is a credible-but-not-urgent DoS: patch on a normal cycle unless dns-error-reporting is enabled in your fleet, in which case treat it as higher priority.

An attacker registers or compromises an authoritative server for a zone they control and waits for (or lures, via a link or embedded resource) a victim Unbound resolver with 'dns-error-reporting: yes' to resolve a name in that zone. The malicious authoritative response carries an EDNS Report-Channel option whose length field and trailing garbage bytes overflow the report-query-name handling, corrupting the stack and terminating the daemon. No exploit code is publicly known, and the network/low-complexity trigger means a single ordinary-looking response suffices.