Skip to main content

NLnet Labs Unbound CVE-2026-56416

| EUVDEUVD-2026-47684 MEDIUM
Improper Validation of Integrity Check Value (CWE-354)
2026-07-22 NLnet Labs GHSA-2845-97v4-7wm3
Buffer Overflow Red Hat Canonical Suse Unbound Nlnet Labs
4.8
CVSS 3.1 · Vendor: NLnet Labs
Share

Severity by source

Vendor (NLnet Labs) PRIMARY
4.8 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
vuln.today AI
6.5 MEDIUM

Heap overflow in a network-facing DNS resolver credibly causes process crash warranting A:H; all other metrics align with vendor assessment.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
5.6 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Red Hat
4.8 MEDIUM
qualitative

Primary rating from Vendor (NLnet Labs).

CVSS VectorVendor: NLnet Labs

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low

Lifecycle Timeline

3
Patch available
Jul 22, 2026 - 16:18 EUVD
Analysis Generated
Jul 22, 2026 - 13:58 vuln.today
CVE Published
Jul 22, 2026 - 13:10 cve.org
MEDIUM 4.8

DescriptionCVE.org

In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain name as 'datstart + dname_valid(datstart, ...)' and passes it straight to 'query_dname_tolower()' without checking that a second name is actually present in the RDATA. The wire-format parser accepts multi-dname RRs whose RDATA ends after the first name, so an attacker who runs a DNSSEC-signed authoritative server can deliver a record with an absent second domain name (e.g. SOA record) and cause 'query_dname_tolower()' to walk label-by-label through stale bytes in the per-worker 'env->scratch_buffer', past the end of that heap allocation if 'msg-buffer-size' has been lowered from the default. This leads to heap buffer overflow and on a release build the outcome relies heavily on the contents of the buffer tail and the adjacent heap chunk.

AnalysisAI

Heap buffer overflow in NLnet Labs Unbound up to and including 1.25.1 allows a network attacker who controls a DNSSEC-signed authoritative server to corrupt heap memory or crash the resolver by serving a PX, RP, MINFO, or SOA record with RDATA truncated to omit the expected second embedded domain name. The DNSSEC validator's canonical RDATA construction routine computes a pointer to the absent second domain name and passes it unchecked to query_dname_tolower(), which then walks label-by-label through stale bytes in the per-worker env->scratch_buffer - overflowing the heap allocation when msg-buffer-size is configured below its default. No public exploit has been identified at time of analysis; exploitation is constrained by the AC:H requirement for attacker control of a DNSSEC-signed zone.

Technical ContextAI

Unbound is a DNSSEC-validating recursive DNS resolver developed by NLnet Labs, deployed broadly across enterprise, ISP, and government environments. The flaw resides in the DNSSEC validator's canonical RDATA construction phase, executed when verifying RRSIG-covered resource record sets containing two embedded domain names - specifically RR types PX, RP, MINFO, and SOA. The code computes the address of the second domain name as datstart + dname_valid(datstart, ...) and forwards it directly to query_dname_tolower() without verifying that a second name actually exists within the RDATA bounds. The wire-format DNS parser accepts records whose RDATA ends after the first domain name, creating an exploitable gap between parser permissiveness and validator assumptions. CWE-354 (Reliance on Data/Memory Layout) precisely captures the root cause: once query_dname_tolower() begins walking stale bytes in the per-worker scratch buffer, the outcome depends entirely on whatever bytes occupy memory adjacent to the allocation - heap metadata, other worker state, or unmapped pages. Worst-case overflow past the allocation boundary is gated on msg-buffer-size being set below its default. Affected product per CPE: cpe:2.3:a:nlnet_labs:unbound:*:*:*:*:*:*:*:*.

RemediationAI

Consult the NLnet Labs advisory at https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-56416.txt for the official patched release version and upgrade as soon as it is available - no specific fix version is independently confirmed from the current intelligence package. As an immediate compensating control, ensure msg-buffer-size is set to its default value rather than any reduced value; this does not eliminate the out-of-bounds read but prevents the overflow from extending past the scratch buffer allocation boundary, limiting worst-case impact to reading stale in-allocation bytes rather than corrupting adjacent heap chunks. Restricting the set of external zones the resolver may query - via Unbound's access-control directives or local RPZ policies - reduces the attack surface by limiting which attacker-controlled authoritative servers the resolver will interact with, though this degrades general recursive resolution capability and may not be feasible in all deployments. Placing Unbound behind a DNS proxy or firewall capable of validating RDATA structural integrity for SOA, MINFO, PX, and RP record types would provide an additional layer of defense, at the cost of added latency and operational complexity.

More in Unbound

View all
CVE-2019-18934 HIGH POC
7.3 Nov 19

Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiv
CVE-2026-33278 CRITICAL
9.1 May 20

Use-after-free in the DNSSEC validator of NLnet Labs Unbound resolver versions 1.19.1 through 1.25.0 allows remote attac
CVE-2026-42959 HIGH
8.7 May 20

Remote denial of service in NLnet Labs Unbound recursive DNS resolver (versions up to and including 1.25.0) allows an at
CVE-2026-42944 HIGH
8.7 May 20

Heap overflow denial-of-service in NLnet Labs Unbound recursive DNS resolver versions 1.14.0 through 1.25.0 allows remot
CVE-2026-32665 HIGH
7.5 Jul 22

Remote denial of service in NLnet Labs Unbound 1.22.0 through 1.25.1 lets an unauthenticated client exhaust configured m
CVE-2026-55973 HIGH
7.5 Jul 22

Remote denial-of-service in NLnet Labs Unbound 1.23.0 through 1.25.1 lets an attacker who controls a delegated DNS zone

CVE-2026-40691 HIGH
7.5 Jul 22

Remote denial-of-service in NLnet Labs Unbound 1.9.0 through 1.25.1 allows an unauthenticated attacker to crash the recu
CVE-2026-44690 HIGH
7.5 Jul 22

DNS cache poisoning in NLnet Labs Unbound (1.7.0 through 1.25.1) lets an actor who controls a single delegated zone unde
CVE-2022-3204 HIGH
7.5 Sep 26

A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolv
CVE-2020-10772 HIGH
7.5 Nov 27

An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020
CVE-2020-12663 HIGH
7.5 May 19

Unbound before 1.10.1 has an infinite loop via malformed DNS answers received from upstream servers. Rated high severity
CVE-2020-12662 HIGH
7.5 May 19

Unbound before 1.10.1 has Insufficient Control of Network Message Volume, aka an "NXNSAttack" issue. Rated high severity

Same weakness CWE-354 – Improper Validation of Integrity Check Value

View all
CVE-2023-48795 MEDIUM POC
5.9
CVE-2024-3596 CRITICAL
9.0
CVE-2023-33668 CRITICAL POC
9.8
CVE-2026-50021 HIGH POC
8.1
CVE-2022-36174 HIGH POC
8.1
CVE-2019-13496 HIGH POC
8.1
CVE-2024-51141 HIGH POC
7.8
CVE-2023-38802 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.5 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected

Share

CVE-2026-56416 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy