Nlnet Labs
Monthly
Routinator, NLnet Labs' RPKI relying-party validator, can be driven into memory exhaustion by an AS range in RPKI data whose maximum value is lower than its minimum, leaving the validator unable to continue. The issue is remotely reachable without authentication per the CVSS vector and affects availability only; exploitation requires an attacker to place the malformed range into RPKI objects that a target Routinator instance fetches and validates. No CISA KEV entry or public exploit code is identified in the supplied data.
Routinator exits when it encounters an RRDP-delivered rsync URI whose path cannot be stored on disk, producing a denial of service in RPKI validation. The flaw affects Routinator instances that fetch repository content over RRDP (the default transport) and validate a publication point the attacker operates, compromises, or otherwise controls; an arbitrary off-path attacker cannot trigger it. The assessed impact is availability-only (CVSS 7.5), with no confidentiality or integrity effect, and no public exploit identified at time of analysis.
Routinator, NLnet Labs' RPKI relying-party validator, can be hung or terminated by a CRL fetched from the repository hierarchy it validates: a CRL carrying a very large number of entries drives the hang or out-of-memory path, while a CRL with an incorrect encoding causes the process to exit, producing an availability-only denial of service (CVSS 7.5, A:H, with no confidentiality or integrity impact). The CPE entry cpe:2.3:a:nlnet_labs:routinator is unversioned, so all releases are presumed affected until the vendor advisory names fixed versions. No public exploit code and no confirmed active exploitation were identified at time of analysis; the practical barrier is that an attacker must be able to serve the crafted CRL from a repository or CA inside a trusted RPKI validation path, and no authentication to Routinator itself is required.
Routinator, NLnet Labs' RPKI relying party validator, mishandles RRDP notification files by accepting delta entries with gaps and by not safely handling an excessive number of delta entries. A malicious or compromised RPKI publication point, or a network-path attacker able to serve crafted RRDP content, can cause incomplete RPKI data (integrity impact) or memory exhaustion and a crash (availability impact). No public exploit code or confirmed active exploitation is identified in the supplied data.
Denial of service in NLnet Labs Unbound versions 1.22.0 through 1.26.1, where a remote DNS-over-QUIC client can crash the resolver by triggering a QUIC path migration at the moment a mesh reply still holds a pointer to the associated DoQ stream. The resulting use-after-free dereferences the freed stream when the pending reply completes, terminating the process and interrupting DNS resolution for all clients of that instance. Exploitation is race-dependent and only possible when DoQ is enabled and Unbound runs multi-threaded; no public exploit code was identified and the issue is not confirmed actively exploited (CISA KEV), so this is a genuine but bounded availability risk rather than a wormable or data-exposing flaw.
Stack-based buffer overflow in NLnet Labs NSD's zone-file RDATA parser allows an attacker with the ability to supply a crafted primary zone file to perform out-of-bounds stack writes, including overwriting a callback function pointer that is invoked immediately after parsing, which can lead to arbitrary code execution. The vulnerable path requires direct ingestion of a specially formatted zone file; NSD-generated zone files, including those for secondary zones received by transfer, are not formatted in the triggering way and will not exploit the flaw. No public exploit code or confirmed active exploitation is identified in the available intelligence, and the assessed vector requires low privileges (PR:L) through local or zone-supply access rather than ordinary remote DNS queries.
Loading a crafted zone file into NLnet Labs NSD can overflow a stack buffer and overwrite up to 191 bytes with attacker-controlled data, which can corrupt control flow in the name server process and lead to code execution or a crash. The trigger is a HIP resource record whose RDATA is filled to (or near) its size limit and which also carries a second dname RDATA field, the HIP Rendezvous server; the bug lives in zone-file parsing, so it is not reachable through ordinary DNS query traffic, and zones NSD writes out itself - including secondary zones learned via zone transfer - are not formatted in the vulnerable way. Exploitation therefore requires the attacker to control zone-file content fed directly to NSD, for example through an operator-controlled provisioning or automation pipeline; no public exploit code was identified at time of analysis, and the vendor's CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N, score 8.7) overstates practical remote risk relative to the assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8 High). Authentication is required per the supplied vectors (PR:L), which corresponds in practice to a low-privileged position able to supply zone-file content to the daemon.
A stack-based buffer overflow in NLnet Labs NSD's parsing of SVCB/HTTPS resource records allows an attacker who can supply a crafted zone file to corrupt memory and potentially achieve arbitrary code execution. The flaw is triggered when the RDATA is filled to the wire-format limit and an ECH parameter overflows the stack, after which the base64 decoder can write attacker-controlled data of unlimited size. Exploitation requires that the crafted zone file be fed directly to NSD; zone files written by NSD itself (e.g., secondary zones) are not affected. The attacker must control or inject into the zone-provisioning path, such as a multi-tenant zone-submission pipeline, and authentication requirements are low-privileged per the CVSS vector (PR:L). No public exploit or in-the-wild exploitation has been identified at time of analysis.
Stack-based buffer overflow in NLnet Labs NSD is triggered when the daemon parses a zone file containing base64 data split into chunks of three characters or fewer, causing the token length calculation to yield zero bytes and letting an attacker overwrite up to 64K of stack memory with attacker-controlled data, with likely code-execution impact. Our independent assessment rates this CVSS 3.1 AV:L/AC:L/PR:L/UI:N with High confidentiality, integrity and availability impact, reflecting that the attacker must control zone-file content fed directly to NSD (PR:L, i.e., write/submit access to the zone input path) - it is not reachable through normal DNS queries and does not affect zone files NSD generates itself, such as zones for which the instance is secondary. The vendor rates it CVSS 4.0 8.7 (High) with AV:N/PR:L; patch availability is not confirmed in the provided data, and no public exploit code or CISA KEV activity was identified at time of analysis.
Denial-of-service through algorithmic complexity attacks in NLnet Labs Unbound up to and including 1.26.0 can degrade or exhaust CPU resources in DNSSEC-validating recursive resolvers when they are made to validate attacker-controlled malicious zones. The flaw, part of the 'ReTrap' research family (TagTrap, DelegationTrap, NsecTrap and AdditionalTrap), is reachable by any client that can induce the resolver to look up names under an attacker-controlled domain, and unauthenticated remote attackers can trigger it per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Exploitation status: no public exploit identified at time of analysis, and CISA KEV does not list this CVE; EPSS is low at 0.31% (24th percentile), and SSVC rates exploitation as 'none' with partial technical impact. Note that the vendor's published CVSS of 7.5 is higher than our independent assessment of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (moderate, availability-only), and this analysis follows the moderated view: real but manageable risk, with service degradation rather than confidentiality or integrity loss.
Heap-based memory corruption in NLnet Labs Unbound up to and including 1.26.0 lets a remote, unauthenticated attacker who controls or spoofs the upstream DNS response (PR:N/UI:N) gradually overwrite heap memory, with the reliable outcome being a crash and remote code execution possible only on certain systems and compilation options that lack hardening. The flaw is scored CVSS 8.4 (CVSS:4.0) and by the independent assessment as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, with the high attack complexity reflecting heavy dependence on heap layout and non-deterministic results. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no KEV listing or EPSS signal is present, so this is a genuine but not-yet-urgent priority for internet-facing recursive resolvers.
A crafted DNSKEY whose owner name is a compression pointer into its own RDATA overflows the digest buffer in the DNSSEC validator of NLnet Labs Unbound 1.26.0 and earlier, letting an attacker who controls an authoritative zone crash a validating recursive resolver and, depending on heap layout, potentially execute code with attacker-influenced data. Exploitation is unauthenticated over the network per the CVSS vectors but is gated on DNSSEC validation being active and on inducing the resolver to query a name in the attacker's zone; the independently assessed impact is primarily denial of service (availability High, confidentiality and integrity Low), with remote code execution only possible rather than demonstrated. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, although the vendor rates the issue 9.1 under CVSS 4.0 and an advisory has been published.
Heap buffer overflow in NLnet Labs Unbound 1.26.0 and earlier can be triggered when a resolver processing a large TCP-framed DNS response encounters an RRSet whose owner name reaches the 255-byte maximum, crashing the resolver process and yielding a denial of service (availability-only impact, C:N/I:N/A:H). An attacker must either operate an authoritative name server that the victim resolver queries or hold an on-path position to tamper with an incoming DNS response, and the malicious answer must be delivered over TCP, be large, and carry the maximal-length owner name; crafting and delivering that payload raises practical complexity above the vendor's AC:L rating, which is why our assessment uses AC:H. No public exploit code or confirmed active exploitation has been identified at time of analysis, and because canonicalisation runs before DNSSEC validation, signature validation does not mitigate the issue. NLnet Labs has published an advisory at https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81634.txt.
Degradation of service in NLnet Labs Unbound up to and including 1.26.0 allows an unauthenticated remote attacker to monopolize a single resolver worker's event loop by streaming a sustained rate of distinct, uncached DNS names over a TCP or DNS-over-TLS (DoT) connection, keeping the attacker's writes ahead of the server's read drain. There is no limit on consecutive reads in the TCP/DoT reading procedure (CWE-770), so the affected worker cannot service other clients for as long as the flood is maintained; because impact is confined to the worker handling the malicious connection, multi-worker deployments retain partial service and availability impact is partial rather than total. Exploitation requires only network reachability to an exposed TCP/DoT listener with no authentication or user interaction (PR:N/UI:N), but no public exploit code has been identified, CISA SSVC rates exploitation as none, and EPSS is low at 0.31% (24th percentile), making this a modest-priority availability issue rather than a widespread-exploitation emergency; vendor patches are available.
NSD's proxy protocol port fails to re-evaluate BLOCKED access control list entries on the second DNS query sent over a kept-open TCP or TLS connection, allowing a remote unauthenticated attacker to bypass ACL denials that should have blocked the request. NLnet Labs reported this against all NSD versions (CPE wildcard scope), classifying it under CWE-290 as an authentication bypass by spoofing. No public exploit code has been identified at time of analysis, but the bypass mechanic - sending a query twice on the same persistent connection - is mechanically trivial once the proxy protocol port is reachable.
NSD authoritative DNS server crashes serve child processes when receiving a crafted DNS message containing exactly 17 DNS Cookie options with a UDP payload size of 512 bytes, triggering a reachable assertion (CWE-617). This condition exists exclusively in debugging and non-release build types - standard production release builds are immune. Remote unauthenticated attackers can continuously respawn-crash serve children to severely degrade or fully deny DNS resolution service; no public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
IP range-based access control in NLnet Labs NSD is silently broken on little-endian systems due to an endianness mismatch in the range comparison logic. Both IPv4 and IPv6 addresses are compared as unsigned 32-bit integers using host byte order, while the actual stored values are in network byte order (big-endian), causing comparisons to produce incorrect results on the dominant x86/x86-64/ARM-LE server platforms. The practical consequence is a bidirectional access control bypass: operators relying on hyphen-range ACL syntax may inadvertently permit unauthorized IP addresses to access restricted DNS operations (such as zone transfers) while simultaneously denying legitimate clients. No public exploit has been identified at time of analysis, but the flaw is fully deterministic and requires no special attacker capability beyond network reachability.
Remote denial-of-service in NLnet Labs Unbound 1.23.0 through 1.25.1 lets an attacker who controls a delegated DNS zone crash the resolver daemon with a single crafted upstream response, but only when the non-default 'dns-error-reporting: yes' option is enabled. The flaw is a stack write triggered while building a DNS Error Report query name from a malformed EDNS Report-Channel option (code 18). No public exploit has been identified at time of analysis and it is not listed in CISA KEV; the CVSS 7.5 reflects a pure availability impact (A:H) with no data disclosure despite the vendor's 'Information Disclosure' tag.
DNS cache poisoning in NLnet Labs Unbound (1.7.0 through 1.25.1) lets an actor who controls a single delegated zone under an NSEC-signed parent forge insecure DNS answers for unrelated sibling zones sharing that parent. The root cause is insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing, allowing fraudulent wildcard DS records to bring non-existent delegations into 'insecure' existence and inject spoofed records. Reported by NLnet Labs with a 7.5 (High) integrity-only CVSS; no public exploit identified at time of analysis and no EPSS/KEV data supplied.
Remote denial-of-service in NLnet Labs Unbound 1.9.0 through 1.25.1 allows an unauthenticated attacker to crash the recursive DNS resolver by sending a single malicious encrypted DNSCrypt query over TCP. The TCP in-place encryption routine omits the reply-length clamp that protects the UDP path, so an oversized reply is shifted 48 bytes forward past the end of a heap allocation sized to 'msg-buffer-size' (CWE-122). Only builds compiled with '--enable-dnscrypt' and an active 'dnscrypt:' clause are affected; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Remote denial of service in NLnet Labs Unbound 1.22.0 through 1.25.1 lets an unauthenticated client exhaust configured memory when downstream DNS-over-QUIC (DoQ) is enabled. The first two bidirectional QUIC streams (stream_id 0 and 4) skip the per-stream 'quic-size' accounting gate, so large input buffers are allocated after only a 2-byte length prefix arrives, letting a single connection with two streams force Unbound to allocate roughly double the configured limit at near-zero attacker cost. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the mechanics are trivial and fully described by the vendor advisory.
Zone-transfer authentication bypass in NLnet Labs NSD allows unauthorized secondaries to obtain full zone contents without presenting the required TLS client certificate. Although a provide-xfr rule specifies a tls-auth-name (mandating client-certificate authentication), NSD only enforces this on the dedicated tls-auth-port; requests arriving over plain TCP on the regular port or over TLS on the regular tls-port are served when the remaining provide-xfr conditions match, defeating mutual-TLS access control. Reported by NLnet Labs with CVSS 4.0 8.2; no public exploit identified at time of analysis and not listed in CISA KEV.
Stack buffer overflow in NSD 4.14.0 (NLnet Labs authoritative DNS server) allows a party able to introduce zone data to overwrite up to 111 attacker-controlled bytes on the stack when a specially crafted APL resource record - carrying an adflength larger than the address family permits - is serialized as the zone is written to disk. Per the CVSS 4.0 vector (PR:L), exploitation requires low privileges and yields high integrity and availability impact, consistent with memory corruption leading to crash or potential code execution. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Remote denial-of-service in NLnet Labs NSD (authoritative DNS name server) version 4.13.0 and later allows an unauthenticated attacker to crash the server process by exploiting a heap use-after-free in the TLS error-logging path. By sending a DNS query over a DNS-over-TLS (DoT) connection and closing the socket before reading the response, an attacker triggers the freed-memory access trivially; no public exploit identified at time of analysis, and the issue is not in CISA KEV. The CVSS 4.0 score of 8.7 reflects high availability impact with no confidentiality or integrity exposure.
Heap overflow in NLnet Labs NSD allows a malicious or compromised zone primary to corrupt memory on a secondary (slave) NSD instance by sending an AXFR transfer containing a crafted SVCB resource record. An rdata size of 65512 causes a uint16_t length variable used for RR allocation to wrap (total size exceeds 65535), producing an undersized buffer and a controlled out-of-bounds write of up to 65509 bytes - an RCE-class primitive (CWE-190 integer overflow leading to heap overflow). No public exploit identified at time of analysis, but the controlled write and remote network vector (CVSS 4.0 base 8.7) make this a high-priority patch for any operator running NSD as a secondary.
Off-path DNS response spoofing in NLnet Labs ldns 1.2.0 through 1.9.0 allows remote attackers to inject forged answers into applications that use the library as a UDP stub resolver, including the bundled drill tool. The library fails to validate the response source address/port, the query transaction ID, and the question section against the original query, making cache and answer poisoning feasible without on-path positioning. No public exploit identified at time of analysis, but the CVSS 4.0 score of 8.2 reflects high integrity impact on any downstream application that trusted ldns to validate DNS answers.
Denial of service in NLnet Labs Routinator allows remote attackers to crash the RPKI validator by serving a crafted Document Type Definition (DTD) inside RRDP repository content. Exploitation requires no authentication or user interaction (CVSS 4.0 8.7, VA:H), and no public exploit identified at time of analysis. A successful crash halts RPKI relying-party processing, which can degrade route origin validation for networks that depend on Routinator output.
Denial of service in NLnet Labs Routinator (an RPKI Relying Party software) allows remote attackers to crash the daemon by sending a specifically crafted non-UTF-8 string in the select-asn query parameter to the /api/v1/origins HTTP endpoint. The flaw only impacts deployments that expose the API to untrusted networks, and no public exploit has been identified at time of analysis. CVSS 4.0 base score is 8.2 driven by high availability impact to both the vulnerable component and downstream RPKI consumers.
Path traversal in NLnet Labs Routinator allows remote attackers to escape the rsync cache directory by supplying rsync URIs whose module component contains '..' sequences, enabling read/write access across the entire Routinator rsync cache filesystem. The flaw is network-reachable and requires no authentication, and no public exploit identified at time of analysis. CVSS 4.0 of 8.3 reflects high integrity and availability impact with an attack requirement (AT:P) reducing it from critical.
Denial of service in NLnet Labs Routinator allows remote unauthenticated attackers to crash the daemon by opening a large number of HTTP or RTR connections, exhausting file descriptors and triggering an unrecoverable exit. Only deployments exposing the HTTP or RTR server to untrusted networks are affected. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Resource exhaustion in NLnet Labs Routinator lets an attacker make the validator's HTTP server unavailable by opening a large number of connections that are never closed, consuming its finite open-connection capacity (CVSS 5.3, availability-only). Only operators who deliberately expose Routinator's HTTP or RTR server to untrusted networks are reachable; in a standard deployment bound to localhost or trusted internal networks the flaw is not remotely exposed. No KEV listing and no public exploit identified at time of analysis, so urgency is driven by deployment topology rather than an active campaign.
Routinator writes a newly retrieved trust anchor (TA) certificate fetched over HTTPS into its cache even when that certificate fails validation, so a failed update can overwrite the previously cached, known-good TA and leave the validator working from bad trust anchor material. Only deployments whose TAL points at an https:// TA URI are exposed, and the attacker must already hold the privileged position over that retrieval channel implied by PR:H - impact is limited to partial integrity and availability loss for RPKI validation (I:L/A:L, CVSS 3.8, C:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the priority signal is monitor.
NLnet Labs Routinator, an RPKI relying party validator, can be driven into memory exhaustion by a flood of concurrent requests to its HTTP JSON output endpoint, and can also abort with a stack overflow when a payload item carrying excessive metadata is discarded in a single operation. Only deployments that expose the HTTP or RTR server to untrusted networks are affected; the flaw is availability-only (no confidentiality or integrity impact), requires no authentication or user interaction, and no public exploit code was identified at the time of analysis. Vendor severity is 6.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), while the independent assessment rates the attack vector as network (AV:N) rather than adjacent, and the priority decision is this_month.
NLnet Labs Unbound through 1.26.1 can be driven to excessive CPU consumption by DNS responses containing many chained compression pointers, degrading resolver performance for legitimate clients. The root cause is that Unbound caps pointer traversal per domain-name operation but lacks an aggregate budget for inbound decompression work, allowing repeated expensive lookups within a single crafted message. The vendor rates this 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L); exploitation requires recursive-query access plus control of an ordinarily delegated authoritative server, and no public exploit identified at time of analysis.
NLnet Labs Unbound up to and including 1.26.1 can be tricked into downgrading a validly signed island-of-security zone to insecure status by a forged NXDOMAIN response, allowing an attacker to deny the existence of records inside that trusted island. The flaw only manifests in the non-default configuration where a root trust anchor and an explicit 'trust-anchor:' statement for an island-of-security zone are both present and the island's parent is provably insecure under the root chain; the attacker must also be positioned to deliver a crafted NXDOMAIN carrying an NSEC/SOA RRSIG whose SignerName names the insecure parent. No public exploit code or confirmed active exploitation was identified at time of analysis, and the high attack complexity and specialized configuration keep practical risk moderate (CVSS 6.5, AV:N/AC:H/PR:N/UI:N/C:N/I:L/A:H).
Unbound 1.0.1 through 1.26.1 can be induced to downgrade a configured island-of-security trust anchor to insecure when a remote unauthenticated attacker injects a forged NSEC response with the SOA bit cleared. The flaw affects only resolvers configured with both a root trust anchor and an additional trust-anchor for an island whose parent is provably insecure under the root chain, and it causes the DNSSEC validator to accept and cache the NSEC without the required RRSIG validation. Impact is integrity-only (CVSS 3.7, AC:H), and no public exploit code was identified at time of analysis.
NLnet Labs Unbound through 1.26.1 can expose a cache-level side-channel when operators explicitly configure unwanted-reply-threshold greater than 0, a non-default setting. An external observer who can send response-like UDP datagrams to the resolver’s current upstream source port can use the resulting RRset/message-cache clear as an oracle to test whether a candidate port is in use; by keeping a concurrent query window open and then performing birthday-style TXID guessing, this can become a feasible cache-poisoning path. The issue is assessed as low-to-moderate risk, with no public exploit identified at time of analysis.
Denial of service in NLnet Labs Unbound 1.12.0 through 1.26.0 arises from a use-after-free in the DNS-over-HTTPS (DoH) code path, reachable only in builds compiled with --with-libnghttp2 when failure conditions such as an RPZ drop action or heavy-traffic stream jostling occur. A remote, unauthenticated attacker can trigger the flaw with a single DoH connection and appropriate traffic, causing memory corruption that, under a hardened allocator, results in controlled termination of the Unbound process. No public exploit code has been identified at time of analysis; the impact is confined to availability (CVSS 5.9, C:N/I:N/A:H) with no confidentiality or integrity effect.
Unbound versions 1.22.0 through 1.26.1 built with DNS-over-QUIC support (--with-libngtcp2) can be driven to an abnormal exit by an unauthenticated remote attacker who manipulates QUIC stream state. The attacker sends a DoQ query, withholds ACKs, issues RESET_STREAM to free the per-stream output buffer, then waits for a PTO timeout so ngtcp2 re-encodes a STREAM frame from the freed memory; a spray of roughly 20 such queries forces the daemon down. Default builds compiled without QUIC support are not affected, and exploitation also requires precise timing against the QUIC state machine, making this a moderate, configuration-gated availability threat rather than a top-tier priority. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the authoritative assessment rates it AV:N/AC:H/PR:N/UI:N/S:U with low confidentiality and high availability impact, so the practical outcome is denial of service against the resolver rather than broad data compromise.
Unbound 1.13.2 through 1.26.1 can serve tampered contents of a ZONEMD-checked zone that sits below - but not at - a DNSSEC trust anchor, because the DS/DNSKEY chain resolution needed to validate the zone must complete asynchronously and the zone data is released (and, with the zonefile: option, written to disk) before the ZONEMD digest check concludes. In memory the exposure is self-correcting: once verification fails the data stops being served, but a tampered copy written to disk persists and is reloaded at the next startup until verification again concludes. Per the independent assessment this is a low-to-moderate integrity/authenticity issue (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N; vendor score 4.4) requiring a non-default zone/trust-anchor topology and precise timing, with no confidentiality or availability impact and no public exploit identified at time of analysis.
NLnet Labs Unbound 1.20.0 through 1.26.0 can be made to accumulate an unbounded number of pending recursive queries from a single source IP because a double decrement on the per-client 'wait-limit' counter occurs on the 'serve-expired' code path. A remote, unauthenticated attacker who controls an authoritative zone with short TTLs alternates a deliberately unanswered 'slow' query with a 'pump' query for an expired cached name, keeping the counter at or below the configured limit and eventually filling a thread's global mesh quota (num-queries-per-thread), thereby bypassing one of the countermeasures introduced for DNSBomb (CVE-2024-33655). Impact is availability-only and limited (CVSS 3.7, AC:H, A:L) and depends on the non-default 'serve-expired' feature; no public exploit has been identified at time of analysis.
TCP window throttling in NLnet Labs NSD allows any unauthenticated remote attacker to crash individual serve child processes by deliberately shrinking the TCP receive window to near-zero after issuing a DNS query over TCP, triggering an integer underflow (CWE-191). By repeating this pattern continuously, the attacker can deny all TCP-based DNS service from the affected NSD instance. No public exploit code has been identified at time of analysis, and the CVSS 4.0 score of 6.9 reflects moderate availability impact with zero confidentiality or integrity exposure.
Counter exhaustion in NLnet Labs Unbound 1.20.0 through 1.25.1 enables a remote attacker to degrade DNS resolution service by triggering a missing decrement in the serve-expired discard-timeout code path. The reply-address counter for duplicate in-flight queries is never decremented when the discard-timeout branch fires under a specific non-default misconfiguration, allowing an attacker controlling a slow authoritative zone to drive the counter to its maximum and cause silent query drops for legitimate clients. No public exploit identified at time of analysis; however, the vulnerability is exploitable remotely with no authentication required once the misconfiguration is in place.
Heap buffer overflow in NLnet Labs Unbound up to and including 1.25.1 allows a network attacker who controls a DNSSEC-signed authoritative server to corrupt heap memory or crash the resolver by serving a PX, RP, MINFO, or SOA record with RDATA truncated to omit the expected second embedded domain name. The DNSSEC validator's canonical RDATA construction routine computes a pointer to the absent second domain name and passes it unchecked to query_dname_tolower(), which then walks label-by-label through stale bytes in the per-worker env->scratch_buffer - overflowing the heap allocation when msg-buffer-size is configured below its default. No public exploit has been identified at time of analysis; exploitation is constrained by the AC:H requirement for attacker control of a DNSSEC-signed zone.
Remote unauthenticated termination of Unbound 1.22.0 through 1.25.1 is possible via a crafted DNS-over-QUIC (DoQ) connection that exploits a signed-to-unsigned integer conversion error when Unbound mishandles the NGTCP2_ERR_STREAM_DATA_BLOCKED error condition. The flaw propagates an implicit conversion of the C literal `-1` to a 64-bit unsigned integer (0xFFFFFFFFFFFFFFFF), which exceeds the 62-bit QUIC varint ceiling and triggers a libngtcp2 assertion that aborts the entire resolver process. Exploitation is deterministic - a single QUIC connection with one crafted transport parameter and one DNS query is sufficient - though the attack surface is constrained to deployments compiled with assertions enabled and DoQ actively configured. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Crash-triggering memory corruption in Unbound's DNSCrypt subsystem allows any unauthenticated network client to kill the DNS resolver with a single UDP packet. Affected versions 1.7.0 through 1.25.1, compiled with DNSCrypt support, miscount valid key slots when the dnscrypt-provider-cert list outnumbers dnscrypt-secret-key entries, leaving tail slots filled with libsodium's 0xdb debug pattern; iterating beyond valid bounds then dereferences that garbage. No public exploit has been identified at time of analysis, and no KEV listing exists, but the trigger condition is trivially constructable - one 68-byte UDP datagram.
Denial of service in NLnet Labs Unbound 1.10.0 through 1.25.1 allows a remote attacker controlling any delegated DNS zone to crash the resolver daemon via a NULL pointer dereference. The vulnerable path is activated only when both the serve-expired feature and a response-ip or RPZ CNAME redirect rule are configured simultaneously; the serve-expired-client-timeout callback's two-pass CNAME alias loop resets alias_rrset on the second pass without resetting partial_rep, causing an eventual null dereference and process crash. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but the network-accessible attack surface makes it a meaningful availability risk for any resolver running these co-configured features.
Policy bypass in NLnet Labs Unbound 1.6.0 through 1.25.1 causes DNS queries for default-protected zones - including RFC 1918 reverse zones, AS112 zones, .onion, and .localhost - to escape to public recursive resolvers instead of being answered locally. The root cause is that the unbound-control commands view_local_data and view_local_datas, when issued against a named view that was initially configured with no local data, create a bare local zones tree that omits the expected default-protected zone entries. Clients mapped to that view subsequently receive answers from the public internet for names that are supposed to be handled locally, silently subverting operator-defined DNS policy. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
DNS Cookie bypass in NLnet Labs Unbound 1.18.0 through 1.25.1 allows an off-path network attacker to defeat RFC 7873 DNS Cookie spoofing protections when Unbound is simultaneously configured with proxy-protocol-port and answer-cookie: yes. The RFC 9018 server-cookie SipHash is computed over the proxy node's wire-layer IP address rather than the PROXYv2-declared client address, meaning a single valid cookie harvested through any proxy node is reusable against every spoofed source behind that node. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the conceptual attack path is straightforward for any attacker with the ability to send one legitimate DNS query through the affected proxy infrastructure.
Memory corruption via use-after-free in NLnet Labs Unbound 1.25.0-1.25.1 can cause a DNS resolver crash under specific, non-default configurations when the server is under load. The flaw originates from a regression introduced in a fix enabling 'respip' and 'dns64' module interoperability: subqueries receive a shallow copy of the active view name, and if the parent query is evicted (jostled) before the subquery completes, the dangling reference causes memory corruption. No public exploit code exists and no confirmed active exploitation (CISA KEV) has been identified; the vendor explicitly describes crash likelihood as low due to dependence on memory layout and allocator behavior.
DNS cache poisoning risk in NLnet Labs Unbound 1.4.22 through 1.25.1 arises because the SO_REUSEPORT load balancing mechanism structurally leaks the secret entropy value - UDP source port randomization - that defends against Kaminsky-style attacks. Each worker thread is assigned a disjoint subset of source ports at startup, so an adjacent-network attacker who can observe Unbound's outgoing UDP queries to authoritative name servers can infer the thread-to-port-subset mapping and substantially reduce the port space to guess during a cache poisoning attempt. Proof-of-concept exploit code exists (CVSS 4.0 E:P); no confirmed active exploitation or CISA KEV listing has been identified.
Cache-clearing denial-of-service in NLnet Labs Unbound through 1.25.1 allows a remote attacker who controls a DNS delegation to indefinitely and repeatedly flush Unbound's message and rrset caches without sending a single spoofed packet. The attack exploits a logic flaw in how the iterator processes in-bailiwick glue records containing the unspecified address 0.0.0.0/::0: on Linux, such queries are routed via loopback and answered by 127.0.0.1, creating an IP mismatch that the unwanted-reply counter tallies until the configured threshold triggers a defensive cache clear - which resets the counter, enabling the loop to continue indefinitely. No public exploit identified at time of analysis; CVSS 3.1 scores this 5.3 (Medium) with Low availability impact and no confidentiality or integrity impact.
DNS response policy poisoning in NLnet Labs Unbound 1.7.0 through 1.25.1 allows an unauthenticated network attacker to become the authoritative XFR source for an auth/rpz zone by spoofing the configured primary hostname's A/AAAA record. The flaw stems from Unbound accepting a BOGUS-validated hostname resolution - one where DNSSEC validation has explicitly failed - as a valid zone transfer endpoint without requiring a valid RRSIG, violating the integrity guarantees DNSSEC is designed to enforce. Successful exploitation enables complete replacement of the resolver's response policy zone, making this a DNS firewall bypass with high real-world consequence for organizations relying on RPZ for threat blocking. No public exploit code has been identified at time of analysis.
DNS response policy rewriting in NLnet Labs Unbound 1.6.2 through 1.25.1 bypasses DNSSEC validation when the respip module is positioned ahead of the validator with response-ip or RPZ-IP redirect rules active. The rewriting handler fails to check upstream DNSSEC security status, allowing a spoofed BOGUS A/AAAA answer whose address falls within an operator-configured redirect subnet to be rewritten and returned to clients with a hardcoded INSECURE security level rather than being rejected as BOGUS. No public exploit code has been identified at time of analysis, but the integrity impact is concrete: clients receive silently misdirected responses that appear to pass through legitimate operator-controlled policy, undermining the core DNSSEC trust guarantee for affected deployments.
Use-after-free in NLnet Labs Unbound 1.15.0 through 1.25.1 crashes the DNS daemon via a dangling pointer to a freed TLS server name string in the DNS-over-TLS forwarding path. A remote attacker with knowledge of the target resolver's configuration can trigger the crash by sustaining query pressure against the configured DoT zone while inducing a transient upstream connection failure, causing denial of service. No public exploit code exists and this vulnerability has not been confirmed as actively exploited, but the network-accessible attack surface (PR:N) makes it relevant to operators running internet-facing recursive resolvers with DoT forwarding.
Quota bypass in NLnet Labs Unbound 1.22.0 through 1.25.1 allows a remote unauthenticated client to cause the resolver to send more upstream DNS packets per query than the operator-configured 'max-global-quota' limit. A single crafted query for a deeply nested hostname under a DNSSEC-signed parent zone triggers excessive recursive DNSSEC validation traffic, effectively neutralizing a security control designed to suppress upstream amplification. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
DNS cache poisoning in Unbound 1.6.0 through 1.25.1 allows a remote, unauthenticated attacker to inject a falsely DNSSEC-secure wildcard record into the resolver cache by exploiting a race condition on the serve-expired code path. The flaw arises because wildcard RRSET entries can be briefly marked secure after RRSIG validation but before NSEC validation completes, and a concurrent serve-expired thread can capture and propagate that intermediate secure status before it is corrected to bogus. No public exploit has been identified at time of analysis and CISA KEV does not list this vulnerability, but the integrity impact on DNSSEC-relying downstream clients makes it notable for operators running serve-expired in recursive resolver deployments.
DNS stub and forward zone resolution in NLnet Labs Unbound 1.13.2 through 1.25.1 is silently bypassed due to an off-by-one error in the default-enabled `harden-below-nxdomain` feature. When a configured stub or forward zone apex is nested two or more labels beneath a DNSSEC-signed public zone and the resolver cache holds a DNSSEC-secure NXDOMAIN for the intermediate label, the guard logic walks one label too far, causing the stub/forward upstream to be permanently shadowed without error. No public exploit has been identified at time of analysis and CVSS 3.7 with AC:H reflects the narrow but realistic conditions common in enterprise private namespace deployments.
Fatal application termination in NLnet Labs Unbound's libunbound library (up to and including 1.25.1) can be triggered remotely when the 'unwanted-reply-threshold' feature is enabled. An attacker controlling or able to spoof responses from an authoritative nameserver can flood the resolver with wrong-transaction-ID UDP datagrams until the threshold is crossed, causing libunbound to invoke 'libworker_alloc_cleanup' - a function absent from the internal allow list - resulting in a fatal exit that crashes the embedding application. Notably, standalone Unbound is unaffected because its counterpart function 'worker_alloc_cleanup' is correctly registered; only applications embedding libunbound are at risk. No public exploit code or CISA KEV listing has been identified at time of analysis.
Ghost domain name cache extension in Unbound DNS resolver 1.16.2 through 1.25.1 allows a network-based adversary who controls a ghost zone to overwrite cached expired parent-side A/AAAA glue records, extending the effective ghost domain window by up to one full cache-max-ttl period beyond expiry. A single crafted A/AAAA client query is sufficient to trigger the overwrite; on resolvers using the non-default harden-referral-path: yes directive, Unbound performs the lookup implicitly with no client query required at all. This is a variant of CVE-2026-40622, which addressed only the NS query path - no public exploit has been identified at time of analysis and no CISA KEV listing exists.
Resolution service degradation in NLnet Labs Unbound 1.22.0 through 1.25.1 enables unauthenticated remote attackers to silently drop DNS responses for new clients by exploiting a resource-accounting flaw in the DNS-over-QUIC (DoQ) subsystem. Attackers send DoQ queries for names that trigger upstream resolution and immediately terminate them using QUIC STOP_SENDING, RESET_STREAM, or CONNECTION_CLOSE frames, causing Unbound's internal wait-reply counter to inflate indefinitely without release. When the counter ceiling is reached, new clients querying the same in-flight names receive no response. No public exploit has been identified at time of analysis; exploitation is constrained by non-default DoQ configuration requirements and the need for multiple source IPs.
Denial of service in NLnet Labs Unbound 1.22.0 through 1.25.1 causes server termination when DNS-over-QUIC (DoQ) is enabled and the resolver operates under high concurrency. Unbound incorrectly passes realtime clock values to libngtcp2 where monotonic timestamps are required; under load, the resulting assertion failure in libngtcp2 abruptly kills the Unbound process. No public exploit code exists and no active exploitation has been reported, but the self-termination of a DNS resolver constitutes a severe availability impact for any infrastructure depending on it.
Routinator, NLnet Labs' RPKI relying-party validator, can be driven into memory exhaustion by an AS range in RPKI data whose maximum value is lower than its minimum, leaving the validator unable to continue. The issue is remotely reachable without authentication per the CVSS vector and affects availability only; exploitation requires an attacker to place the malformed range into RPKI objects that a target Routinator instance fetches and validates. No CISA KEV entry or public exploit code is identified in the supplied data.
Routinator exits when it encounters an RRDP-delivered rsync URI whose path cannot be stored on disk, producing a denial of service in RPKI validation. The flaw affects Routinator instances that fetch repository content over RRDP (the default transport) and validate a publication point the attacker operates, compromises, or otherwise controls; an arbitrary off-path attacker cannot trigger it. The assessed impact is availability-only (CVSS 7.5), with no confidentiality or integrity effect, and no public exploit identified at time of analysis.
Routinator, NLnet Labs' RPKI relying-party validator, can be hung or terminated by a CRL fetched from the repository hierarchy it validates: a CRL carrying a very large number of entries drives the hang or out-of-memory path, while a CRL with an incorrect encoding causes the process to exit, producing an availability-only denial of service (CVSS 7.5, A:H, with no confidentiality or integrity impact). The CPE entry cpe:2.3:a:nlnet_labs:routinator is unversioned, so all releases are presumed affected until the vendor advisory names fixed versions. No public exploit code and no confirmed active exploitation were identified at time of analysis; the practical barrier is that an attacker must be able to serve the crafted CRL from a repository or CA inside a trusted RPKI validation path, and no authentication to Routinator itself is required.
Routinator, NLnet Labs' RPKI relying party validator, mishandles RRDP notification files by accepting delta entries with gaps and by not safely handling an excessive number of delta entries. A malicious or compromised RPKI publication point, or a network-path attacker able to serve crafted RRDP content, can cause incomplete RPKI data (integrity impact) or memory exhaustion and a crash (availability impact). No public exploit code or confirmed active exploitation is identified in the supplied data.
Denial of service in NLnet Labs Unbound versions 1.22.0 through 1.26.1, where a remote DNS-over-QUIC client can crash the resolver by triggering a QUIC path migration at the moment a mesh reply still holds a pointer to the associated DoQ stream. The resulting use-after-free dereferences the freed stream when the pending reply completes, terminating the process and interrupting DNS resolution for all clients of that instance. Exploitation is race-dependent and only possible when DoQ is enabled and Unbound runs multi-threaded; no public exploit code was identified and the issue is not confirmed actively exploited (CISA KEV), so this is a genuine but bounded availability risk rather than a wormable or data-exposing flaw.
Stack-based buffer overflow in NLnet Labs NSD's zone-file RDATA parser allows an attacker with the ability to supply a crafted primary zone file to perform out-of-bounds stack writes, including overwriting a callback function pointer that is invoked immediately after parsing, which can lead to arbitrary code execution. The vulnerable path requires direct ingestion of a specially formatted zone file; NSD-generated zone files, including those for secondary zones received by transfer, are not formatted in the triggering way and will not exploit the flaw. No public exploit code or confirmed active exploitation is identified in the available intelligence, and the assessed vector requires low privileges (PR:L) through local or zone-supply access rather than ordinary remote DNS queries.
Loading a crafted zone file into NLnet Labs NSD can overflow a stack buffer and overwrite up to 191 bytes with attacker-controlled data, which can corrupt control flow in the name server process and lead to code execution or a crash. The trigger is a HIP resource record whose RDATA is filled to (or near) its size limit and which also carries a second dname RDATA field, the HIP Rendezvous server; the bug lives in zone-file parsing, so it is not reachable through ordinary DNS query traffic, and zones NSD writes out itself - including secondary zones learned via zone transfer - are not formatted in the vulnerable way. Exploitation therefore requires the attacker to control zone-file content fed directly to NSD, for example through an operator-controlled provisioning or automation pipeline; no public exploit code was identified at time of analysis, and the vendor's CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N, score 8.7) overstates practical remote risk relative to the assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8 High). Authentication is required per the supplied vectors (PR:L), which corresponds in practice to a low-privileged position able to supply zone-file content to the daemon.
A stack-based buffer overflow in NLnet Labs NSD's parsing of SVCB/HTTPS resource records allows an attacker who can supply a crafted zone file to corrupt memory and potentially achieve arbitrary code execution. The flaw is triggered when the RDATA is filled to the wire-format limit and an ECH parameter overflows the stack, after which the base64 decoder can write attacker-controlled data of unlimited size. Exploitation requires that the crafted zone file be fed directly to NSD; zone files written by NSD itself (e.g., secondary zones) are not affected. The attacker must control or inject into the zone-provisioning path, such as a multi-tenant zone-submission pipeline, and authentication requirements are low-privileged per the CVSS vector (PR:L). No public exploit or in-the-wild exploitation has been identified at time of analysis.
Stack-based buffer overflow in NLnet Labs NSD is triggered when the daemon parses a zone file containing base64 data split into chunks of three characters or fewer, causing the token length calculation to yield zero bytes and letting an attacker overwrite up to 64K of stack memory with attacker-controlled data, with likely code-execution impact. Our independent assessment rates this CVSS 3.1 AV:L/AC:L/PR:L/UI:N with High confidentiality, integrity and availability impact, reflecting that the attacker must control zone-file content fed directly to NSD (PR:L, i.e., write/submit access to the zone input path) - it is not reachable through normal DNS queries and does not affect zone files NSD generates itself, such as zones for which the instance is secondary. The vendor rates it CVSS 4.0 8.7 (High) with AV:N/PR:L; patch availability is not confirmed in the provided data, and no public exploit code or CISA KEV activity was identified at time of analysis.
Denial-of-service through algorithmic complexity attacks in NLnet Labs Unbound up to and including 1.26.0 can degrade or exhaust CPU resources in DNSSEC-validating recursive resolvers when they are made to validate attacker-controlled malicious zones. The flaw, part of the 'ReTrap' research family (TagTrap, DelegationTrap, NsecTrap and AdditionalTrap), is reachable by any client that can induce the resolver to look up names under an attacker-controlled domain, and unauthenticated remote attackers can trigger it per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Exploitation status: no public exploit identified at time of analysis, and CISA KEV does not list this CVE; EPSS is low at 0.31% (24th percentile), and SSVC rates exploitation as 'none' with partial technical impact. Note that the vendor's published CVSS of 7.5 is higher than our independent assessment of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (moderate, availability-only), and this analysis follows the moderated view: real but manageable risk, with service degradation rather than confidentiality or integrity loss.
Heap-based memory corruption in NLnet Labs Unbound up to and including 1.26.0 lets a remote, unauthenticated attacker who controls or spoofs the upstream DNS response (PR:N/UI:N) gradually overwrite heap memory, with the reliable outcome being a crash and remote code execution possible only on certain systems and compilation options that lack hardening. The flaw is scored CVSS 8.4 (CVSS:4.0) and by the independent assessment as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, with the high attack complexity reflecting heavy dependence on heap layout and non-deterministic results. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no KEV listing or EPSS signal is present, so this is a genuine but not-yet-urgent priority for internet-facing recursive resolvers.
A crafted DNSKEY whose owner name is a compression pointer into its own RDATA overflows the digest buffer in the DNSSEC validator of NLnet Labs Unbound 1.26.0 and earlier, letting an attacker who controls an authoritative zone crash a validating recursive resolver and, depending on heap layout, potentially execute code with attacker-influenced data. Exploitation is unauthenticated over the network per the CVSS vectors but is gated on DNSSEC validation being active and on inducing the resolver to query a name in the attacker's zone; the independently assessed impact is primarily denial of service (availability High, confidentiality and integrity Low), with remote code execution only possible rather than demonstrated. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, although the vendor rates the issue 9.1 under CVSS 4.0 and an advisory has been published.
Heap buffer overflow in NLnet Labs Unbound 1.26.0 and earlier can be triggered when a resolver processing a large TCP-framed DNS response encounters an RRSet whose owner name reaches the 255-byte maximum, crashing the resolver process and yielding a denial of service (availability-only impact, C:N/I:N/A:H). An attacker must either operate an authoritative name server that the victim resolver queries or hold an on-path position to tamper with an incoming DNS response, and the malicious answer must be delivered over TCP, be large, and carry the maximal-length owner name; crafting and delivering that payload raises practical complexity above the vendor's AC:L rating, which is why our assessment uses AC:H. No public exploit code or confirmed active exploitation has been identified at time of analysis, and because canonicalisation runs before DNSSEC validation, signature validation does not mitigate the issue. NLnet Labs has published an advisory at https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81634.txt.
Degradation of service in NLnet Labs Unbound up to and including 1.26.0 allows an unauthenticated remote attacker to monopolize a single resolver worker's event loop by streaming a sustained rate of distinct, uncached DNS names over a TCP or DNS-over-TLS (DoT) connection, keeping the attacker's writes ahead of the server's read drain. There is no limit on consecutive reads in the TCP/DoT reading procedure (CWE-770), so the affected worker cannot service other clients for as long as the flood is maintained; because impact is confined to the worker handling the malicious connection, multi-worker deployments retain partial service and availability impact is partial rather than total. Exploitation requires only network reachability to an exposed TCP/DoT listener with no authentication or user interaction (PR:N/UI:N), but no public exploit code has been identified, CISA SSVC rates exploitation as none, and EPSS is low at 0.31% (24th percentile), making this a modest-priority availability issue rather than a widespread-exploitation emergency; vendor patches are available.
NSD's proxy protocol port fails to re-evaluate BLOCKED access control list entries on the second DNS query sent over a kept-open TCP or TLS connection, allowing a remote unauthenticated attacker to bypass ACL denials that should have blocked the request. NLnet Labs reported this against all NSD versions (CPE wildcard scope), classifying it under CWE-290 as an authentication bypass by spoofing. No public exploit code has been identified at time of analysis, but the bypass mechanic - sending a query twice on the same persistent connection - is mechanically trivial once the proxy protocol port is reachable.
NSD authoritative DNS server crashes serve child processes when receiving a crafted DNS message containing exactly 17 DNS Cookie options with a UDP payload size of 512 bytes, triggering a reachable assertion (CWE-617). This condition exists exclusively in debugging and non-release build types - standard production release builds are immune. Remote unauthenticated attackers can continuously respawn-crash serve children to severely degrade or fully deny DNS resolution service; no public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
IP range-based access control in NLnet Labs NSD is silently broken on little-endian systems due to an endianness mismatch in the range comparison logic. Both IPv4 and IPv6 addresses are compared as unsigned 32-bit integers using host byte order, while the actual stored values are in network byte order (big-endian), causing comparisons to produce incorrect results on the dominant x86/x86-64/ARM-LE server platforms. The practical consequence is a bidirectional access control bypass: operators relying on hyphen-range ACL syntax may inadvertently permit unauthorized IP addresses to access restricted DNS operations (such as zone transfers) while simultaneously denying legitimate clients. No public exploit has been identified at time of analysis, but the flaw is fully deterministic and requires no special attacker capability beyond network reachability.
Remote denial-of-service in NLnet Labs Unbound 1.23.0 through 1.25.1 lets an attacker who controls a delegated DNS zone crash the resolver daemon with a single crafted upstream response, but only when the non-default 'dns-error-reporting: yes' option is enabled. The flaw is a stack write triggered while building a DNS Error Report query name from a malformed EDNS Report-Channel option (code 18). No public exploit has been identified at time of analysis and it is not listed in CISA KEV; the CVSS 7.5 reflects a pure availability impact (A:H) with no data disclosure despite the vendor's 'Information Disclosure' tag.
DNS cache poisoning in NLnet Labs Unbound (1.7.0 through 1.25.1) lets an actor who controls a single delegated zone under an NSEC-signed parent forge insecure DNS answers for unrelated sibling zones sharing that parent. The root cause is insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing, allowing fraudulent wildcard DS records to bring non-existent delegations into 'insecure' existence and inject spoofed records. Reported by NLnet Labs with a 7.5 (High) integrity-only CVSS; no public exploit identified at time of analysis and no EPSS/KEV data supplied.
Remote denial-of-service in NLnet Labs Unbound 1.9.0 through 1.25.1 allows an unauthenticated attacker to crash the recursive DNS resolver by sending a single malicious encrypted DNSCrypt query over TCP. The TCP in-place encryption routine omits the reply-length clamp that protects the UDP path, so an oversized reply is shifted 48 bytes forward past the end of a heap allocation sized to 'msg-buffer-size' (CWE-122). Only builds compiled with '--enable-dnscrypt' and an active 'dnscrypt:' clause are affected; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Remote denial of service in NLnet Labs Unbound 1.22.0 through 1.25.1 lets an unauthenticated client exhaust configured memory when downstream DNS-over-QUIC (DoQ) is enabled. The first two bidirectional QUIC streams (stream_id 0 and 4) skip the per-stream 'quic-size' accounting gate, so large input buffers are allocated after only a 2-byte length prefix arrives, letting a single connection with two streams force Unbound to allocate roughly double the configured limit at near-zero attacker cost. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the mechanics are trivial and fully described by the vendor advisory.
Zone-transfer authentication bypass in NLnet Labs NSD allows unauthorized secondaries to obtain full zone contents without presenting the required TLS client certificate. Although a provide-xfr rule specifies a tls-auth-name (mandating client-certificate authentication), NSD only enforces this on the dedicated tls-auth-port; requests arriving over plain TCP on the regular port or over TLS on the regular tls-port are served when the remaining provide-xfr conditions match, defeating mutual-TLS access control. Reported by NLnet Labs with CVSS 4.0 8.2; no public exploit identified at time of analysis and not listed in CISA KEV.
Stack buffer overflow in NSD 4.14.0 (NLnet Labs authoritative DNS server) allows a party able to introduce zone data to overwrite up to 111 attacker-controlled bytes on the stack when a specially crafted APL resource record - carrying an adflength larger than the address family permits - is serialized as the zone is written to disk. Per the CVSS 4.0 vector (PR:L), exploitation requires low privileges and yields high integrity and availability impact, consistent with memory corruption leading to crash or potential code execution. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Remote denial-of-service in NLnet Labs NSD (authoritative DNS name server) version 4.13.0 and later allows an unauthenticated attacker to crash the server process by exploiting a heap use-after-free in the TLS error-logging path. By sending a DNS query over a DNS-over-TLS (DoT) connection and closing the socket before reading the response, an attacker triggers the freed-memory access trivially; no public exploit identified at time of analysis, and the issue is not in CISA KEV. The CVSS 4.0 score of 8.7 reflects high availability impact with no confidentiality or integrity exposure.
Heap overflow in NLnet Labs NSD allows a malicious or compromised zone primary to corrupt memory on a secondary (slave) NSD instance by sending an AXFR transfer containing a crafted SVCB resource record. An rdata size of 65512 causes a uint16_t length variable used for RR allocation to wrap (total size exceeds 65535), producing an undersized buffer and a controlled out-of-bounds write of up to 65509 bytes - an RCE-class primitive (CWE-190 integer overflow leading to heap overflow). No public exploit identified at time of analysis, but the controlled write and remote network vector (CVSS 4.0 base 8.7) make this a high-priority patch for any operator running NSD as a secondary.
Off-path DNS response spoofing in NLnet Labs ldns 1.2.0 through 1.9.0 allows remote attackers to inject forged answers into applications that use the library as a UDP stub resolver, including the bundled drill tool. The library fails to validate the response source address/port, the query transaction ID, and the question section against the original query, making cache and answer poisoning feasible without on-path positioning. No public exploit identified at time of analysis, but the CVSS 4.0 score of 8.2 reflects high integrity impact on any downstream application that trusted ldns to validate DNS answers.
Denial of service in NLnet Labs Routinator allows remote attackers to crash the RPKI validator by serving a crafted Document Type Definition (DTD) inside RRDP repository content. Exploitation requires no authentication or user interaction (CVSS 4.0 8.7, VA:H), and no public exploit identified at time of analysis. A successful crash halts RPKI relying-party processing, which can degrade route origin validation for networks that depend on Routinator output.
Denial of service in NLnet Labs Routinator (an RPKI Relying Party software) allows remote attackers to crash the daemon by sending a specifically crafted non-UTF-8 string in the select-asn query parameter to the /api/v1/origins HTTP endpoint. The flaw only impacts deployments that expose the API to untrusted networks, and no public exploit has been identified at time of analysis. CVSS 4.0 base score is 8.2 driven by high availability impact to both the vulnerable component and downstream RPKI consumers.
Path traversal in NLnet Labs Routinator allows remote attackers to escape the rsync cache directory by supplying rsync URIs whose module component contains '..' sequences, enabling read/write access across the entire Routinator rsync cache filesystem. The flaw is network-reachable and requires no authentication, and no public exploit identified at time of analysis. CVSS 4.0 of 8.3 reflects high integrity and availability impact with an attack requirement (AT:P) reducing it from critical.
Denial of service in NLnet Labs Routinator allows remote unauthenticated attackers to crash the daemon by opening a large number of HTTP or RTR connections, exhausting file descriptors and triggering an unrecoverable exit. Only deployments exposing the HTTP or RTR server to untrusted networks are affected. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Resource exhaustion in NLnet Labs Routinator lets an attacker make the validator's HTTP server unavailable by opening a large number of connections that are never closed, consuming its finite open-connection capacity (CVSS 5.3, availability-only). Only operators who deliberately expose Routinator's HTTP or RTR server to untrusted networks are reachable; in a standard deployment bound to localhost or trusted internal networks the flaw is not remotely exposed. No KEV listing and no public exploit identified at time of analysis, so urgency is driven by deployment topology rather than an active campaign.
Routinator writes a newly retrieved trust anchor (TA) certificate fetched over HTTPS into its cache even when that certificate fails validation, so a failed update can overwrite the previously cached, known-good TA and leave the validator working from bad trust anchor material. Only deployments whose TAL points at an https:// TA URI are exposed, and the attacker must already hold the privileged position over that retrieval channel implied by PR:H - impact is limited to partial integrity and availability loss for RPKI validation (I:L/A:L, CVSS 3.8, C:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the priority signal is monitor.
NLnet Labs Routinator, an RPKI relying party validator, can be driven into memory exhaustion by a flood of concurrent requests to its HTTP JSON output endpoint, and can also abort with a stack overflow when a payload item carrying excessive metadata is discarded in a single operation. Only deployments that expose the HTTP or RTR server to untrusted networks are affected; the flaw is availability-only (no confidentiality or integrity impact), requires no authentication or user interaction, and no public exploit code was identified at the time of analysis. Vendor severity is 6.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), while the independent assessment rates the attack vector as network (AV:N) rather than adjacent, and the priority decision is this_month.
NLnet Labs Unbound through 1.26.1 can be driven to excessive CPU consumption by DNS responses containing many chained compression pointers, degrading resolver performance for legitimate clients. The root cause is that Unbound caps pointer traversal per domain-name operation but lacks an aggregate budget for inbound decompression work, allowing repeated expensive lookups within a single crafted message. The vendor rates this 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L); exploitation requires recursive-query access plus control of an ordinarily delegated authoritative server, and no public exploit identified at time of analysis.
NLnet Labs Unbound up to and including 1.26.1 can be tricked into downgrading a validly signed island-of-security zone to insecure status by a forged NXDOMAIN response, allowing an attacker to deny the existence of records inside that trusted island. The flaw only manifests in the non-default configuration where a root trust anchor and an explicit 'trust-anchor:' statement for an island-of-security zone are both present and the island's parent is provably insecure under the root chain; the attacker must also be positioned to deliver a crafted NXDOMAIN carrying an NSEC/SOA RRSIG whose SignerName names the insecure parent. No public exploit code or confirmed active exploitation was identified at time of analysis, and the high attack complexity and specialized configuration keep practical risk moderate (CVSS 6.5, AV:N/AC:H/PR:N/UI:N/C:N/I:L/A:H).
Unbound 1.0.1 through 1.26.1 can be induced to downgrade a configured island-of-security trust anchor to insecure when a remote unauthenticated attacker injects a forged NSEC response with the SOA bit cleared. The flaw affects only resolvers configured with both a root trust anchor and an additional trust-anchor for an island whose parent is provably insecure under the root chain, and it causes the DNSSEC validator to accept and cache the NSEC without the required RRSIG validation. Impact is integrity-only (CVSS 3.7, AC:H), and no public exploit code was identified at time of analysis.
NLnet Labs Unbound through 1.26.1 can expose a cache-level side-channel when operators explicitly configure unwanted-reply-threshold greater than 0, a non-default setting. An external observer who can send response-like UDP datagrams to the resolver’s current upstream source port can use the resulting RRset/message-cache clear as an oracle to test whether a candidate port is in use; by keeping a concurrent query window open and then performing birthday-style TXID guessing, this can become a feasible cache-poisoning path. The issue is assessed as low-to-moderate risk, with no public exploit identified at time of analysis.
Denial of service in NLnet Labs Unbound 1.12.0 through 1.26.0 arises from a use-after-free in the DNS-over-HTTPS (DoH) code path, reachable only in builds compiled with --with-libnghttp2 when failure conditions such as an RPZ drop action or heavy-traffic stream jostling occur. A remote, unauthenticated attacker can trigger the flaw with a single DoH connection and appropriate traffic, causing memory corruption that, under a hardened allocator, results in controlled termination of the Unbound process. No public exploit code has been identified at time of analysis; the impact is confined to availability (CVSS 5.9, C:N/I:N/A:H) with no confidentiality or integrity effect.
Unbound versions 1.22.0 through 1.26.1 built with DNS-over-QUIC support (--with-libngtcp2) can be driven to an abnormal exit by an unauthenticated remote attacker who manipulates QUIC stream state. The attacker sends a DoQ query, withholds ACKs, issues RESET_STREAM to free the per-stream output buffer, then waits for a PTO timeout so ngtcp2 re-encodes a STREAM frame from the freed memory; a spray of roughly 20 such queries forces the daemon down. Default builds compiled without QUIC support are not affected, and exploitation also requires precise timing against the QUIC state machine, making this a moderate, configuration-gated availability threat rather than a top-tier priority. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the authoritative assessment rates it AV:N/AC:H/PR:N/UI:N/S:U with low confidentiality and high availability impact, so the practical outcome is denial of service against the resolver rather than broad data compromise.
Unbound 1.13.2 through 1.26.1 can serve tampered contents of a ZONEMD-checked zone that sits below - but not at - a DNSSEC trust anchor, because the DS/DNSKEY chain resolution needed to validate the zone must complete asynchronously and the zone data is released (and, with the zonefile: option, written to disk) before the ZONEMD digest check concludes. In memory the exposure is self-correcting: once verification fails the data stops being served, but a tampered copy written to disk persists and is reloaded at the next startup until verification again concludes. Per the independent assessment this is a low-to-moderate integrity/authenticity issue (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N; vendor score 4.4) requiring a non-default zone/trust-anchor topology and precise timing, with no confidentiality or availability impact and no public exploit identified at time of analysis.
NLnet Labs Unbound 1.20.0 through 1.26.0 can be made to accumulate an unbounded number of pending recursive queries from a single source IP because a double decrement on the per-client 'wait-limit' counter occurs on the 'serve-expired' code path. A remote, unauthenticated attacker who controls an authoritative zone with short TTLs alternates a deliberately unanswered 'slow' query with a 'pump' query for an expired cached name, keeping the counter at or below the configured limit and eventually filling a thread's global mesh quota (num-queries-per-thread), thereby bypassing one of the countermeasures introduced for DNSBomb (CVE-2024-33655). Impact is availability-only and limited (CVSS 3.7, AC:H, A:L) and depends on the non-default 'serve-expired' feature; no public exploit has been identified at time of analysis.
TCP window throttling in NLnet Labs NSD allows any unauthenticated remote attacker to crash individual serve child processes by deliberately shrinking the TCP receive window to near-zero after issuing a DNS query over TCP, triggering an integer underflow (CWE-191). By repeating this pattern continuously, the attacker can deny all TCP-based DNS service from the affected NSD instance. No public exploit code has been identified at time of analysis, and the CVSS 4.0 score of 6.9 reflects moderate availability impact with zero confidentiality or integrity exposure.
Counter exhaustion in NLnet Labs Unbound 1.20.0 through 1.25.1 enables a remote attacker to degrade DNS resolution service by triggering a missing decrement in the serve-expired discard-timeout code path. The reply-address counter for duplicate in-flight queries is never decremented when the discard-timeout branch fires under a specific non-default misconfiguration, allowing an attacker controlling a slow authoritative zone to drive the counter to its maximum and cause silent query drops for legitimate clients. No public exploit identified at time of analysis; however, the vulnerability is exploitable remotely with no authentication required once the misconfiguration is in place.
Heap buffer overflow in NLnet Labs Unbound up to and including 1.25.1 allows a network attacker who controls a DNSSEC-signed authoritative server to corrupt heap memory or crash the resolver by serving a PX, RP, MINFO, or SOA record with RDATA truncated to omit the expected second embedded domain name. The DNSSEC validator's canonical RDATA construction routine computes a pointer to the absent second domain name and passes it unchecked to query_dname_tolower(), which then walks label-by-label through stale bytes in the per-worker env->scratch_buffer - overflowing the heap allocation when msg-buffer-size is configured below its default. No public exploit has been identified at time of analysis; exploitation is constrained by the AC:H requirement for attacker control of a DNSSEC-signed zone.
Remote unauthenticated termination of Unbound 1.22.0 through 1.25.1 is possible via a crafted DNS-over-QUIC (DoQ) connection that exploits a signed-to-unsigned integer conversion error when Unbound mishandles the NGTCP2_ERR_STREAM_DATA_BLOCKED error condition. The flaw propagates an implicit conversion of the C literal `-1` to a 64-bit unsigned integer (0xFFFFFFFFFFFFFFFF), which exceeds the 62-bit QUIC varint ceiling and triggers a libngtcp2 assertion that aborts the entire resolver process. Exploitation is deterministic - a single QUIC connection with one crafted transport parameter and one DNS query is sufficient - though the attack surface is constrained to deployments compiled with assertions enabled and DoQ actively configured. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Crash-triggering memory corruption in Unbound's DNSCrypt subsystem allows any unauthenticated network client to kill the DNS resolver with a single UDP packet. Affected versions 1.7.0 through 1.25.1, compiled with DNSCrypt support, miscount valid key slots when the dnscrypt-provider-cert list outnumbers dnscrypt-secret-key entries, leaving tail slots filled with libsodium's 0xdb debug pattern; iterating beyond valid bounds then dereferences that garbage. No public exploit has been identified at time of analysis, and no KEV listing exists, but the trigger condition is trivially constructable - one 68-byte UDP datagram.
Denial of service in NLnet Labs Unbound 1.10.0 through 1.25.1 allows a remote attacker controlling any delegated DNS zone to crash the resolver daemon via a NULL pointer dereference. The vulnerable path is activated only when both the serve-expired feature and a response-ip or RPZ CNAME redirect rule are configured simultaneously; the serve-expired-client-timeout callback's two-pass CNAME alias loop resets alias_rrset on the second pass without resetting partial_rep, causing an eventual null dereference and process crash. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but the network-accessible attack surface makes it a meaningful availability risk for any resolver running these co-configured features.
Policy bypass in NLnet Labs Unbound 1.6.0 through 1.25.1 causes DNS queries for default-protected zones - including RFC 1918 reverse zones, AS112 zones, .onion, and .localhost - to escape to public recursive resolvers instead of being answered locally. The root cause is that the unbound-control commands view_local_data and view_local_datas, when issued against a named view that was initially configured with no local data, create a bare local zones tree that omits the expected default-protected zone entries. Clients mapped to that view subsequently receive answers from the public internet for names that are supposed to be handled locally, silently subverting operator-defined DNS policy. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
DNS Cookie bypass in NLnet Labs Unbound 1.18.0 through 1.25.1 allows an off-path network attacker to defeat RFC 7873 DNS Cookie spoofing protections when Unbound is simultaneously configured with proxy-protocol-port and answer-cookie: yes. The RFC 9018 server-cookie SipHash is computed over the proxy node's wire-layer IP address rather than the PROXYv2-declared client address, meaning a single valid cookie harvested through any proxy node is reusable against every spoofed source behind that node. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the conceptual attack path is straightforward for any attacker with the ability to send one legitimate DNS query through the affected proxy infrastructure.
Memory corruption via use-after-free in NLnet Labs Unbound 1.25.0-1.25.1 can cause a DNS resolver crash under specific, non-default configurations when the server is under load. The flaw originates from a regression introduced in a fix enabling 'respip' and 'dns64' module interoperability: subqueries receive a shallow copy of the active view name, and if the parent query is evicted (jostled) before the subquery completes, the dangling reference causes memory corruption. No public exploit code exists and no confirmed active exploitation (CISA KEV) has been identified; the vendor explicitly describes crash likelihood as low due to dependence on memory layout and allocator behavior.
DNS cache poisoning risk in NLnet Labs Unbound 1.4.22 through 1.25.1 arises because the SO_REUSEPORT load balancing mechanism structurally leaks the secret entropy value - UDP source port randomization - that defends against Kaminsky-style attacks. Each worker thread is assigned a disjoint subset of source ports at startup, so an adjacent-network attacker who can observe Unbound's outgoing UDP queries to authoritative name servers can infer the thread-to-port-subset mapping and substantially reduce the port space to guess during a cache poisoning attempt. Proof-of-concept exploit code exists (CVSS 4.0 E:P); no confirmed active exploitation or CISA KEV listing has been identified.
Cache-clearing denial-of-service in NLnet Labs Unbound through 1.25.1 allows a remote attacker who controls a DNS delegation to indefinitely and repeatedly flush Unbound's message and rrset caches without sending a single spoofed packet. The attack exploits a logic flaw in how the iterator processes in-bailiwick glue records containing the unspecified address 0.0.0.0/::0: on Linux, such queries are routed via loopback and answered by 127.0.0.1, creating an IP mismatch that the unwanted-reply counter tallies until the configured threshold triggers a defensive cache clear - which resets the counter, enabling the loop to continue indefinitely. No public exploit identified at time of analysis; CVSS 3.1 scores this 5.3 (Medium) with Low availability impact and no confidentiality or integrity impact.
DNS response policy poisoning in NLnet Labs Unbound 1.7.0 through 1.25.1 allows an unauthenticated network attacker to become the authoritative XFR source for an auth/rpz zone by spoofing the configured primary hostname's A/AAAA record. The flaw stems from Unbound accepting a BOGUS-validated hostname resolution - one where DNSSEC validation has explicitly failed - as a valid zone transfer endpoint without requiring a valid RRSIG, violating the integrity guarantees DNSSEC is designed to enforce. Successful exploitation enables complete replacement of the resolver's response policy zone, making this a DNS firewall bypass with high real-world consequence for organizations relying on RPZ for threat blocking. No public exploit code has been identified at time of analysis.
DNS response policy rewriting in NLnet Labs Unbound 1.6.2 through 1.25.1 bypasses DNSSEC validation when the respip module is positioned ahead of the validator with response-ip or RPZ-IP redirect rules active. The rewriting handler fails to check upstream DNSSEC security status, allowing a spoofed BOGUS A/AAAA answer whose address falls within an operator-configured redirect subnet to be rewritten and returned to clients with a hardcoded INSECURE security level rather than being rejected as BOGUS. No public exploit code has been identified at time of analysis, but the integrity impact is concrete: clients receive silently misdirected responses that appear to pass through legitimate operator-controlled policy, undermining the core DNSSEC trust guarantee for affected deployments.
Use-after-free in NLnet Labs Unbound 1.15.0 through 1.25.1 crashes the DNS daemon via a dangling pointer to a freed TLS server name string in the DNS-over-TLS forwarding path. A remote attacker with knowledge of the target resolver's configuration can trigger the crash by sustaining query pressure against the configured DoT zone while inducing a transient upstream connection failure, causing denial of service. No public exploit code exists and this vulnerability has not been confirmed as actively exploited, but the network-accessible attack surface (PR:N) makes it relevant to operators running internet-facing recursive resolvers with DoT forwarding.
Quota bypass in NLnet Labs Unbound 1.22.0 through 1.25.1 allows a remote unauthenticated client to cause the resolver to send more upstream DNS packets per query than the operator-configured 'max-global-quota' limit. A single crafted query for a deeply nested hostname under a DNSSEC-signed parent zone triggers excessive recursive DNSSEC validation traffic, effectively neutralizing a security control designed to suppress upstream amplification. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
DNS cache poisoning in Unbound 1.6.0 through 1.25.1 allows a remote, unauthenticated attacker to inject a falsely DNSSEC-secure wildcard record into the resolver cache by exploiting a race condition on the serve-expired code path. The flaw arises because wildcard RRSET entries can be briefly marked secure after RRSIG validation but before NSEC validation completes, and a concurrent serve-expired thread can capture and propagate that intermediate secure status before it is corrected to bogus. No public exploit has been identified at time of analysis and CISA KEV does not list this vulnerability, but the integrity impact on DNSSEC-relying downstream clients makes it notable for operators running serve-expired in recursive resolver deployments.
DNS stub and forward zone resolution in NLnet Labs Unbound 1.13.2 through 1.25.1 is silently bypassed due to an off-by-one error in the default-enabled `harden-below-nxdomain` feature. When a configured stub or forward zone apex is nested two or more labels beneath a DNSSEC-signed public zone and the resolver cache holds a DNSSEC-secure NXDOMAIN for the intermediate label, the guard logic walks one label too far, causing the stub/forward upstream to be permanently shadowed without error. No public exploit has been identified at time of analysis and CVSS 3.7 with AC:H reflects the narrow but realistic conditions common in enterprise private namespace deployments.
Fatal application termination in NLnet Labs Unbound's libunbound library (up to and including 1.25.1) can be triggered remotely when the 'unwanted-reply-threshold' feature is enabled. An attacker controlling or able to spoof responses from an authoritative nameserver can flood the resolver with wrong-transaction-ID UDP datagrams until the threshold is crossed, causing libunbound to invoke 'libworker_alloc_cleanup' - a function absent from the internal allow list - resulting in a fatal exit that crashes the embedding application. Notably, standalone Unbound is unaffected because its counterpart function 'worker_alloc_cleanup' is correctly registered; only applications embedding libunbound are at risk. No public exploit code or CISA KEV listing has been identified at time of analysis.
Ghost domain name cache extension in Unbound DNS resolver 1.16.2 through 1.25.1 allows a network-based adversary who controls a ghost zone to overwrite cached expired parent-side A/AAAA glue records, extending the effective ghost domain window by up to one full cache-max-ttl period beyond expiry. A single crafted A/AAAA client query is sufficient to trigger the overwrite; on resolvers using the non-default harden-referral-path: yes directive, Unbound performs the lookup implicitly with no client query required at all. This is a variant of CVE-2026-40622, which addressed only the NS query path - no public exploit has been identified at time of analysis and no CISA KEV listing exists.
Resolution service degradation in NLnet Labs Unbound 1.22.0 through 1.25.1 enables unauthenticated remote attackers to silently drop DNS responses for new clients by exploiting a resource-accounting flaw in the DNS-over-QUIC (DoQ) subsystem. Attackers send DoQ queries for names that trigger upstream resolution and immediately terminate them using QUIC STOP_SENDING, RESET_STREAM, or CONNECTION_CLOSE frames, causing Unbound's internal wait-reply counter to inflate indefinitely without release. When the counter ceiling is reached, new clients querying the same in-flight names receive no response. No public exploit has been identified at time of analysis; exploitation is constrained by non-default DoQ configuration requirements and the need for multiple source IPs.
Denial of service in NLnet Labs Unbound 1.22.0 through 1.25.1 causes server termination when DNS-over-QUIC (DoQ) is enabled and the resolver operates under high concurrency. Unbound incorrectly passes realtime clock values to libngtcp2 where monotonic timestamps are required; under load, the resulting assertion failure in libngtcp2 abruptly kills the Unbound process. No public exploit code exists and no active exploitation has been reported, but the self-termination of a DNS resolver constitutes a severe availability impact for any infrastructure depending on it.