Executive brief
Unbound is a widely used DNS resolver that translates human-readable domain names into IP addresses. A vulnerability in its security validation component allows an attacker to crash the service or potentially take control of the server by hosting a malicious domain. This could lead to a total service outage or unauthorized access to the network infrastructure.
Technical details
A use-after-free vulnerability exists in the DNSSEC validator of Unbound due to a struct-assignment bug during deep-copy operations. When NSEC3 computational budgets are exhausted, Unbound attempts to preserve response messages across memory region teardowns by deep-copying data structures; however, it erroneously overwrites a destination pointer with a source pointer. When the sub-query memory region is subsequently freed and the validator resumes, it dereferences this dangling pointer. An unauthenticated remote attacker can trigger this by controlling a malicious signed zone and sending specific queries to the vulnerable resolver. This can result in a daemon crash (DoS) or arbitrary code execution. The issue is fixed in version 1.25.1.
Affected products
- NLnet Labs Unbound 1.19.1 through 1.25.0
Timeline
- 2026-05-20: disclosed
- 2026-05-20: advisory
- 2026-05-20: patched: Fixed in Unbound 1.25.1