Executive brief
NLnet Labs Unbound, a widely used DNS resolver that translates domain names into IP addresses, is vulnerable to a denial-of-service attack. An attacker controlling a malicious domain can send a specially crafted response that causes the Unbound service to crash immediately. This disruption prevents users and systems from resolving website addresses, effectively taking the DNS service offline.
Technical details
A denial of service vulnerability exists in the DNSSEC validator of NLnet Labs Unbound due to an incorrect counter used when calculating write offsets for ADDITIONAL section RRsets. Specifically, DNAME duplication can increase the ANSWER section count while authority filtering decreases the AUTHORITY section count, resulting in an uninitialized array slot. When the validator subsequently dereferences this uninitialized pointer, the process crashes. An unauthenticated remote attacker controlling a DNSSEC-signed domain can trigger this null/uninitialized pointer dereference by providing a response containing a specific DNAME chain and unsigned records. The issue is fixed in version 1.25.1.
Affected products
- NLnet Labs Unbound up to and including 1.25.0
Timeline
- 2026-05-20: advisory: Advisory published by NLnet Labs and NVD
- 2026-05-20: patched: Fixed in Unbound version 1.25.1