Executive brief
Unbound is a widely used DNS resolver that helps translate human-readable domain names into IP addresses. A flaw in how it handles security policy updates (RPZ) can cause the service to crash when multiple internal processes try to access the same data simultaneously. This could allow an attacker to disrupt internet connectivity or internal network services by forcing the DNS resolver to shut down.
Technical details
A locking inconsistency exists in Unbound versions 1.14.0 through 1.25.0 when configured with multi-threading and RPZ zones using 'rpz-nsip' or 'rpz-nsdname' triggers. The vulnerability is a race condition that occurs during an RPZ zone transfer (XFR) reload; if a reader thread accesses the zone while an XFR update is being applied, improper lock duration allows the XFR thread to free memory objects still in use by the reader. This results in a heap use-after-free condition. An attacker can trigger this by providing malicious RPZ updates via XFR, leading to a Denial of Service (DoS) via a daemon crash. The issue is resolved in Unbound version 1.25.1.
Affected products
- NLnet Labs Unbound 1.14.0 through 1.25.0
Timeline
- 2026-05-20: advisory: Initial disclosure by NLnet Labs
- 2026-05-20: patched: Released in Unbound version 1.25.1