Executive brief
A vulnerability in the libunbound library, used for DNS resolution, can cause applications to crash unexpectedly. When an application is configured to monitor for suspicious network replies, a flood of incorrect data from a malicious or misconfigured server can trigger a fatal error that shuts down the entire program. This results in a denial of service, potentially disrupting critical internet connectivity or services relying on the affected software.
Technical details
A denial of service vulnerability exists in libunbound (up to version 1.25.1) due to an improper check for exceptional conditions (CWE-754). When an application using the library sets a non-zero 'unwanted-reply-threshold', receiving enough UDP datagrams with incorrect transaction IDs triggers a call to 'libworker_alloc_cleanup'. Because this specific function was omitted from the library's internal function call allow list, the call results in a fatal exit. This terminates the embedding application. The main Unbound executable is unaffected as it uses a different, correctly registered cleanup function. The issue is resolved in version 1.25.2.
Affected products
- NLnet Labs Unbound Up to and including 1.25.1
Timeline
- 2026-07-22: disclosed
- 2026-07-22: advisory
- 2026-07-22: patched: Fixed in Unbound 1.25.2