Executive brief
NLnet Labs Unbound is a widely used DNS resolver that translates human-readable domain names into IP addresses. A memory management flaw in certain configurations could allow a remote attacker to cause the service to crash or behave unpredictably when the server is under heavy load. This could lead to a denial-of-service, impacting the ability of users and applications to access internet resources.
Technical details
A use-after-free vulnerability (CWE-416) exists in Unbound versions 1.25.0 through 1.25.1 due to the creation of a shallow copy of a 'view name' when the 'respip' and 'dns64' modules interact. The vulnerability is triggered when Unbound is configured with 'respip' or 'rpz' modules alongside subquery-attaching modules (like dns64 or subnetcache) and 'access-control-view'. Under high load, Unbound's 'jostle' logic may drop a super query that owns the original view name, leaving the subquery with a dangling pointer. This leads to memory corruption or a server crash, particularly in builds with memory protections like ASAN. The issue is resolved in version 1.25.2.
Affected products
- NLnet Labs Unbound 1.25.0 to 1.25.1
Timeline
- 2026-07-22: disclosed
- 2026-07-22: advisory
- 2026-07-22: patched: Fixed in version 1.25.2