Executive brief
NLnet Labs Unbound is a widely used tool for translating human-readable website names into IP addresses. A flaw in how it handles error reporting allows a remote attacker to crash the service by sending a specially crafted response from a domain they control. This results in a denial-of-service, preventing users from accessing websites or other internet services that rely on the affected server.
Technical details
A vulnerability exists in Unbound versions 1.23.0 through 1.25.1 when 'dns-error-reporting: yes' is configured. The issue stems from improper validation of the EDNS Report-Channel option (code 18) length in upstream responses. When processing a synthetic '_er.' report query name, the 'find_closest_of_type()' function fails to stop at the embedded root and instead uses the full option length to strip labels. This causes the iterator to walk past the intended memory boundary, feeding garbage bytes to 'dname_query_hash()' and overwriting the 'labuf' stack variable. An attacker controlling a delegated zone can trigger this crash with a single response, leading to a daemon termination (DoS). The issue is fixed in version 1.25.2.
Affected products
- NLnet Labs Unbound 1.23.0 to 1.25.1
Timeline
- 2026-07-22: advisory
- 2026-07-22: disclosed
- 2026-07-22: patched