Executive brief
NLnet Labs Unbound is a widely used DNS resolver that translates human-readable domain names into IP addresses. A vulnerability exists where a malicious DNS server can send specially crafted, signed records that cause the resolver to process memory incorrectly. This can lead to a service crash or unpredictable behavior, potentially impacting the reliability of internet connectivity for users relying on the affected resolver.
Technical details
A heap buffer overflow exists in Unbound's DNSSEC validator when processing RRSIG-covered RRsets for PX, RP, MINFO, or SOA records. The root cause is a failure to verify the presence of a second embedded domain name in the RDATA before passing a calculated pointer to 'query_dname_tolower()'. An attacker operating a DNSSEC-signed authoritative server can provide a truncated record that causes the parser to read past the intended buffer into stale bytes or beyond the heap allocation. This is particularly exploitable if 'msg-buffer-size' is configured below the default value. The issue is resolved in Unbound version 1.25.2.
Affected products
- NLnet Labs Unbound up to and including 1.25.1
Timeline
- 2026-07-22: disclosed
- 2026-07-22: advisory
- 2026-07-22: patched: Fixed in version 1.25.2