NLnet Labs Unbound up to 1.25.0 numeric truncation error

Summaryinfo

A vulnerability marked as problematic has been reported in NLnet Labs Unbound up to 1.25.0. This vulnerability affects unknown code. Performing a manipulation results in numeric truncation error. This vulnerability is identified as CVE-2026-42944. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in NLnet Labs Unbound up to 1.25.0. This affects an unknown code. The manipulation with an unknown input leads to a numeric truncation error vulnerability. CWE is classifying the issue as CWE-197. Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. This is going to have an impact on availability. The summary by CVE is:

NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options ('nsid', 'answer-cookie', 'pad-responses' (default)) need to be enabled for the vulnerability to be exploited. An adversary who can query Unbound can exploit the vulnerability by attaching multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options to the query. A flaw in the size calculation of the EDNS field truncates the correct value which allows the encoder to overflow the available space when writing. Those two combined lead to a heap overflow write of Unbound controlled data and eventually a crash. Unbound 1.25.1 contains a patch with a fix to de-duplicate the EDNS options and a fix to prevent truncation of the EDNS field size calculation.

The weakness was released by Qifan Zhang. It is possible to read the advisory at nlnetlabs.nl. This vulnerability is uniquely identified as CVE-2026-42944 since 05/07/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 315760 (Linux Distros Unpatched Vulnerability : CVE-2026-42944), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.25.1 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (315760) and CERT Bund (WID-SEC-2026-1599). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Red Hat Enterprise Linux
• Fedora Linux
• Ubuntu Linux
• Open Source Unbound
• cPanel cPanel/WHM

Productinfo

Vendor

• NLnet Labs

Name

• Unbound

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion