NLnet Labs Unbound up to 1.25.0 RPZ File improper resource locking

Summaryinfo

A vulnerability was found in NLnet Labs Unbound up to 1.25.0 and classified as problematic. Affected is an unknown function of the component RPZ File Handler. Executing a manipulation can lead to improper resource locking. This vulnerability appears as CVE-2026-44608. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in NLnet Labs Unbound up to 1.25.0. It has been declared as problematic. This vulnerability affects an unknown code of the component RPZ File Handler. The manipulation with an unknown input leads to a improper resource locking vulnerability. The CWE definition for the vulnerability is CWE-413. The product does not lock or does not correctly lock a resource when the product must have exclusive access to the resource. As an impact it is known to affect availability. CVE summarizes:

NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met (multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers) it could result in heap use-after-free and eventual crash. An adversary can exploit the vulnerability if conditions are first met on a vulnerable Unbound, i.e., multi-threaded, an RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers and an ongoing XFR for that RPZ zone. Local RPZ files do not trigger the vulnerability. If the timing is right and an XFR happens at the same time another thread needs to read that RPZ zone, the reader may not hold the lock long enough and the thread applying the XFR may free objects that the reader is about to walk causing the use-after-free. Unbound 1.25.1 contains a patch with a fix to the locking code.

The weakness was presented by Qifan Zhang. The advisory is available at nlnetlabs.nl. This vulnerability was named CVE-2026-44608 since 05/07/2026. The exploitation appears to be difficult. The attack can be initiated remotely. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1499 by the MITRE ATT&CK project.

The vulnerability scanner Nessus provides a plugin with the ID 315774 (Linux Distros Unpatched Vulnerability : CVE-2026-44608), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.25.1 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (315774) and CERT Bund (WID-SEC-2026-1599). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• Red Hat Enterprise Linux
• Fedora Linux
• Ubuntu Linux
• Open Source Unbound
• cPanel cPanel/WHM

Productinfo

Vendor

• NLnet Labs

Name

• Unbound

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion