CVE-2026-42944

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-42944
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42944.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-42944
Downstream
ALPINE (1)
ALSA (3)
AZL (1)
CLSA (3)
DEBIAN (1)
ECHO (1)
OESA (3)
openSUSE (2)
RHSA (4)
RLSA (3)
ROOT (2)
SUSE (6)
UBUNTU (1)
Related
ALSA (3)
openSUSE (2)
SUSE (6)
Published
2026-05-20T10:16:27Z
Modified
2026-10-24T15:04:09Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options ('nsid', 'answer-cookie', 'pad-responses' (default)) need to be enabled for the vulnerability to be exploited. An adversary who can query Unbound can exploit the vulnerability by attaching multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options to the query. A flaw in the size calculation of the EDNS field truncates the correct value which allows the encoder to overflow the available space when writing. Those two combined lead to a heap overflow write of Unbound controlled data and eventually a crash. Unbound 1.25.1 contains a patch with a fix to de-duplicate the EDNS options and a fix to prevent truncation of the EDNS field size calculation.

References

Affected packages

Git / github.com/nlnetlabs/unbound

Affected ranges

Type
GIT
Repo
https://github.com/nlnetlabs/unbound
Events
Introduced
919c8c9527281a7289415c00f8f2aed12b17a9aa
Fixed
75b6dba593d4fff000434cd64807c6ebd50bd244
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.14.0"
                },
                {
                    "fixed":  "1.25.1"
                }
            ],
            "source":  "CPE_RANGE"
        }
    ]
}

Affected versions

release-1.*
release-1.14.0
release-1.14.0rc1
release-1.15.0
release-1.15.0rc1
release-1.16.0
release-1.16.0rc1
release-1.16.1
release-1.16.1rc1
release-1.16.2
release-1.18.0
release-1.18.0rc1
release-1.19.0
release-1.19.0rc1
release-1.19.3rc1
release-1.20.0
release-1.20.0rc1
release-1.21.0
release-1.21.0rc1
release-1.22.0
release-1.22.0rc1
release-1.23.0rc1
release-1.24.0
release-1.24.0rc1
release-1.25.0
release-1.25.0rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42944.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "26148135886169857913239956572075736548",
            "length":  1502
        },
        "id":  "CVE-2026-42944-7cb89fac",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/nlnetlabs/unbound/commit/75b6dba593d4fff000434cd64807c6ebd50bd244",
        "target":  {
            "file":  "services/rpz.c",
            "function":  "rpz_callback_from_iterator_module"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "108481287081154918060659085654141150584",
                "73953166938600086918224773195867549742",
                "15251087855327528788980657535362970158",
                "48532896601082718174781974683716349061",
                "287248990686482337183326495344180868363",
                "112058947495561481565691171486557666856",
                "238258467286774268681997190612827183971",
                "126648031849056156900266153546629664662",
                "335401097143186200364020904286165936708",
                "336096779053276656395004922884987906159",
                "248876396313049466881138460638611830858",
                "293135123655960925553682804594622081358",
                "298612071867479354827766089224387452786",
                "217265304546593372824910550975155656654",
                "13292601781282786772501437491204364169",
                "281286782737850123600796590480125479595",
                "74511316679551775089931390035715335201",
                "161066344018382590627892027575409612852",
                "226343512543910522766563315515650712879"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-42944-a3b17d2e",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/nlnetlabs/unbound/commit/75b6dba593d4fff000434cd64807c6ebd50bd244",
        "target":  {
            "file":  "services/rpz.c"
        }
    }
]
vanir_signatures_modified 
"2026-10-24T15:04:09Z"