CVE-2026-44621
- Source
- https://cve.org/CVERecord?id=CVE-2026-44621
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44621.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-44621
- Downstream
- Related
- Published
- 2026-07-22T14:17:18.913Z
- Modified
- 2026-08-12T18:48:02.622730532Z
- Severity
-
- 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and libunbound needs to call 'libworkeralloccleanup' since the function is absent from the function call allow list. When an application using libunbound sets 'unwanted-reply-threshold' to any non-zero value and the iterator queries an authoritative that replies with enough wrong-transaction-ID UDP datagrams to cross the threshold, the 'libworkeralloccleanup' will eventually be called. Since the function is absent from the function call allow list, this leads to a fatal exit of libunbound and eventual termination of the embedding application.Unbound itself is not affected since its relevant function 'workeralloccleanup' is registed in the allow list and proceeds to perform the documented cache flush.
- References
Affected packages
Git / github.com/nlnetlabs/unbound
Affected ranges
- Type
- GIT
- Repo
- https://github.com/nlnetlabs/unbound
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "0" }, { "fixed": "1.25.2" } ], "source": "CPE_RANGE", "cpe": "cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*" }