CVE-2026-56416
- Source
- https://cve.org/CVERecord?id=CVE-2026-56416
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56416.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-56416
- Downstream
- Related
- Published
- 2026-07-22T14:17:22.090Z
- Modified
- 2026-07-27T14:06:46.882602Z
- Severity
-
- 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L CVSS Calculator
- Summary
- [none]
- Details
-
In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain name as 'datstart + dnamevalid(datstart, ...)' and passes it straight to 'querydnametolower()' without checking that a second name is actually present in the RDATA. The wire-format parser accepts multi-dname RRs whose RDATA ends after the first name, so an attacker who runs a DNSSEC-signed authoritative server can deliver a record with an absent second domain name (e.g. SOA record) and cause 'querydnametolower()' to walk label-by-label through stale bytes in the per-worker 'env->scratchbuffer', past the end of that heap allocation if 'msg-buffer-size' has been lowered from the default. This leads to heap buffer overflow and on a release build the outcome relies heavily on the contents of the buffer tail and the adjacent heap chunk.
- References
Affected packages
Git / github.com/nlnetlabs/unbound
Affected ranges
- Type
- GIT
- Repo
- https://github.com/nlnetlabs/unbound
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
{ "cpe": "cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*", "source": "CPE_RANGE", "extracted_events": [ { "introduced": "0" }, { "fixed": "1.25.2" } ] }