Log in Start free

Vulnerability · Published May 20, 2026 · Assigned by NLnet Labs

CVE-2026-42944Heap overflow with multiple NSID, COOKIE, PADDING EDNS options

High 7.5

In plain English

A high-severity out-of-bounds write in Unbound from NLnet Labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.8%top 41.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options ('nsid', 'answer-cookie', 'pad-responses' (default)) need to be enabled for the vulnerability to be exploited. An adversary who can query Unbound can exploit the vulnerability by attaching multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options to the query. A flaw in the size calculation of the EDNS field truncates the correct value which allows the encoder to overflow the available space when writing. Those two combined lead to a heap overflow write of Unbound controlled data and eventually a crash. Unbound 1.25.1 contains a patch with a fix to de-duplicate the EDNS options and a fix to prevent truncation of the EDNS field size calculation.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10python3-unbound1.24.2-7.el10_2.1ALSA-2026:23231
AlmaLinux:8python3-unbound1.16.2-5.11.el8_10ALSA-2026:24365
AlmaLinux:9python3-unbound1.24.2-3.el9_8.1ALSA-2026:24369
AlmaLinux:10unbound1.24.2-7.el10_2.1ALSA-2026:23231
AlmaLinux:8unbound1.16.2-5.11.el8_10ALSA-2026:24365
AlmaLinux:9unbound1.24.2-3.el9_8.1ALSA-2026:24369
AlmaLinux:10unbound-anchor1.24.2-7.el10_2.1ALSA-2026:23231
AlmaLinux:10unbound-devel1.24.2-7.el10_2.1ALSA-2026:23231
AlmaLinux:8unbound-devel1.16.2-5.11.el8_10ALSA-2026:24365
AlmaLinux:9unbound-devel1.24.2-3.el9_8.1ALSA-2026:24369
AlmaLinux:10unbound-dracut1.24.2-7.el10_2.1ALSA-2026:23231
AlmaLinux:9unbound-dracut1.24.2-3.el9_8.1ALSA-2026:24369
AlmaLinux:10unbound-libs1.24.2-7.el10_2.1ALSA-2026:23231
AlmaLinux:8unbound-libs1.16.2-5.11.el8_10ALSA-2026:24365
AlmaLinux:9unbound-libs1.24.2-3.el9_8.1ALSA-2026:24369
AlmaLinux:10unbound-utils1.24.2-7.el10_2.1ALSA-2026:23231
Alpine:v3.22unbound1.25.2-r0ALPINE-CVE-2026-42944
Alpine:v3.23unbound1.25.2-r0ALPINE-CVE-2026-42944
Alpine:v3.24unbound1.25.1-r0ALPINE-CVE-2026-42944
Debian:12unboundno fix listedDEBIAN-CVE-2026-42944
Debian:13unbound1.22.0-2+deb13u3DEBIAN-CVE-2026-42944
Debian:14unbound1.25.1-1DEBIAN-CVE-2026-42944
Rocky Linux:10unbound0:1.24.2-7.el10_2.1RLSA-2026:23231
Rocky Linux:8unbound0:1.16.2-5.11.el8_10RLSA-2026:24365
Rocky Linux:9unbound0:1.24.2-3.el9_8.1RLSA-2026:24369
Ubuntu:24.04:LTSunbound1.19.2-1ubuntu3.8UBUNTU-CVE-2026-42944
Ubuntu:25.10unbound1.22.0-2ubuntu2.3UBUNTU-CVE-2026-42944
Ubuntu:26.04:LTSunbound1.24.2-1ubuntu2.1UBUNTU-CVE-2026-42944

Affected products (as reported)

VendorProductVersions
NLnet Labs Unbound 1.14.0 – before 1.25.1

Weakness: CWE-197, CWE-787, CWE-131 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References