Vulnerability · Published Jul 22, 2026 · Assigned by NLnet Labs
CVE-2026-44621Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abruptly terminated
Medium 5.9
In plain English
A medium-severity security flaw in Unbound from NLnet Labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and libunbound needs to call 'libworker_alloc_cleanup' since the function is absent from the function call allow list. When an application using libunbound sets 'unwanted-reply-threshold' to any non-zero value and the iterator queries an authoritative that replies with enough wrong-transaction-ID UDP datagrams to cross the threshold, the 'libworker_alloc_cleanup' will eventually be called. Since the function is absent from the function call allow list, this leads to a fatal exit of libunbound and eventual termination of the embedding application.Unbound itself is not affected since its relevant function 'worker_alloc_cleanup' is registed in the allow list and proceeds to perform the documented cache flush.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.22 | unbound | 1.25.2-r0 | ALPINE-CVE-2026-44621 |
| Alpine:v3.23 | unbound | 1.25.2-r0 | ALPINE-CVE-2026-44621 |
| Alpine:v3.24 | unbound | 1.25.2-r0 | ALPINE-CVE-2026-44621 |
| Debian:12 | unbound | no fix listed | DEBIAN-CVE-2026-44621 |
| Debian:13 | unbound | 1.26.1-0+deb13u1 | DEBIAN-CVE-2026-44621 |
| Debian:14 | unbound | 1.25.2-1 | DEBIAN-CVE-2026-44621 |
| Ubuntu:22.04:LTS | unbound | no fix listed | UBUNTU-CVE-2026-44621 |
| Ubuntu:24.04:LTS | unbound | no fix listed | UBUNTU-CVE-2026-44621 |
| Ubuntu:26.04:LTS | unbound | no fix listed | UBUNTU-CVE-2026-44621 |
| Ubuntu:26.10 | unbound | no fix listed | UBUNTU-CVE-2026-44621 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NLnet Labs | Unbound | 0 – before 1.25.2 |
Weakness: CWE-754 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-44621.txt vendor-advisory