Vulnerability · Published Jul 22, 2026 · Assigned by NLnet Labs
CVE-2026-56416Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name
Medium 4.8
In plain English
A medium-severity security flaw in Unbound from NLnet Labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain name as 'datstart + dname_valid(datstart, ...)' and passes it straight to 'query_dname_tolower()' without checking that a second name is actually present in the RDATA. The wire-format parser accepts multi-dname RRs whose RDATA ends after the first name, so an attacker who runs a DNSSEC-signed authoritative server can deliver a record with an absent second domain name (e.g. SOA record) and cause 'query_dname_tolower()' to walk label-by-label through stale bytes in the per-worker 'env->scratch_buffer', past the end of that heap allocation if 'msg-buffer-size' has been lowered from the default. This leads to heap buffer overflow and on a release build the outcome relies heavily on the contents of the buffer tail and the adjacent heap chunk.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.22 | unbound | 1.25.2-r0 | ALPINE-CVE-2026-56416 |
| Alpine:v3.23 | unbound | 1.25.2-r0 | ALPINE-CVE-2026-56416 |
| Alpine:v3.24 | unbound | 1.25.2-r0 | ALPINE-CVE-2026-56416 |
| Debian:12 | unbound | no fix listed | DEBIAN-CVE-2026-56416 |
| Debian:13 | unbound | 1.26.1-0+deb13u1 | DEBIAN-CVE-2026-56416 |
| Debian:14 | unbound | 1.25.2-1 | DEBIAN-CVE-2026-56416 |
| Ubuntu:22.04:LTS | unbound | no fix listed | UBUNTU-CVE-2026-56416 |
| Ubuntu:24.04:LTS | unbound | no fix listed | UBUNTU-CVE-2026-56416 |
| Ubuntu:26.04:LTS | unbound | no fix listed | UBUNTU-CVE-2026-56416 |
| Ubuntu:26.10 | unbound | no fix listed | UBUNTU-CVE-2026-56416 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NLnet Labs | Unbound | 0 – before 1.25.2 |
Weakness: CWE-354 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
References
- https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-56416.txt vendor-advisory