Log in Start free

Vulnerability · Published Jul 22, 2026 · Assigned by NLnet Labs

CVE-2026-55973'dns-error-reporting: yes' leads to stack buffer overflow

High 7.5

In plain English

A high-severity improper input validation in Unbound from NLnet Labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.3%top 79.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain, the returned lenght is not used and if the agent domain is followed by garbage, those bytes are moved onto the tail of the synthetic '_er.' report query name. That query name is later used in the iterator via a subquery to send out the DNS Error Report and when Unbound tries to walk that query name during 'find_closest_of_type()', it strips labels using the query name length rather than stopping at the embedded root, walks one byte past it, and feeds the first garbage byte to 'dname_query_hash()' as a label length writing over the stack variable 'labuf'. One ordinary upstream response from a delegated zone the attacker controls is sufficient to terminate the daemon.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10python3-unbound1.24.2-7.el10_2.4ALSA-2026:55892
AlmaLinux:9python3-unbound1.24.2-3.el9_8.4ALSA-2026:55841
AlmaLinux:10unbound1.24.2-7.el10_2.4ALSA-2026:55892
AlmaLinux:9unbound1.24.2-3.el9_8.4ALSA-2026:55841
AlmaLinux:10unbound-anchor1.24.2-7.el10_2.4ALSA-2026:55892
AlmaLinux:10unbound-devel1.24.2-7.el10_2.4ALSA-2026:55892
AlmaLinux:9unbound-devel1.24.2-3.el9_8.4ALSA-2026:55841
AlmaLinux:10unbound-dracut1.24.2-7.el10_2.4ALSA-2026:55892
AlmaLinux:9unbound-dracut1.24.2-3.el9_8.4ALSA-2026:55841
AlmaLinux:10unbound-libs1.24.2-7.el10_2.4ALSA-2026:55892
AlmaLinux:9unbound-libs1.24.2-3.el9_8.4ALSA-2026:55841
AlmaLinux:10unbound-utils1.24.2-7.el10_2.4ALSA-2026:55892
Alpine:v3.22unbound1.25.2-r0ALPINE-CVE-2026-55973
Alpine:v3.23unbound1.25.2-r0ALPINE-CVE-2026-55973
Alpine:v3.24unbound1.25.2-r0ALPINE-CVE-2026-55973
Debian:12unboundno fix listedDEBIAN-CVE-2026-55973
Debian:13unbound1.26.1-0+deb13u1DEBIAN-CVE-2026-55973
Debian:14unbound1.25.2-1DEBIAN-CVE-2026-55973
Rocky Linux:10unbound0:1.24.2-7.el10_2.4RLSA-2026:55892
Rocky Linux:9unbound0:1.24.2-3.el9_8.4RLSA-2026:55841
Ubuntu:22.04:LTSunbound1.13.1-1ubuntu5.17USN-8946-1
Ubuntu:24.04:LTSunbound1.19.2-1ubuntu3.12USN-8946-1
Ubuntu:26.04:LTSunbound1.24.2-1ubuntu2.4UBUNTU-CVE-2026-55973
Ubuntu:26.04:LTSunbound1.24.2-1ubuntu2.4USN-8946-1
Ubuntu:26.10unboundno fix listedUBUNTU-CVE-2026-55973

Affected products (as reported)

VendorProductVersions
NLnet Labs Unbound 1.23.0 – before 1.25.2

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References