CVE-2026-42944

NLnet Labs  has disclosed several vulnerabilities affecting Unbound DNS resolver which could result in denial-of-service (DoS). CVE-2026-33278 is a critical vulnerability with a CVSS score 9.8 affecting Unbound 1.19.1 through 1.25.0. This vulnerability exists in the DNSSEC validator during NSEC3 validation handling and is caused by an incorrect deep-copy operation. A crafted DNSSEC response can trigger access to freed memory, leading to crashes or possible remote code execution. CVE-2026-42944 is heap overflow vulnerability, in EDNS reply packet encoding, affecting Unbound versions 1.14.0 through 1.25.0. The flaw is caused by incorrect EDNS size calculations when handling multiple NSID, DNS Cookie, or EDNS Padding options. A remote unauthenticated attacker can trigger the issue by sending specially crafted DNS queries. Exploitation can crash the service, resulting in a denial-of-service condition. CVE-2026-42959 is denial-of-service vulnerability existing in Unbound up to version 1.25.0 within the DNSSEC validator. This issue  arises from incorrect counter usage when calculating write offsets for ADDITIONAL section RRsets during chase-reply construction. DNAME duplication and AUTHORITY filtering can create uninitialized array slots, leading to invalid memory references. An attacker controlling a DNSSEC-signed domain can trigger the bug with a single crafted query, resulting in an immediate process crash.

EPSS 0.06% · 18.8th percentile