Read the docs
TI-2026-31146 Aliases CVE-2026-42959GHSA-5jp8-75xr-qrmf

Crash during DNSSEC validation of malicious content

Priority MEDIUM 45CWE-824Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 6 fixed, 3 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-824 and the CVSS impact.

Summary

NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validator that can lead to a crash given malicious upstream replies. When Unbound constructs chase-reply messages for validation, the code uses the wrong counter to calculate write offsets for ADDITIONAL section rrsets. DNAME duplication could increase the ANSWER section count and authority filtering could decrease the AUTHORITY section count and create an uninitialized array slot. Combining these two, the validator later dereferences this uninitialized pointer, causing an immediate process crash. An adversary controlling a DNSSEC-signed domain can trigger this bug with a single query by configuring a DNAME chain with unsigned CNAMEs and a response containing unsigned AUTHORITY records alongside signed ADDITIONAL glue records. Unbound 1.25.1 contains a patch with a fix to use the proper counters to calculate the write offsets.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00807 57th percentileScored 2026-11-07
Fix Partial Unbound (NLnet Labs): 1.25.1Red Hat: 4 advisoriesRed Hat: 6 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NLnet LabsUnboundbefore 1.25.11.25.1Patch availableCNA
  • Unbound VendorNLnet Labs Affected before 1.25.1 Fixed in 1.25.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*before 1.25.1VulnerableNLNETLABS
  • cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:* Versions before 1.25.1 Vulnerable ·NLNETLABS

Remediation

  • Fix · CNA Unbound (NLnet Labs) Fixed in 1.25.1

Red Hat 4 advisories

  • RHSA-2026:24369 Released 2026-06-08 · Red Hat rating Important
    unbound security update
    • Red Hat Enterprise Linux AppStream (v. 9) python3-unbound-1.24.2-3.el9_8.1, unbound-1.24.2-3.el9_8.1, unbound-dracut-1.24.2-3.el9_8.1 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) unbound-devel-1.24.2-3.el9_8.1
  • RHSA-2026:24365 Released 2026-06-08 · Red Hat rating Important
    unbound security update
    • Red Hat Enterprise Linux AppStream (v. 8) python3-unbound-1.16.2-5.11.el8_10, unbound-1.16.2-5.11.el8_10, unbound-devel-1.16.2-5.11.el8_10 +1
  • RHSA-2026:23231 Released 2026-06-04 · Red Hat rating Important
    unbound security update
    • Red Hat Enterprise Linux AppStream (v. 10) python3-unbound-1.24.2-7.el10_2.1, unbound-1.24.2-7.el10_2.1, unbound-anchor-1.24.2-7.el10_2.1 +3
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) unbound-devel-1.24.2-7.el10_2.1
Show 1 more Red Hat advisories
  • RHSA-2026:19752 Released 2026-05-20 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images python3-unbound-1.25.1-0.1.hum1@aarch64, python3-unbound-1.25.1-0.1.hum1@x86_64, unbound-1.25.1-0.1.hum1@aarch64 +14

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    NLnet Labs Unbound 1.25.1

    11 records Highest priority Priority MEDIUM 3 MEDIUM, 8 LOW

    Other records, highest priority first

    • TI-2026-25690 Possible arbitrary code execution during DNSSEC validationPriority MEDIUM 50
    • TI-2026-31135 Heap overflow with multiple NSID, COOKIE, PADDING EDNS optionsPriority MEDIUM 45
    • TI-2026-32341 Unbounded name compression in certain cases causes degradation of servicePriority LOW 37
    Show all 11 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:23231
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:24365
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:24369
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:23231
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:24369
Red Hat Hardened ImagesFixed RHSA-2026:19752

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42959
  2. 2026-10-03 Alias added: GHSA-5jp8-75xr-qrmf

References

Advisory 1

  • TI-2026-25690 Possible arbitrary code execution during DNSSEC validation CVSS 4.0CRITICAL 9.1
  • TI-2026-56302 Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY CVSS 4.0CRITICAL 9.1
  • TI-2026-31135 Heap overflow with multiple NSID, COOKIE, PADDING EDNS options CVSS 4.0HIGH 8.7
  • TI-2026-36436 Routinator crashes on specifically crafted RRDP XML files CVSS 4.0HIGH 8.7
  • TI-2026-36433 Routinator exits when accepting an incoming HTTP or RTR connection fails CVSS 4.0HIGH 8.7
  • TI-2026-10532 Denial of DNS over TLS service by any DoT client CVSS 4.0HIGH 8.7
See all 96 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences