CVE-2026-42959
Analyzed Analyzed - Analysis Complete
Denial of Service in Unbound DNSSEC Validator

Publication date: 2026-05-20

Last updated on: 2026-05-20

Assigner: NLnet Labs

Description
NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validator that can lead to a crash given malicious upstream replies. When Unbound constructs chase-reply messages for validation, the code uses the wrong counter to calculate write offsets for ADDITIONAL section rrsets. DNAME duplication could increase the ANSWER section count and authority filtering could decrease the AUTHORITY section count and create an uninitialized array slot. Combining these two, the validator later dereferences this uninitialized pointer, causing an immediate process crash. An adversary controlling a DNSSEC-signed domain can trigger this bug with a single query by configuring a DNAME chain with unsigned CNAMEs and a response containing unsigned AUTHORITY records alongside signed ADDITIONAL glue records. Unbound 1.25.1 contains a patch with a fix to use the proper counters to calculate the write offsets.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-20
Last Modified
2026-05-20
Generated
2026-06-10
AI Q&A
2026-05-20
EPSS Evaluated
2026-06-08
NVD
CVE-2026-42959
EUVD
EUVD-2026-31084
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
nlnetlabs unbound to 1.25.1 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-824 The product accesses or uses a pointer that has not been initialized.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Mitigation Strategies

To mitigate this vulnerability, you should upgrade Unbound to version 1.25.1, which contains a patch fixing the incorrect counter usage that leads to the denial of service crash.

Alternatively, you can manually apply the patch provided by the developers if upgrading is not immediately possible.

Executive Summary

CVE-2026-42959 is a denial of service vulnerability in the DNSSEC validator of NLnet Labs Unbound up to version 1.25.0. The issue occurs because Unbound uses incorrect counters to calculate write offsets for ADDITIONAL section resource record sets when constructing chase-reply messages for validation. This leads to an uninitialized array slot being dereferenced, causing the process to crash immediately.

An attacker controlling a DNSSEC-signed domain can exploit this vulnerability by crafting a DNS response with a DNAME chain containing unsigned CNAMEs and unsigned AUTHORITY records alongside signed ADDITIONAL glue records, triggering the crash with a single query.

The vulnerability affects Unbound versions up to and including 1.25.0, and was fixed in version 1.25.1 by correcting the counter usage.

Impact Analysis

This vulnerability can cause the Unbound DNS resolver process to crash immediately when processing specially crafted malicious DNS responses. This results in a denial of service condition, potentially disrupting DNS resolution services that rely on Unbound.

If you run Unbound versions up to 1.25.0, an attacker controlling a DNSSEC-signed domain can exploit this flaw to cause service interruptions with a single query, impacting availability.

To mitigate this impact, users should upgrade to Unbound version 1.25.1 or apply the provided patch.

Detection Guidance

This vulnerability causes Unbound to crash when processing specially crafted DNSSEC-signed domain responses involving DNAME chains with unsigned CNAMEs and unsigned AUTHORITY records alongside signed ADDITIONAL glue records.

Detection can involve monitoring Unbound process stability for crashes or core dumps triggered by DNS queries.

To detect exploitation attempts, you can capture and analyze DNS traffic for suspicious DNSSEC-signed responses with DNAME chains and unsigned CNAMEs or AUTHORITY records.

Specific commands are not provided in the available resources, but general approaches include:

  • Using packet capture tools like tcpdump or Wireshark to monitor DNS traffic for unusual DNSSEC-signed responses.
  • Checking Unbound logs for crashes or error messages related to DNSSEC validation.
  • Running Unbound in a debug mode or with increased logging to capture details of DNSSEC validation failures.
  • Upgrading Unbound to version 1.25.1 or later to prevent the vulnerability from being exploitable.
Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-42959. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart