CVE-2026-42959
Denial of Service in Unbound DNSSEC Validator
Publication date: 2026-05-20
Last updated on: 2026-05-20
Assigner: NLnet Labs
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nlnet_labs | unbound | to 1.25.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-824 | The product accesses or uses a pointer that has not been initialized. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-42959 is a denial of service vulnerability in the DNSSEC validator of NLnet Labs Unbound up to version 1.25.0. The issue occurs because Unbound uses incorrect counters to calculate write offsets for ADDITIONAL section resource record sets when constructing chase-reply messages for validation. This leads to an uninitialized array slot being dereferenced, causing the process to crash immediately.
An attacker controlling a DNSSEC-signed domain can exploit this vulnerability by crafting a DNS response with a DNAME chain containing unsigned CNAMEs and unsigned AUTHORITY records alongside signed ADDITIONAL glue records, triggering the crash with a single query.
The vulnerability affects Unbound versions up to and including 1.25.0, and was fixed in version 1.25.1 by correcting the counter usage.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Unbound to version 1.25.1, which contains a patch fixing the incorrect counter usage that leads to the denial of service crash.
Alternatively, you can manually apply the patch provided by the developers if upgrading is not immediately possible.
How can this vulnerability impact me? :
This vulnerability can cause the Unbound DNS resolver process to crash immediately when processing specially crafted malicious DNS responses. This results in a denial of service condition, potentially disrupting DNS resolution services that rely on Unbound.
If you run Unbound versions up to 1.25.0, an attacker controlling a DNSSEC-signed domain can exploit this flaw to cause service interruptions with a single query, impacting availability.
To mitigate this impact, users should upgrade to Unbound version 1.25.1 or apply the provided patch.