CVE-2026-44621
Received Received - Intake

Denial of Service in NLnet Labs Unbound

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: NLnet Labs

Description
With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and libunbound needs to call 'libworker_alloc_cleanup' since the function is absent from the function call allow list. When an application using libunbound sets 'unwanted-reply-threshold' to any non-zero value and the iterator queries an authoritative that replies with enough wrong-transaction-ID UDP datagrams to cross the threshold, the 'libworker_alloc_cleanup' will eventually be called. Since the function is absent from the function call allow list, this leads to a fatal exit of libunbound and eventual termination of the embedding application.Unbound itself is not affected since its relevant function 'worker_alloc_cleanup' is registed in the allow list and proceeds to perform the documented cache flush.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-22
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-44621
EUVD
EUVD-2026-47667

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
nlnet_labs unbound 1.25.1
nlnet_labs libunbound to 1.25.1 (inc)
nlnet_labs unbound to 1.25.1 (inc)
nlnet_labs unbound 1.25.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-754 The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects applications using libunbound with the 'unwanted-reply-threshold' setting enabled. When an authoritative DNS server sends enough wrong-transaction-ID UDP datagrams to exceed this threshold, libunbound tries to call 'libworker_alloc_cleanup', which is not in the function call allow list. This causes libunbound to terminate abruptly, potentially crashing the application using it.

Detection Guidance

Check if your system is running Unbound version 1.25.1 or earlier or libunbound with 'unwanted-reply-threshold' set to a non-zero value. Monitor for abrupt terminations of applications using libunbound. Review logs for excessive wrong-transaction-ID UDP datagrams triggering the threshold.

Impact Analysis

The vulnerability can cause sudden termination of applications relying on libunbound. This may lead to service disruptions, data loss, or denial of service if the affected application is critical. Systems using Unbound versions up to 1.25.1 with 'unwanted-reply-threshold' set to a non-zero value are at risk.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It causes abrupt termination of applications using libunbound when the unwanted-reply-threshold is exceeded, which could lead to service disruptions rather than data breaches or compliance violations.

Mitigation Strategies

Upgrade Unbound to version 1.25.2 or apply the provided patch. If upgrading is not possible, disable the 'unwanted-reply-threshold' setting or set it to zero to prevent the issue. Restart affected services after applying changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44621. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart