CVE-2026-55973
Received Received - Intake

Memory Corruption in Unbound DNS Server

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: NLnet Labs

Description
In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain, the returned lenght is not used and if the agent domain is followed by garbage, those bytes are moved onto the tail of the synthetic '_er.' report query name. That query name is later used in the iterator via a subquery to send out the DNS Error Report and when Unbound tries to walk that query name during 'find_closest_of_type()', it strips labels using the query name length rather than stopping at the embedded root, walks one byte past it, and feeds the first garbage byte to 'dname_query_hash()' as a label length writing over the stack variable 'labuf'. One ordinary upstream response from a delegated zone the attacker controls is sufficient to terminate the daemon.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-22
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-55973
EUVD
EUVD-2026-47681

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
nlnet_labs unbound 1.23.0
nlnet_labs unbound to 1.25.1 (inc)
nlnetlabs unbound to 1.25.1 (inc)
nlnetlabs unbound 1.25.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-55973 is a vulnerability in Unbound DNS software versions 1.23.0 through 1.25.1. When the 'dns-error-reporting: yes' setting is enabled, Unbound improperly handles the EDNS Report-Channel option (code 18) from upstream responses. It uses the option's length as the agent domain length, leading to a buffer overflow when garbage bytes are appended to the agent domain. This causes a stack variable overwrite during query name processing, allowing an attacker to terminate the Unbound daemon with a single malicious upstream response from a controlled delegated zone.

Detection Guidance

To detect this vulnerability, check if your Unbound DNS software version is between 1.23.0 and 1.25.1. Run 'unbound -V' to verify the version. If 'dns-error-reporting: yes' is enabled in the configuration, the system is potentially vulnerable.

Impact Analysis

This vulnerability allows an attacker to crash the Unbound DNS server by sending a single malicious response. If you rely on Unbound for DNS resolution, this could disrupt DNS services, leading to downtime or degraded performance. The attack requires no authentication and can be executed remotely, making it a significant risk for exposed systems.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a denial-of-service issue in DNS software rather than a data privacy or security breach. However, service disruption caused by the vulnerability could indirectly impact compliance if DNS resolution failures lead to unauthorized access or data processing errors.

Mitigation Strategies

Immediately upgrade Unbound to version 1.25.2 or later. If upgrading is not possible, disable the 'dns-error-reporting' setting in the Unbound configuration file or apply the manual patch provided by NLnet Labs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55973. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart