CVE-2026-56416
Received Received - Intake

Heap Buffer Overflow in Unbound DNS Validator

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: NLnet Labs

Description
In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain name as 'datstart + dname_valid(datstart, ...)' and passes it straight to 'query_dname_tolower()' without checking that a second name is actually present in the RDATA. The wire-format parser accepts multi-dname RRs whose RDATA ends after the first name, so an attacker who runs a DNSSEC-signed authoritative server can deliver a record with an absent second domain name (e.g. SOA record) and cause 'query_dname_tolower()' to walk label-by-label through stale bytes in the per-worker 'env->scratch_buffer', past the end of that heap allocation if 'msg-buffer-size' has been lowered from the default. This leads to heap buffer overflow and on a release build the outcome relies heavily on the contents of the buffer tail and the adjacent heap chunk.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-22
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-56416
EUVD
EUVD-2026-47684

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nlnet_labs unbound to 1.25.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-354 The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-56416 is a heap buffer overflow vulnerability in NLnet Labs Unbound DNS software versions up to 1.25.1. It occurs when processing certain DNS resource record sets (PX/RP/MINFO/SOA) signed with RRSIG. The validator incorrectly handles the second embedded domain name in RDATA, leading to memory corruption when stale bytes beyond allocated heap memory are accessed.

Detection Guidance

Detecting this vulnerability requires checking the Unbound DNS software version running on your system. Run 'unbound -v' to check the version. If it is 1.25.1 or earlier, the system is vulnerable. Additionally, monitor DNS logs for unusual memory-related errors or crashes in the Unbound process.

Impact Analysis

An attacker exploiting this could cause memory corruption, potentially leading to crashes, data corruption, or unauthorized code execution on systems running vulnerable Unbound versions. This may disrupt DNS resolution services and compromise the integrity of DNS responses.

Compliance Impact

This vulnerability primarily impacts DNS resolution integrity and could lead to memory corruption in Unbound DNS software. While it does not directly violate GDPR or HIPAA, it may indirectly affect compliance by compromising data integrity and availability if exploited to disrupt DNS services handling sensitive data.

Mitigation Strategies

Immediately upgrade Unbound to version 1.25.2 or later, as this version includes a fix for the vulnerability. If upgrading is not immediately possible, apply the manual patch provided by NLnet Labs. Disable DNSSEC validation temporarily if you cannot upgrade, but this is not a recommended long-term solution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56416. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart