CVE-2026-42944

What it actually does

CVE-2026-42944 is a network-reachable heap overflow in NLnet Labs Unbound versions 1.14.0 through 1.25.0 when specific EDNS-related reply options are enabled. If Unbound is configured with NSID, DNS Cookie answer generation, or response padding, an unauthenticated client that can send DNS queries to the resolver can include multiple NSID, DNS Cookie, and/or EDNS Padding options in a single query. A flawed EDNS size calculation truncates the computed field size, and the reply encoder can then write beyond the allocated heap buffer using Unbound-controlled data. The documented impact is high availability impact, typically causing the Unbound process to crash and interrupt DNS resolution service.

Why it matters to the business

Successful exploitation can take DNS resolution offline for systems that depend on the affected Unbound resolver, causing application outages, failed service discovery, user-facing connectivity problems, and operational disruption. Because exploitation is unauthenticated, network-based, and low complexity, Internet-exposed or broadly reachable resolvers are at higher risk even though current public exploitation indicators are low: EPSS is 0.00842 with no 30-day increase, the issue is not listed in CISA KEV, and no mature public exploit is indicated. Organizations using Unbound as critical recursive DNS infrastructure should still treat patching as important because DNS resolver instability can have wide blast radius across dependent services.

How an attack unfolds

An attacker first identifies an Unbound resolver running an affected version and reachable over UDP or TCP DNS. They then determine or assume that one or more relevant EDNS response features are enabled, such as NSID, answer-cookie, or response padding. The attacker sends crafted DNS queries containing multiple instances of NSID, DNS Cookie, and/or EDNS Padding EDNS options. During response construction, Unbound attempts to encode corresponding EDNS options into the reply packet. Because the vulnerable versions incorrectly calculate the EDNS field size and may truncate the value, the encoder can write past the end of the allocated heap buffer. The overflow uses data controlled by Unbound’s encoding path and is expected to result in process memory corruption and eventual crash, producing a denial of service against DNS resolution. The vulnerability description does not support reliable remote code execution claims; the practical known outcome is resolver crash and service interruption.

How to fix it

Upgrade NLnet Labs Unbound to version 1.25.1 or later. Version 1.25.1 fixes the issue by de-duplicating EDNS options and preventing truncation in the EDNS field size calculation. If immediate upgrade is not possible, reduce exposure by limiting who can query the resolver, especially from untrusted networks; restrict recursive DNS service to trusted clients only; place resolvers behind appropriate network filtering; and consider disabling nonessential affected options such as nsid, answer-cookie, and pad-responses where operationally acceptable. Ensure service managers restart the Unbound daemon after package update and verify the running binary, not just the installed package, is the fixed version.

How to confirm the fix worked

Confirm exposure by checking the running Unbound version and configuration. Affected versions are 1.14.0 through 1.25.0 inclusive; fixed version is 1.25.1 or later. Validate configuration for enabled EDNS-related features, especially nsid, answer-cookie, and pad-responses. Confirm network exposure by verifying which interfaces and client networks can send DNS queries to the resolver. After remediation, verify that `unbound -V` or the platform package manager reports Unbound 1.25.1 or later, restart the service if needed, and confirm DNS queries succeed normally. Review crash history before and after patching to ensure unexplained Unbound crashes cease.

Typical attack path

1. Identify DNS resolvers running NLnet Labs Unbound 1.14.0 through 1.25.0.
2. Confirm the resolver is reachable by sending standard DNS queries over UDP and/or TCP port 53.
3. Target resolvers configured with one or more relevant EDNS features enabled: nsid, answer-cookie, or pad-responses.
4. Send crafted DNS queries that include multiple NSID, DNS Cookie, and/or EDNS Padding EDNS options.
5. Trigger vulnerable EDNS reply construction in Unbound.
6. Cause heap buffer overflow during reply packet encoding.
7. Crash or destabilize the Unbound process, disrupting DNS resolution until the service restarts or is repaired.

How to detect it

Look for evidence of prior exploitation by correlating Unbound crashes or restarts with inbound DNS queries containing duplicate EDNS options. Relevant log sources include Unbound logs, systemd journal, syslog, kernel logs, package/service manager logs, crash dump directories, DNS packet captures, network IDS logs, and firewall or flow logs for UDP/TCP port 53. Indicators include unexplained Unbound process termination, segmentation faults, malloc or heap corruption messages, repeated service restarts, core dumps for the unbound process, and bursts of DNS queries with multiple OPT RR options such as NSID, COOKIE, or PADDING. Packet-level analysis is especially useful because application logs may not record individual EDNS option duplication by default. If available, inspect PCAP or DNS telemetry for queries from the same source shortly before a crash that contain duplicate EDNS option codes: NSID option code 3, COOKIE option code 10, or PADDING option code 12. No named threat actors or ransomware campaigns are currently associated with this vulnerability based on the supplied data.

• unbound.*segmentation fault
• segfault.*unbound
• unbound.*core dumped
• unbound.*dumped core
• unbound.*malloc
• unbound.*heap corruption
• unbound.*corrupted size
• unbound.*double free
• systemd.*unbound.*Main process exited
• systemd.*unbound.*code=dumped
• systemd.*unbound.*status=11/SEGV
• systemd.*unbound.*Scheduled restart job
• /var/lib/systemd/coredump/core.unbound
• /var/crash/*unbound*
• /var/log/unbound/unbound.log
• EDNS option NSID
• EDNS option COOKIE
• EDNS option PADDING
• duplicate NSID
• duplicate COOKIE
• duplicate PADDING
• edns.option.code == 3
• edns.option.code == 10
• edns.option.code == 12
• udp.port == 53
• tcp.port == 53

What your security team should do

• Inventory all Unbound resolvers and prioritize any running versions 1.14.0 through 1.25.0.
• Upgrade affected deployments to Unbound 1.25.1 or later, prioritizing Internet-facing and shared infrastructure resolvers.
• Restrict resolver access to trusted client networks; do not expose recursive DNS service to the public Internet unless explicitly required and protected.
• Review Unbound configuration for nsid, answer-cookie, and pad-responses; disable nonessential affected options as a temporary mitigation if patching is delayed.
• Monitor Unbound service health for crashes, restarts, core dumps, and spikes in malformed or unusual EDNS queries.
• Add detection logic for repeated DNS queries containing duplicate NSID, COOKIE, or PADDING EDNS options from the same source.
• Because the issue is not in CISA KEV, has low EPSS, and has no known mature exploit, handle under normal vulnerability management SLAs unless the resolver is externally reachable or operationally critical.