Search
Find a vulnerability
Search criteria
172 vulnerabilities by NLnet Labs
CVE-2026-97206 (GCVE-0-2026-97206)
Vulnerability from nvd – Published: 2026-10-21 08:57 – Updated: 2026-10-21 08:57
VLAI
EPSS
VEX
Title
DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.
Summary
NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.
Severity
7.5 (High)
CWE
- CWE-416 - Use After Free
Assigner
NLnet Labs
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.nlnetlabs.nl/downloads/unbound/CVE-20… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NLnet Labs | Unbound |
Affected:
1.22.0 , < 1.26.2
(semver)
|
Date Public
2026-10-21 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Unbound",
"vendor": "NLnet Labs",
"versions": [
{
"lessThan": "1.26.2",
"status": "affected",
"version": "1.22.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kunta Chu (Tsinghua University)"
},
{
"lang": "en",
"type": "finder",
"value": "Jianjun Chen (Tsinghua University)"
}
],
"datePublic": "2026-10-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "compiled with DNS-over-QUIC support"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T08:57:41.106Z",
"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"shortName": "NLnet Labs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-97206.txt"
}
],
"solutions": [
{
"lang": "en",
"value": "This issue is fixed starting with version 1.26.2"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-20T00:00:00.000Z",
"value": "Issue reported by Kunta Chu"
},
{
"lang": "en",
"time": "2026-09-29T00:00:00.000Z",
"value": "NLnet Labs shares patch"
},
{
"lang": "en",
"time": "2026-09-30T00:00:00.000Z",
"value": "Kunta Chu verifies patch"
},
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Fixes released with version 1.26.2"
}
],
"title": "DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"assignerShortName": "NLnet Labs",
"cveId": "CVE-2026-97206",
"datePublished": "2026-10-21T08:57:41.106Z",
"dateReserved": "2026-10-14T09:16:14.090Z",
"dateUpdated": "2026-10-21T08:57:41.106Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96405 (GCVE-0-2026-96405)
Vulnerability from nvd – Published: 2026-10-21 08:57 – Updated: 2026-10-21 08:57
VLAI
EPSS
VEX
Title
Aggregate DNS name chained pointer decompression work leads to degradation of service.
Summary
NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious actor with recursive-query access and control of an ordinarily delegated authority that serves specially crafted replies can exploit the vulnerability and degrade Unbound's general performance.
Severity
5.3 (Medium)
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
NLnet Labs
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.nlnetlabs.nl/downloads/unbound/CVE-20… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NLnet Labs | Unbound |
Affected:
0 , < 1.26.2
(semver)
|
Date Public
2026-10-21 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Unbound",
"vendor": "NLnet Labs",
"versions": [
{
"lessThan": "1.26.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuheng Zhang (Tsinghua University \u0026 Jingxian Technology Co., Ltd.)"
},
{
"lang": "en",
"type": "finder",
"value": "Jianjun Chen (Tsinghua University)"
},
{
"lang": "en",
"type": "finder",
"value": "Zihan Wang (Z.AI Co., Ltd.)"
},
{
"lang": "en",
"type": "finder",
"value": "Kaiwen Shen (CloudItera)"
}
],
"datePublic": "2026-10-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious actor with recursive-query access and control of an ordinarily delegated authority that serves specially crafted replies can exploit the vulnerability and degrade Unbound\u0027s general performance."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T08:57:26.986Z",
"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"shortName": "NLnet Labs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-96405.txt"
}
],
"solutions": [
{
"lang": "en",
"value": "This issue is fixed starting with version 1.26.2"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-16T00:00:00.000Z",
"value": "Issue reported by Yuheng Zhang"
},
{
"lang": "en",
"time": "2026-07-17T00:00:00.000Z",
"value": "NLnet Labs shares patch"
},
{
"lang": "en",
"time": "2026-07-17T00:00:00.000Z",
"value": "Yuheng Zhang requests changes"
},
{
"lang": "en",
"time": "2026-07-21T00:00:00.000Z",
"value": "NLnet Labs shares new patch"
},
{
"lang": "en",
"time": "2026-09-30T00:00:00.000Z",
"value": "Yuheng Zhang verifies patch"
},
{
"lang": "en",
"time": "2026-09-16T00:00:00.000Z",
"value": "Coordinated fixes released with version 1.26.2"
}
],
"title": "Aggregate DNS name chained pointer decompression work leads to degradation of service.",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"assignerShortName": "NLnet Labs",
"cveId": "CVE-2026-96405",
"datePublished": "2026-10-21T08:57:26.986Z",
"dateReserved": "2026-10-14T09:16:14.093Z",
"dateUpdated": "2026-10-21T08:57:26.986Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50106 (GCVE-0-2026-50106)
Vulnerability from nvd – Published: 2026-10-21 08:57 – Updated: 2026-10-21 08:57
VLAI
EPSS
VEX
Title
Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent.
Summary
When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name inside the island, with the NSEC/SOA RRSIG 'SignerName' set to the insecure parent, tricks Unbound's validator to use the root trust anchor instead, and consecutively the insecure parent, thus causing that record to be treated as insecure and denying existence for records in the trust island.
Severity
6.5 (Medium)
CWE
- CWE-807 - Reliance on Untrusted Inputs in a Security Decision
Assigner
NLnet Labs
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.nlnetlabs.nl/downloads/unbound/CVE-20… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NLnet Labs | Unbound |
Affected:
0 , < 1.26.2
(semver)
|
Date Public
2026-10-21 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Unbound",
"vendor": "NLnet Labs",
"versions": [
{
"lessThan": "1.26.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Qifan Zhang (Palo Alto Networks)"
}
],
"datePublic": "2026-10-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional \u0027trust-anchor:\u0027 for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name inside the island, with the NSEC/SOA RRSIG \u0027SignerName\u0027 set to the insecure parent, tricks Unbound\u0027s validator to use the root trust anchor instead, and consecutively the insecure parent, thus causing that record to be treated as insecure and denying existence for records in the trust island."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-807",
"description": "CWE-807: Reliance on Untrusted Inputs in a Security Decision",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T08:57:11.040Z",
"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"shortName": "NLnet Labs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50106.txt"
}
],
"solutions": [
{
"lang": "en",
"value": "This issue is fixed starting with version 1.26.2"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-13T00:00:00.000Z",
"value": "Issue reported by Qifan Zhang"
},
{
"lang": "en",
"time": "2026-06-08T00:00:00.000Z",
"value": "NLnet Labs shares patch"
},
{
"lang": "en",
"time": "2026-06-13T00:00:00.000Z",
"value": "Qifan Zhang verifies patch"
},
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Fixes released with version 1.26.2"
}
],
"title": "Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent.",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"assignerShortName": "NLnet Labs",
"cveId": "CVE-2026-50106",
"datePublished": "2026-10-21T08:57:11.040Z",
"dateReserved": "2026-06-22T10:11:10.553Z",
"dateUpdated": "2026-10-21T08:57:11.040Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-35501 (GCVE-0-2026-35501)
Vulnerability from nvd – Published: 2026-10-21 08:56 – Updated: 2026-10-21 08:56
VLAI
EPSS
VEX
Title
Bypass of a configured island trust anchor underneath an insecure parent from an atacker-controlled NSEC record.
Summary
When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor with a forged NSEC reply with the SOA bit cleared can trick Unbound to treat the configured trust island as insecure. This happens because the DNSSEC validator in Unbound accepts and caches the NSEC insecure response bypassing the RRSIG validation that the validator was supposed to do. The acceptance of the NSEC record at the trust anchor apex was allowed due to and old fix for type DS and NSEC queries from clients when trust anchor for that name existed.
Severity
CWE
- CWE-354 - Improper Validation of Integrity Check Value
Assigner
NLnet Labs
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.nlnetlabs.nl/downloads/unbound/CVE-20… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NLnet Labs | Unbound |
Affected:
1.0.1 , < 1.26.2
(semver)
|
Date Public
2026-10-21 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Unbound",
"vendor": "NLnet Labs",
"versions": [
{
"lessThan": "1.26.2",
"status": "affected",
"version": "1.0.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Qifan Zhang (Palo Alto Networks)"
}
],
"datePublic": "2026-10-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an additional \u0027trust-anchor:\u0027 for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor with a forged NSEC reply with the SOA bit cleared can trick Unbound to treat the configured trust island as insecure. This happens because the DNSSEC validator in Unbound accepts and caches the NSEC insecure response bypassing the RRSIG validation that the validator was supposed to do. The acceptance of the NSEC record at the trust anchor apex was allowed due to and old fix for type DS and NSEC queries from clients when trust anchor for that name existed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-354",
"description": "CWE-354: Improper Validation of Integrity Check Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T08:56:55.811Z",
"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"shortName": "NLnet Labs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-35501.txt"
}
],
"solutions": [
{
"lang": "en",
"value": "This issue is fixed starting with version 1.26.2"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-13T00:00:00.000Z",
"value": "Issue reported by Qifan Zhang"
},
{
"lang": "en",
"time": "2026-06-08T00:00:00.000Z",
"value": "NLnet Labs shares patch"
},
{
"lang": "en",
"time": "2026-06-13T00:00:00.000Z",
"value": "Qifan Zhang verifies patch"
},
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Fixes released with version 1.26.2"
}
],
"title": "Bypass of a configured island trust anchor underneath an insecure parent from an atacker-controlled NSEC record.",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"assignerShortName": "NLnet Labs",
"cveId": "CVE-2026-35501",
"datePublished": "2026-10-21T08:56:55.811Z",
"dateReserved": "2026-06-22T10:11:10.543Z",
"dateUpdated": "2026-10-21T08:56:55.811Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109125 (GCVE-0-2026-109125)
Vulnerability from nvd – Published: 2026-10-21 08:56 – Updated: 2026-10-21 08:56
VLAI
EPSS
VEX
Title
Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'
Summary
In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-threshold > 0' configurations (not a default configuration). If a response-like UDP datagram reaches the upstream source port currently used by a recursive query, but its TXID does not match any pending query, Unbound counts the packet as an unwanted reply. When the accumulated count reaches the configured threshold, Unbound clears the worker's RRset cache and message cache. This cache clear action does not destroy the current upstream UDP pending query. Therefore, an external observer can distinguish whether a candidate port matches the current upstream source port by checking whether an existing cached item has been cleared. This is a cache side-channel vulnerability that can be used to probe the upstream source port. Although the attack is not feasible on default configurations and the suggested value (10 million) makes it an ureliable attack on a public resolver, in scenarios where the attacker can keep a concurrent query window alive, the attacker can first filter the source port and then perform birthday-style guessing against the TXID, making cache poisoning a feasible attack path.
Severity
5.3 (Medium)
CWE
- CWE-205 - Observable Behavioral Discrepancy
Assigner
NLnet Labs
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.nlnetlabs.nl/downloads/unbound/CVE-20… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NLnet Labs | Unbound |
Affected:
0 , < 1.26.2
(semver)
|
Date Public
2026-10-21 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Unbound",
"vendor": "NLnet Labs",
"versions": [
{
"lessThan": "1.26.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "TaoFei Guo (Peking University)"
},
{
"lang": "en",
"type": "finder",
"value": "Yang Luo (Tsinghua University)"
},
{
"lang": "en",
"type": "finder",
"value": "JianJun Chen (Tsinghua University)"
}
],
"datePublic": "2026-10-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with \u0027unwanted-reply-threshold \u003e 0\u0027 configurations (not a default configuration). If a response-like UDP datagram reaches the upstream source port currently used by a recursive query, but its TXID does not match any pending query, Unbound counts the packet as an unwanted reply. When the accumulated count reaches the configured threshold, Unbound clears the worker\u0027s RRset cache and message cache. This cache clear action does not destroy the current upstream UDP pending query. Therefore, an external observer can distinguish whether a candidate port matches the current upstream source port by checking whether an existing cached item has been cleared. This is a cache side-channel vulnerability that can be used to probe the upstream source port. Although the attack is not feasible on default configurations and the suggested value (10 million) makes it an ureliable attack on a public resolver, in scenarios where the attacker can keep a concurrent query window alive, the attacker can first filter the source port and then perform birthday-style guessing against the TXID, making cache poisoning a feasible attack path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-205",
"description": "CWE-205: Observable Behavioral Discrepancy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T08:56:35.696Z",
"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"shortName": "NLnet Labs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-109125.txt"
}
],
"solutions": [
{
"lang": "en",
"value": "This issue is fixed starting with version 1.26.2"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-28T00:00:00.000Z",
"value": "Issue reported by TaoFei Guo"
},
{
"lang": "en",
"time": "2026-10-05T00:00:00.000Z",
"value": "NLnet Labs shares patch"
},
{
"lang": "en",
"time": "2026-10-06T00:00:00.000Z",
"value": "TaoFei Guo verifies patch"
},
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Fixes released with version 1.26.2"
}
],
"title": "Possible cache poisoning vulnerability via a cache side-channel exposed by \u0027unwanted-reply-threshold\u0027",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"assignerShortName": "NLnet Labs",
"cveId": "CVE-2026-109125",
"datePublished": "2026-10-21T08:56:35.696Z",
"dateReserved": "2026-10-14T09:16:14.087Z",
"dateUpdated": "2026-10-21T08:56:35.696Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101341 (GCVE-0-2026-101341)
Vulnerability from nvd – Published: 2026-10-14 10:56 – Updated: 2026-10-14 14:08
VLAI
EPSS
VEX
Title
Stack overwrite from specially formatted TXT-DATA RDATA field
Summary
Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which are written out by NSD itself, such for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 14:08 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
NLnet Labs
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-1… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NLnet Labs | NSD |
Affected:
4.10.0 , < 4.15.3
(semver)
|
Date Public
2026-10-14 12:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-101341",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T14:08:02.561206Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:08:20.283Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NSD",
"vendor": "NLnet Labs",
"versions": [
{
"lessThan": "4.15.3",
"status": "affected",
"version": "4.10.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Alwaleed Ashi (LXR) \u003cwaleed.9998@hotmail.com\u003e"
}
],
"datePublic": "2026-10-14T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which are written out by NSD itself, such for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system)."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "When reading zone files, a specially crafted and formatted resource record containing a series of strings (TXT, NINFO, SPF, AVC, RESINFO and WALLET) can cause an out of bounds stack overwrite which can be exploited for execution of arbitrary commands."
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T10:56:51.922Z",
"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"shortName": "NLnet Labs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101341.txt"
}
],
"solutions": [
{
"lang": "en",
"value": "This issue is fixed in 4.15.3 and all later versions."
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-23T15:40:00.000Z",
"value": "Issue reported by Alwaleed Ashi (LXR)"
},
{
"lang": "en",
"time": "2026-09-28T14:59:00.000Z",
"value": "NLnet Labs shares patch"
},
{
"lang": "en",
"time": "2026-09-30T12:46:00.000Z",
"value": "Alwaleed Ashi (LXR) verifies patch"
},
{
"lang": "en",
"time": "2026-10-14T12:00:00.000Z",
"value": "Fix released with version 4.15.3"
}
],
"title": "Stack overwrite from specially formatted TXT-DATA RDATA field",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"assignerShortName": "NLnet Labs",
"cveId": "CVE-2026-101341",
"datePublished": "2026-10-14T10:56:51.922Z",
"dateReserved": "2026-09-28T14:39:03.779Z",
"dateUpdated": "2026-10-14T14:08:20.283Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101339 (GCVE-0-2026-101339)
Vulnerability from nvd – Published: 2026-10-14 10:56 – Updated: 2026-10-14 14:08
VLAI
EPSS
VEX
Title
Stack overwrite from a specially crafted and formatted HIP RR
Summary
A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack with up to 191 bytes of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 14:08 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
NLnet Labs
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-1… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NLnet Labs | NSD |
Affected:
4.10.0 , < 4.15.3
(semver)
|
Date Public
2026-10-14 12:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-101339",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T14:08:37.264291Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:08:51.522Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NSD",
"vendor": "NLnet Labs",
"versions": [
{
"lessThan": "4.15.3",
"status": "affected",
"version": "4.10.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Qifan Zhang from Palo Alto Networks"
},
{
"lang": "en",
"type": "finder",
"value": "Alwaleed Ashi (LXR) \u003cwaleed.9998@hotmail.com\u003e"
}
],
"datePublic": "2026-10-14T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack with up to 191 bytes of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system)."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "When reading zone files, a specially crafted and formatted HIP resource record can cause an out of bounds stack overwrite which can be exploited for execution of arbitrary commands."
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T10:56:37.808Z",
"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"shortName": "NLnet Labs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101339.txt"
}
],
"solutions": [
{
"lang": "en",
"value": "This issue is fixed in 4.15.3 and all later versions."
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-13T08:12:00.000Z",
"value": "Issue reported by Qifan Zhang"
},
{
"lang": "en",
"time": "2026-08-13T08:12:00.000Z",
"value": "Issue reported by Alwaleed Ashi (LXR)"
},
{
"lang": "en",
"time": "2026-09-22T12:55:00.000Z",
"value": "NLnet Labs shares patch with Alwaleed Ashi (LXR)"
},
{
"lang": "en",
"time": "2026-09-23T15:40:00.000Z",
"value": "Alwaleed Ashi (LXR) verifies patch"
},
{
"lang": "en",
"time": "2026-09-27T15:03:00.000Z",
"value": "NLnet Labs shares patch with Qifan Zhang"
},
{
"lang": "en",
"time": "2026-09-28T21:21:00.000Z",
"value": "Qifan Zhang verifies patch"
},
{
"lang": "en",
"time": "2026-10-14T12:00:00.000Z",
"value": "Fix released with version 4.15.3"
}
],
"title": "Stack overwrite from a specially crafted and formatted HIP RR",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"assignerShortName": "NLnet Labs",
"cveId": "CVE-2026-101339",
"datePublished": "2026-10-14T10:56:37.808Z",
"dateReserved": "2026-09-28T14:39:03.778Z",
"dateUpdated": "2026-10-14T14:08:51.522Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101338 (GCVE-0-2026-101338)
Vulnerability from nvd – Published: 2026-10-14 10:56 – Updated: 2026-10-14 14:09
VLAI
EPSS
VEX
Title
Stack overwrite from a specially crafted and formatted SVCB or HTTPS RR
Summary
When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of unlimited size. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 14:09 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
NLnet Labs
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-1… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NLnet Labs | NSD |
Affected:
4.10.0 , < 4.15.3
(semver)
|
Date Public
2026-10-14 12:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-101338",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T14:09:10.026829Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:09:20.163Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NSD",
"vendor": "NLnet Labs",
"versions": [
{
"lessThan": "4.15.3",
"status": "affected",
"version": "4.10.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Qifan Zhang from Palo Alto Networks"
}
],
"datePublic": "2026-10-14T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of unlimited size. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system)."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "When reading zone files, a specially crafted and format SVCB or HTTPS record cancause an out of bounds stack overwrite which can be exploited for execution of arbitrary commands."
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T10:56:28.223Z",
"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"shortName": "NLnet Labs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101338.txt"
}
],
"solutions": [
{
"lang": "en",
"value": "This issue is fixed in 4.15.3 and all later versions."
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-13T08:12:00.000Z",
"value": "Issue reported by Qifan Zhang"
},
{
"lang": "en",
"time": "2026-09-27T15:03:00.000Z",
"value": "NLnet Labs shares patch"
},
{
"lang": "en",
"time": "2026-09-28T21:21:00.000Z",
"value": "Qifan Zhang verifies patch"
},
{
"lang": "en",
"time": "2026-10-14T12:00:00.000Z",
"value": "Fix released with version 4.15.3"
}
],
"title": "Stack overwrite from a specially crafted and formatted SVCB or HTTPS RR",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"assignerShortName": "NLnet Labs",
"cveId": "CVE-2026-101338",
"datePublished": "2026-10-14T10:56:28.223Z",
"dateReserved": "2026-09-28T14:39:03.778Z",
"dateUpdated": "2026-10-14T14:09:20.163Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101337 (GCVE-0-2026-101337)
Vulnerability from nvd – Published: 2026-10-14 10:56 – Updated: 2026-10-14 14:09
VLAI
EPSS
VEX
Title
Stack overwrite from specially formatted base64 RDATA field
Summary
When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 14:09 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
NLnet Labs
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-1… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NLnet Labs | NSD |
Affected:
4.10.0 , < 4.15.3
(semver)
|
Date Public
2026-10-14 12:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-101337",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T14:09:47.568694Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:09:58.370Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NSD",
"vendor": "NLnet Labs",
"versions": [
{
"lessThan": "4.15.3",
"status": "affected",
"version": "4.10.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Qifan Zhang from Palo Alto Networks"
},
{
"lang": "en",
"type": "finder",
"value": "Gaurang Maheta"
}
],
"datePublic": "2026-10-14T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system)."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "When reading zone files, a resource record with a base64 RDATA field in a specially crafted presentation format, can cause an out of bounds stack overwrite which can be exploited for execution of arbitrary command."
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T10:56:15.073Z",
"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"shortName": "NLnet Labs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101337.txt"
}
],
"solutions": [
{
"lang": "en",
"value": "This issue is fixed in 4.15.3 and all later versions."
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-13T08:12:00.000Z",
"value": "Issue reported by Qifan Zhang"
},
{
"lang": "en",
"time": "2026-09-02T11:12:00.000Z",
"value": "Issue reported by Gaurang Maheta"
},
{
"lang": "en",
"time": "2026-09-02T11:43:00.000Z",
"value": "NLnet Labs shares patch with Gaurang Maheta"
},
{
"lang": "en",
"time": "2026-09-02T11:49:00.000Z",
"value": "Gaurang Maheta verifies patch"
},
{
"lang": "en",
"time": "2026-09-27T15:03:00.000Z",
"value": "NLnet Labs shares patch with Qifan Zhang"
},
{
"lang": "en",
"time": "2026-09-29T09:49:00.000Z",
"value": "NLnet Labs shares updated patch with Qifan Zhang"
},
{
"lang": "en",
"time": "2026-10-02T02:03:00.000Z",
"value": "Qifan Zhang verifies patch"
},
{
"lang": "en",
"time": "2026-10-14T12:00:00.000Z",
"value": "Fix released with version 4.15.3"
}
],
"title": "Stack overwrite from specially formatted base64 RDATA field",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"assignerShortName": "NLnet Labs",
"cveId": "CVE-2026-101337",
"datePublished": "2026-10-14T10:56:15.073Z",
"dateReserved": "2026-09-28T14:39:03.778Z",
"dateUpdated": "2026-10-14T14:09:58.370Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85501 (GCVE-0-2026-85501)
Vulnerability from nvd – Published: 2026-09-16 08:32 – Updated: 2026-09-16 14:12
VLAI
EPSS
VEX
Title
Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC
Summary
Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested domains, this results in significant computational overhead. NsecTrap, where responses with excessive invalid NSEC records compel the resolver to validate each one. AdditionalTrap, where Unbound by default would try to DNSSEC validate the ADDITIONAL section as well. This can be exploited to waste validation resources by malicious users.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 14:10 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
NLnet Labs
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.nlnetlabs.nl/downloads/unbound/CVE-20… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NLnet Labs | Unbound |
Affected:
0 , < 1.26.1
(semver)
|
Date Public
2026-09-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85501",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T14:10:48.623819Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:12:18.996Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Unbound",
"vendor": "NLnet Labs",
"versions": [
{
"lessThan": "1.26.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zuyao Xu (Nankai University, AOSP Lab)"
},
{
"lang": "en",
"type": "finder",
"value": "Xiang Li (Nankai University, AOSP Lab)"
},
{
"lang": "en",
"type": "finder",
"value": "Qifan Zhang (Palo Alto Networks)"
}
],
"datePublic": "2026-09-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term \u0027ReTrap\u0027. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested domains, this results in significant computational overhead. NsecTrap, where responses with excessive invalid NSEC records compel the resolver to validate each one. AdditionalTrap, where Unbound by default would try to DNSSEC validate the ADDITIONAL section as well. This can be exploited to waste validation resources by malicious users."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T08:32:25.398Z",
"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"shortName": "NLnet Labs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-85501.txt"
}
],
"solutions": [
{
"lang": "en",
"value": "This issue is fixed starting with version 1.26.1"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-05-24T00:00:00.000Z",
"value": "Issue reported by Zuyao Xu"
},
{
"lang": "en",
"time": "2025-05-28T00:00:00.000Z",
"value": "NLnet Labs shares some concerns about the testing methodology"
},
{
"lang": "en",
"time": "2025-08-14T00:00:00.000Z",
"value": "Zuyao Xu shares updated research results"
},
{
"lang": "en",
"time": "2025-08-26T00:00:00.000Z",
"value": "NLnet Labs shares patch with Zuyao Xu"
},
{
"lang": "en",
"time": "2025-09-03T00:00:00.000Z",
"value": "Zuyao Xu verifies patch"
},
{
"lang": "en",
"time": "2026-05-05T00:00:00.000Z",
"value": "Issue similar to TagTrap reported by Qifan Zhang"
},
{
"lang": "en",
"time": "2026-05-07T00:00:00.000Z",
"value": "NLnet Labs shares patch with Qifan Zhang"
},
{
"lang": "en",
"time": "2026-05-08T00:00:00.000Z",
"value": "Qifan Zhang verifies patch"
},
{
"lang": "en",
"time": "2026-09-16T00:00:00.000Z",
"value": "Fixes released with version 1.26.1"
}
],
"title": "Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"assignerShortName": "NLnet Labs",
"cveId": "CVE-2026-85501",
"datePublished": "2026-09-16T08:32:25.398Z",
"dateReserved": "2026-09-07T14:06:21.977Z",
"dateUpdated": "2026-09-16T14:12:18.996Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82720 (GCVE-0-2026-82720)
Vulnerability from nvd – Published: 2026-09-16 08:32 – Updated: 2026-09-16 14:14
VLAI
EPSS
VEX
Title
Use-after-free in DoH stream cleanup code path
Summary
NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. During failure code paths (i.e., RPZ drop query, jostle due to heavy traffic), a dropped DoH stream brings down the whole DoH session and does not account properly for other DoH streams in the same session. This leads to use-after-free in those code paths. If the prerequisites are satisfied (possible RPZ drop or heavy client traffic), a malicious actor can trigger the vulnerability with a single DoH connection and the appropriate traffic. Impact is limited as the reads are not user controlled and the use-after-free leads to early returns. However, a hardened allocator can catch the use-after-free and controllably terminate the process resulting to denial of service.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 14:13 UTC
CWE
- CWE-416 - Use After Free
Assigner
NLnet Labs
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.nlnetlabs.nl/downloads/unbound/CVE-20… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NLnet Labs | Unbound |
Affected:
1.12.0 , < 1.26.1
(semver)
|
Date Public
2026-09-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82720",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T14:13:03.616721Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:14:25.720Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Unbound",
"vendor": "NLnet Labs",
"versions": [
{
"lessThan": "1.26.1",
"status": "affected",
"version": "1.12.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuqi Qiu (Nankai University, AOSP Lab)"
},
{
"lang": "en",
"type": "finder",
"value": "Xiang Li (Nankai University, AOSP Lab)"
}
],
"datePublic": "2026-09-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with \u0027--with-libnghttp2\u0027. During failure code paths (i.e., RPZ drop query, jostle due to heavy traffic), a dropped DoH stream brings down the whole DoH session and does not account properly for other DoH streams in the same session. This leads to use-after-free in those code paths. If the prerequisites are satisfied (possible RPZ drop or heavy client traffic), a malicious actor can trigger the vulnerability with a single DoH connection and the appropriate traffic. Impact is limited as the reads are not user controlled and the use-after-free leads to early returns. However, a hardened allocator can catch the use-after-free and controllably terminate the process resulting to denial of service."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "Compiled with DNS-over-HTTPs support"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T08:32:10.359Z",
"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"shortName": "NLnet Labs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-82720.txt"
}
],
"solutions": [
{
"lang": "en",
"value": "This issue is fixed starting with version 1.26.1"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-11T00:00:00.000Z",
"value": "Issue reported by Yuqi Qiu"
},
{
"lang": "en",
"time": "2026-08-13T00:00:00.000Z",
"value": "NLnet Labs shares patch"
},
{
"lang": "en",
"time": "2026-08-14T00:00:00.000Z",
"value": "Yuqi Qiu verifies patch"
},
{
"lang": "en",
"time": "2026-09-16T00:00:00.000Z",
"value": "Fixes released with version 1.26.1"
}
],
"title": "Use-after-free in DoH stream cleanup code path",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"assignerShortName": "NLnet Labs",
"cveId": "CVE-2026-82720",
"datePublished": "2026-09-16T08:32:10.359Z",
"dateReserved": "2026-09-07T14:06:21.960Z",
"dateUpdated": "2026-09-16T14:14:25.720Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82717 (GCVE-0-2026-82717)
Vulnerability from nvd – Published: 2026-09-16 08:31 – Updated: 2026-09-16 14:15
VLAI
EPSS
VEX
Title
CNAME synthesis could lead to heap corruption
Summary
In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 14:15 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
NLnet Labs
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.nlnetlabs.nl/downloads/unbound/CVE-20… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NLnet Labs | Unbound |
Affected:
0 , < 1.26.1
(semver)
|
Date Public
2026-09-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82717",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T14:15:46.463136Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:15:55.295Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Unbound",
"vendor": "NLnet Labs",
"versions": [
{
"lessThan": "1.26.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ben Morris (Anthropic)"
}
],
"datePublic": "2026-09-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T08:31:59.417Z",
"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"shortName": "NLnet Labs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-82717.txt"
}
],
"solutions": [
{
"lang": "en",
"value": "This issue is fixed starting with version 1.26.1"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-23T00:00:00.000Z",
"value": "Issue reported by Ben Morris"
},
{
"lang": "en",
"time": "2026-07-23T00:00:00.000Z",
"value": "NLnet Labs shares patch"
},
{
"lang": "en",
"time": "2026-07-23T00:00:00.000Z",
"value": "Ben Morris verifies patch"
},
{
"lang": "en",
"time": "2026-09-16T00:00:00.000Z",
"value": "Fixes released with version 1.26.1"
}
],
"title": "CNAME synthesis could lead to heap corruption",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"assignerShortName": "NLnet Labs",
"cveId": "CVE-2026-82717",
"datePublished": "2026-09-16T08:31:59.417Z",
"dateReserved": "2026-09-07T14:06:21.974Z",
"dateUpdated": "2026-09-16T14:15:55.295Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81642 (GCVE-0-2026-81642)
Vulnerability from nvd – Published: 2026-09-16 08:30 – Updated: 2026-09-16 14:32
VLAI
EPSS
VEX
Title
Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY
Summary
In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA can overflow the digest buffer. Remote code execution is possible through attacker controlled data. An adversary can exploit the vulnerability by controlling a malicious zone and querying a vulnerable Unbound.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 14:30 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
NLnet Labs
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.nlnetlabs.nl/downloads/unbound/CVE-20… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NLnet Labs | Unbound |
Affected:
0 , < 1.26.1
(semver)
|
Date Public
2026-09-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81642",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T14:30:20.298477Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:32:16.825Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Unbound",
"vendor": "NLnet Labs",
"versions": [
{
"lessThan": "1.26.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuqi Qiu (Nankai University, AOSP Lab)"
},
{
"lang": "en",
"type": "finder",
"value": "Xiang Li (Nankai University, AOSP Lab)"
}
],
"datePublic": "2026-09-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA can overflow the digest buffer. Remote code execution is possible through attacker controlled data. An adversary can exploit the vulnerability by controlling a malicious zone and querying a vulnerable Unbound."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/U:Red",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T08:30:58.604Z",
"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"shortName": "NLnet Labs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81642.txt"
}
],
"solutions": [
{
"lang": "en",
"value": "This issue is fixed starting with version 1.26.1"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-11T00:00:00.000Z",
"value": "Issue reported by Yuqi Qiu"
},
{
"lang": "en",
"time": "2026-08-12T00:00:00.000Z",
"value": "NLnet Labs shares patch"
},
{
"lang": "en",
"time": "2026-08-13T00:00:00.000Z",
"value": "Yuqi Qiu verifies patch"
},
{
"lang": "en",
"time": "2026-09-16T00:00:00.000Z",
"value": "Fixes released with version 1.26.1"
}
],
"title": "Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"assignerShortName": "NLnet Labs",
"cveId": "CVE-2026-81642",
"datePublished": "2026-09-16T08:30:58.604Z",
"dateReserved": "2026-09-07T14:06:21.956Z",
"dateUpdated": "2026-09-16T14:32:16.825Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81634 (GCVE-0-2026-81634)
Vulnerability from nvd – Published: 2026-09-16 08:30 – Updated: 2026-09-16 14:32
VLAI
EPSS
VEX
Title
Possible heap buffer overflow during DNSSEC canonicalization
Summary
In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNSSEC validation), can trigger the vulnerability.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 14:32 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
NLnet Labs
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.nlnetlabs.nl/downloads/unbound/CVE-20… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NLnet Labs | Unbound |
Affected:
0 , < 1.26.1
(semver)
|
Date Public
2026-09-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81634",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T14:32:31.803030Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:32:38.842Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Unbound",
"vendor": "NLnet Labs",
"versions": [
{
"lessThan": "1.26.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Vlatko Kosturjak (Marlink Cyber)"
}
],
"datePublic": "2026-09-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNSSEC validation), can trigger the vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T08:30:15.428Z",
"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"shortName": "NLnet Labs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81634.txt"
}
],
"solutions": [
{
"lang": "en",
"value": "This issue is fixed starting with version 1.26.1"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-31T00:00:00.000Z",
"value": "Issue reported by Vlatko Kosturjak"
},
{
"lang": "en",
"time": "2026-08-03T00:00:00.000Z",
"value": "NLnet Labs shares patch"
},
{
"lang": "en",
"time": "2026-08-04T00:00:00.000Z",
"value": "Vlatko Kosturjak verifies patch"
},
{
"lang": "en",
"time": "2026-09-16T00:00:00.000Z",
"value": "Fixes released with version 1.26.1"
}
],
"title": "Possible heap buffer overflow during DNSSEC canonicalization",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"assignerShortName": "NLnet Labs",
"cveId": "CVE-2026-81634",
"datePublished": "2026-09-16T08:30:15.428Z",
"dateReserved": "2026-09-07T14:06:21.967Z",
"dateUpdated": "2026-09-16T14:32:38.842Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80225 (GCVE-0-2026-80225)
Vulnerability from nvd – Published: 2026-09-16 08:30 – Updated: 2026-09-16 14:33
VLAI
EPSS
VEX
Title
Possible degradation of service from continuous queries on the same TCP/DoT connection
Summary
In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 14:32 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
NLnet Labs
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.nlnetlabs.nl/downloads/unbound/CVE-20… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NLnet Labs | Unbound |
Affected:
0 , < 1.26.1
(semver)
|
Date Public
2026-09-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80225",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T14:32:57.188145Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:33:08.344Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Unbound",
"vendor": "NLnet Labs",
"versions": [
{
"lessThan": "1.26.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Qifan Zhang (Palo Alto Networks)"
}
],
"datePublic": "2026-09-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker\u0027s entire event loop for as long as its writes stay ahead of the drain."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T08:30:04.246Z",
"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"shortName": "NLnet Labs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-80225.txt"
}
],
"solutions": [
{
"lang": "en",
"value": "This issue is fixed starting with version 1.26.1"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-12T00:00:00.000Z",
"value": "Issue reported by Qifan Zhang"
},
{
"lang": "en",
"time": "2026-09-01T00:00:00.000Z",
"value": "NLnet Labs shares patch"
},
{
"lang": "en",
"time": "2026-09-16T00:00:00.000Z",
"value": "Fixes released with version 1.26.1"
}
],
"title": "Possible degradation of service from continuous queries on the same TCP/DoT connection",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"assignerShortName": "NLnet Labs",
"cveId": "CVE-2026-80225",
"datePublished": "2026-09-16T08:30:04.246Z",
"dateReserved": "2026-09-07T14:06:21.952Z",
"dateUpdated": "2026-09-16T14:33:08.344Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78227 (GCVE-0-2026-78227)
Vulnerability from nvd – Published: 2026-09-16 08:29 – Updated: 2026-09-16 15:33
VLAI
EPSS
VEX
Title
Use-after-free in DoQ stream output buffer on reset re-transmission
Summary
NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that holds the DNS response. ngtcp2's retransmission buffer keeps a shallow pointer into the output buffer for as long as a STREAM frame may be resent. On a client RESET_STREAM, the output buffer is freed but ngtcp2 still holds the matching retransmission entries. The next PTO timeout makes ngtcp2 re-encode the STREAM frame and copy from the freed buffer. A malicious actor that can query Unbound over DoQ and that withholds ACKs, sends RESET_STREAM, and waits for PTO, reaches this use-after-free with no privilege. This leads to retransmissions against freed memory and eventually an abnormal server exit under a 20-query spray.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 15:33 UTC
CWE
- CWE-416 - Use After Free
Assigner
NLnet Labs
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.nlnetlabs.nl/downloads/unbound/CVE-20… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NLnet Labs | Unbound |
Affected:
1.22.0 , < 1.26.1
(semver)
|
Date Public
2026-09-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78227",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T15:33:40.171223Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T15:33:54.267Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Unbound",
"vendor": "NLnet Labs",
"versions": [
{
"lessThan": "1.26.1",
"status": "affected",
"version": "1.22.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuqi Qiu (Nankai University, AOSP Lab)"
},
{
"lang": "en",
"type": "finder",
"value": "Xiang Li (Nankai University, AOSP Lab)"
}
],
"datePublic": "2026-09-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with \u0027--with-libngtcp2\u0027. Each DoQ stream owns an output buffer that holds the DNS response. ngtcp2\u0027s retransmission buffer keeps a shallow pointer into the output buffer for as long as a STREAM frame may be resent. On a client RESET_STREAM, the output buffer is freed but ngtcp2 still holds the matching retransmission entries. The next PTO timeout makes ngtcp2 re-encode the STREAM frame and copy from the freed buffer. A malicious actor that can query Unbound over DoQ and that withholds ACKs, sends RESET_STREAM, and waits for PTO, reaches this use-after-free with no privilege. This leads to retransmissions against freed memory and eventually an abnormal server exit under a 20-query spray."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "compiled with DNS-over-QUIC support"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T08:29:52.342Z",
"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"shortName": "NLnet Labs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-78227.txt"
}
],
"solutions": [
{
"lang": "en",
"value": "This issue is fixed starting with version 1.26.1"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-11T00:00:00.000Z",
"value": "Issue reported by Yuqi Qiu"
},
{
"lang": "en",
"time": "2026-08-13T00:00:00.000Z",
"value": "NLnet Labs shares patch"
},
{
"lang": "en",
"time": "2026-08-14T00:00:00.000Z",
"value": "Yuqi Qiu verifies patch"
},
{
"lang": "en",
"time": "2026-09-16T00:00:00.000Z",
"value": "Fixes released with version 1.26.1"
}
],
"title": "Use-after-free in DoQ stream output buffer on reset re-transmission",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"assignerShortName": "NLnet Labs",
"cveId": "CVE-2026-78227",
"datePublished": "2026-09-16T08:29:52.342Z",
"dateReserved": "2026-09-07T14:06:21.963Z",
"dateUpdated": "2026-09-16T15:33:54.267Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77955 (GCVE-0-2026-77955)
Vulnerability from nvd – Published: 2026-09-16 08:29 – Updated: 2026-09-16 14:33
VLAI
EPSS
VEX
Title
Possible ZONEMD verification bypass window
Summary
In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check failed, the tampered data are reloaded on startup and available until ZONEMD verification concludes again. If verification fails, the data is not served any more but still persists on disk for future reloads.
Severity
4.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 14:33 UTC
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Assigner
NLnet Labs
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.nlnetlabs.nl/downloads/unbound/CVE-20… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NLnet Labs | Unbound |
Affected:
1.13.2 , < 1.26.1
(semver)
|
Date Public
2026-09-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77955",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T14:33:18.720420Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:33:24.961Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Unbound",
"vendor": "NLnet Labs",
"versions": [
{
"lessThan": "1.26.1",
"status": "affected",
"version": "1.13.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuqi Qiu (Nankai University, AOSP Lab)"
},
{
"lang": "en",
"type": "finder",
"value": "Xiang Li (Nankai University, AOSP Lab)"
},
{
"lang": "en",
"type": "finder",
"value": "Qifan Zhang (Palo Alto Networks)"
}
],
"datePublic": "2026-09-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check failed, the tampered data are reloaded on startup and available until ZONEMD verification concludes again. If verification fails, the data is not served any more but still persists on disk for future reloads."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "\u0027zonemd-check: yes\u0027 configured for authoritative zones"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T08:29:39.955Z",
"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"shortName": "NLnet Labs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-77955.txt"
}
],
"solutions": [
{
"lang": "en",
"value": "This issue is fixed starting with version 1.26.1"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-11T00:00:00.000Z",
"value": "Issue reported by Yuqi Qiu"
},
{
"lang": "en",
"time": "2026-08-16T00:00:00.000Z",
"value": "Issue reported by Qifan Zhang"
},
{
"lang": "en",
"time": "2026-08-19T00:00:00.000Z",
"value": "NLnet Labs shares patch with Yuqi Qiu"
},
{
"lang": "en",
"time": "2026-08-20T00:00:00.000Z",
"value": "Yuqi Qiu verifies patch"
},
{
"lang": "en",
"time": "2026-09-01T00:00:00.000Z",
"value": "NLnet Labs shares patch with Qifan Zhang"
},
{
"lang": "en",
"time": "2026-09-16T00:00:00.000Z",
"value": "Fixes released with version 1.26.1"
}
],
"title": "Possible ZONEMD verification bypass window",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"assignerShortName": "NLnet Labs",
"cveId": "CVE-2026-77955",
"datePublished": "2026-09-16T08:29:39.955Z",
"dateReserved": "2026-09-07T14:06:21.947Z",
"dateUpdated": "2026-09-16T14:33:24.961Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77860 (GCVE-0-2026-77860)
Vulnerability from nvd – Published: 2026-09-16 08:29 – Updated: 2026-09-16 14:45
VLAI
EPSS
VEX
Title
'serve-expired' can bypass Unbound 'wait-limit'
Summary
In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb (CVE-2024-33655). A malicious actor can exploit this by controlling an authoritative zone with short TTL, so cached entries expire quickly. Each 'slow' query, one the attacker's authoritative never answers, is followed by one query for an expired cached name, which is answered immediately via the 'serve-expired' path and decrements the counter twice. This second query was named 'pump'. By alternating slow queries and pumps, the attacker keeps the per-client counter at or below the configured 'wait-limit' indefinitely, and can hold an arbitrary number of pending queries from a single source IP, up to the global mesh quota (num-queries-per-thread); eventually bypassing one of the counter measures introduced for DNSBomb (CVE-2024-33655). This vulnerability is present on the 'serve-expired' code path.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 14:45 UTC
CWE
- CWE-675 - Multiple Operations on Resource in Single-Operation Context
Assigner
NLnet Labs
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.nlnetlabs.nl/downloads/unbound/CVE-20… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NLnet Labs | Unbound |
Affected:
1.20.0 , < 1.26.1
(semver)
|
Date Public
2026-09-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77860",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T14:45:26.867772Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:45:35.788Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Unbound",
"vendor": "NLnet Labs",
"versions": [
{
"lessThan": "1.26.1",
"status": "affected",
"version": "1.20.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Xuanchao Xie (University of Science and Technology of China)"
},
{
"lang": "en",
"type": "finder",
"value": "Lutong Chen (University of Science and Technology of China)"
},
{
"lang": "en",
"type": "finder",
"value": "Kaiping Xue (University of Science and Technology of China)"
}
],
"datePublic": "2026-09-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the \u0027serve-expired\u0027 code path can cause a double decrement on the \u0027wait-limit\u0027 counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb (CVE-2024-33655). A malicious actor can exploit this by controlling an authoritative zone with short TTL, so cached entries expire quickly. Each \u0027slow\u0027 query, one the attacker\u0027s authoritative never answers, is followed by one query for an expired cached name, which is answered immediately via the \u0027serve-expired\u0027 path and decrements the counter twice. This second query was named \u0027pump\u0027. By alternating slow queries and pumps, the attacker keeps the per-client counter at or below the configured \u0027wait-limit\u0027 indefinitely, and can hold an arbitrary number of pending queries from a single source IP, up to the global mesh quota (num-queries-per-thread); eventually bypassing one of the counter measures introduced for DNSBomb (CVE-2024-33655). This vulnerability is present on the \u0027serve-expired\u0027 code path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "\u0027serve-expired\u0027 configuration option used"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-675",
"description": "CWE-675: Multiple Operations on Resource in Single-Operation Context",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T08:29:23.501Z",
"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"shortName": "NLnet Labs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-77860.txt"
}
],
"solutions": [
{
"lang": "en",
"value": "This issue is fixed starting with version 1.26.1"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-30T00:00:00.000Z",
"value": "Issue reported by Xuanchao Xie"
},
{
"lang": "en",
"time": "2026-07-30T00:00:00.000Z",
"value": "NLnet Labs shares patch"
},
{
"lang": "en",
"time": "2026-07-30T00:00:00.000Z",
"value": "Xuanchao Xie verifies patch"
},
{
"lang": "en",
"time": "2026-09-16T00:00:00.000Z",
"value": "Fixes released with version 1.26.1"
}
],
"title": "\u0027serve-expired\u0027 can bypass Unbound \u0027wait-limit\u0027",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"assignerShortName": "NLnet Labs",
"cveId": "CVE-2026-77860",
"datePublished": "2026-09-16T08:29:23.501Z",
"dateReserved": "2026-09-07T14:06:21.971Z",
"dateUpdated": "2026-09-16T14:45:35.788Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97206 (GCVE-0-2026-97206)
Vulnerability from cvelistv5 – Published: 2026-10-21 08:57 – Updated: 2026-10-21 08:57
VLAI
EPSS
VEX
Title
DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.
Summary
NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.
Severity
7.5 (High)
CWE
- CWE-416 - Use After Free
Assigner
NLnet Labs
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.nlnetlabs.nl/downloads/unbound/CVE-20… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NLnet Labs | Unbound |
Affected:
1.22.0 , < 1.26.2
(semver)
|
Date Public
2026-10-21 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Unbound",
"vendor": "NLnet Labs",
"versions": [
{
"lessThan": "1.26.2",
"status": "affected",
"version": "1.22.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kunta Chu (Tsinghua University)"
},
{
"lang": "en",
"type": "finder",
"value": "Jianjun Chen (Tsinghua University)"
}
],
"datePublic": "2026-10-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "compiled with DNS-over-QUIC support"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T08:57:41.106Z",
"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"shortName": "NLnet Labs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-97206.txt"
}
],
"solutions": [
{
"lang": "en",
"value": "This issue is fixed starting with version 1.26.2"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-20T00:00:00.000Z",
"value": "Issue reported by Kunta Chu"
},
{
"lang": "en",
"time": "2026-09-29T00:00:00.000Z",
"value": "NLnet Labs shares patch"
},
{
"lang": "en",
"time": "2026-09-30T00:00:00.000Z",
"value": "Kunta Chu verifies patch"
},
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Fixes released with version 1.26.2"
}
],
"title": "DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"assignerShortName": "NLnet Labs",
"cveId": "CVE-2026-97206",
"datePublished": "2026-10-21T08:57:41.106Z",
"dateReserved": "2026-10-14T09:16:14.090Z",
"dateUpdated": "2026-10-21T08:57:41.106Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96405 (GCVE-0-2026-96405)
Vulnerability from cvelistv5 – Published: 2026-10-21 08:57 – Updated: 2026-10-21 08:57
VLAI
EPSS
VEX
Title
Aggregate DNS name chained pointer decompression work leads to degradation of service.
Summary
NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious actor with recursive-query access and control of an ordinarily delegated authority that serves specially crafted replies can exploit the vulnerability and degrade Unbound's general performance.
Severity
5.3 (Medium)
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
NLnet Labs
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.nlnetlabs.nl/downloads/unbound/CVE-20… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NLnet Labs | Unbound |
Affected:
0 , < 1.26.2
(semver)
|
Date Public
2026-10-21 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Unbound",
"vendor": "NLnet Labs",
"versions": [
{
"lessThan": "1.26.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuheng Zhang (Tsinghua University \u0026 Jingxian Technology Co., Ltd.)"
},
{
"lang": "en",
"type": "finder",
"value": "Jianjun Chen (Tsinghua University)"
},
{
"lang": "en",
"type": "finder",
"value": "Zihan Wang (Z.AI Co., Ltd.)"
},
{
"lang": "en",
"type": "finder",
"value": "Kaiwen Shen (CloudItera)"
}
],
"datePublic": "2026-10-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious actor with recursive-query access and control of an ordinarily delegated authority that serves specially crafted replies can exploit the vulnerability and degrade Unbound\u0027s general performance."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T08:57:26.986Z",
"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"shortName": "NLnet Labs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-96405.txt"
}
],
"solutions": [
{
"lang": "en",
"value": "This issue is fixed starting with version 1.26.2"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-16T00:00:00.000Z",
"value": "Issue reported by Yuheng Zhang"
},
{
"lang": "en",
"time": "2026-07-17T00:00:00.000Z",
"value": "NLnet Labs shares patch"
},
{
"lang": "en",
"time": "2026-07-17T00:00:00.000Z",
"value": "Yuheng Zhang requests changes"
},
{
"lang": "en",
"time": "2026-07-21T00:00:00.000Z",
"value": "NLnet Labs shares new patch"
},
{
"lang": "en",
"time": "2026-09-30T00:00:00.000Z",
"value": "Yuheng Zhang verifies patch"
},
{
"lang": "en",
"time": "2026-09-16T00:00:00.000Z",
"value": "Coordinated fixes released with version 1.26.2"
}
],
"title": "Aggregate DNS name chained pointer decompression work leads to degradation of service.",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"assignerShortName": "NLnet Labs",
"cveId": "CVE-2026-96405",
"datePublished": "2026-10-21T08:57:26.986Z",
"dateReserved": "2026-10-14T09:16:14.093Z",
"dateUpdated": "2026-10-21T08:57:26.986Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50106 (GCVE-0-2026-50106)
Vulnerability from cvelistv5 – Published: 2026-10-21 08:57 – Updated: 2026-10-21 08:57
VLAI
EPSS
VEX
Title
Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent.
Summary
When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name inside the island, with the NSEC/SOA RRSIG 'SignerName' set to the insecure parent, tricks Unbound's validator to use the root trust anchor instead, and consecutively the insecure parent, thus causing that record to be treated as insecure and denying existence for records in the trust island.
Severity
6.5 (Medium)
CWE
- CWE-807 - Reliance on Untrusted Inputs in a Security Decision
Assigner
NLnet Labs
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.nlnetlabs.nl/downloads/unbound/CVE-20… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NLnet Labs | Unbound |
Affected:
0 , < 1.26.2
(semver)
|
Date Public
2026-10-21 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Unbound",
"vendor": "NLnet Labs",
"versions": [
{
"lessThan": "1.26.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Qifan Zhang (Palo Alto Networks)"
}
],
"datePublic": "2026-10-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional \u0027trust-anchor:\u0027 for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name inside the island, with the NSEC/SOA RRSIG \u0027SignerName\u0027 set to the insecure parent, tricks Unbound\u0027s validator to use the root trust anchor instead, and consecutively the insecure parent, thus causing that record to be treated as insecure and denying existence for records in the trust island."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-807",
"description": "CWE-807: Reliance on Untrusted Inputs in a Security Decision",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T08:57:11.040Z",
"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"shortName": "NLnet Labs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50106.txt"
}
],
"solutions": [
{
"lang": "en",
"value": "This issue is fixed starting with version 1.26.2"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-13T00:00:00.000Z",
"value": "Issue reported by Qifan Zhang"
},
{
"lang": "en",
"time": "2026-06-08T00:00:00.000Z",
"value": "NLnet Labs shares patch"
},
{
"lang": "en",
"time": "2026-06-13T00:00:00.000Z",
"value": "Qifan Zhang verifies patch"
},
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Fixes released with version 1.26.2"
}
],
"title": "Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent.",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"assignerShortName": "NLnet Labs",
"cveId": "CVE-2026-50106",
"datePublished": "2026-10-21T08:57:11.040Z",
"dateReserved": "2026-06-22T10:11:10.553Z",
"dateUpdated": "2026-10-21T08:57:11.040Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-35501 (GCVE-0-2026-35501)
Vulnerability from cvelistv5 – Published: 2026-10-21 08:56 – Updated: 2026-10-21 08:56
VLAI
EPSS
VEX
Title
Bypass of a configured island trust anchor underneath an insecure parent from an atacker-controlled NSEC record.
Summary
When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor with a forged NSEC reply with the SOA bit cleared can trick Unbound to treat the configured trust island as insecure. This happens because the DNSSEC validator in Unbound accepts and caches the NSEC insecure response bypassing the RRSIG validation that the validator was supposed to do. The acceptance of the NSEC record at the trust anchor apex was allowed due to and old fix for type DS and NSEC queries from clients when trust anchor for that name existed.
Severity
CWE
- CWE-354 - Improper Validation of Integrity Check Value
Assigner
NLnet Labs
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.nlnetlabs.nl/downloads/unbound/CVE-20… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NLnet Labs | Unbound |
Affected:
1.0.1 , < 1.26.2
(semver)
|
Date Public
2026-10-21 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Unbound",
"vendor": "NLnet Labs",
"versions": [
{
"lessThan": "1.26.2",
"status": "affected",
"version": "1.0.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Qifan Zhang (Palo Alto Networks)"
}
],
"datePublic": "2026-10-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an additional \u0027trust-anchor:\u0027 for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor with a forged NSEC reply with the SOA bit cleared can trick Unbound to treat the configured trust island as insecure. This happens because the DNSSEC validator in Unbound accepts and caches the NSEC insecure response bypassing the RRSIG validation that the validator was supposed to do. The acceptance of the NSEC record at the trust anchor apex was allowed due to and old fix for type DS and NSEC queries from clients when trust anchor for that name existed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-354",
"description": "CWE-354: Improper Validation of Integrity Check Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T08:56:55.811Z",
"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"shortName": "NLnet Labs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-35501.txt"
}
],
"solutions": [
{
"lang": "en",
"value": "This issue is fixed starting with version 1.26.2"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-13T00:00:00.000Z",
"value": "Issue reported by Qifan Zhang"
},
{
"lang": "en",
"time": "2026-06-08T00:00:00.000Z",
"value": "NLnet Labs shares patch"
},
{
"lang": "en",
"time": "2026-06-13T00:00:00.000Z",
"value": "Qifan Zhang verifies patch"
},
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Fixes released with version 1.26.2"
}
],
"title": "Bypass of a configured island trust anchor underneath an insecure parent from an atacker-controlled NSEC record.",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"assignerShortName": "NLnet Labs",
"cveId": "CVE-2026-35501",
"datePublished": "2026-10-21T08:56:55.811Z",
"dateReserved": "2026-06-22T10:11:10.543Z",
"dateUpdated": "2026-10-21T08:56:55.811Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109125 (GCVE-0-2026-109125)
Vulnerability from cvelistv5 – Published: 2026-10-21 08:56 – Updated: 2026-10-21 08:56
VLAI
EPSS
VEX
Title
Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'
Summary
In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-threshold > 0' configurations (not a default configuration). If a response-like UDP datagram reaches the upstream source port currently used by a recursive query, but its TXID does not match any pending query, Unbound counts the packet as an unwanted reply. When the accumulated count reaches the configured threshold, Unbound clears the worker's RRset cache and message cache. This cache clear action does not destroy the current upstream UDP pending query. Therefore, an external observer can distinguish whether a candidate port matches the current upstream source port by checking whether an existing cached item has been cleared. This is a cache side-channel vulnerability that can be used to probe the upstream source port. Although the attack is not feasible on default configurations and the suggested value (10 million) makes it an ureliable attack on a public resolver, in scenarios where the attacker can keep a concurrent query window alive, the attacker can first filter the source port and then perform birthday-style guessing against the TXID, making cache poisoning a feasible attack path.
Severity
5.3 (Medium)
CWE
- CWE-205 - Observable Behavioral Discrepancy
Assigner
NLnet Labs
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.nlnetlabs.nl/downloads/unbound/CVE-20… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NLnet Labs | Unbound |
Affected:
0 , < 1.26.2
(semver)
|
Date Public
2026-10-21 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Unbound",
"vendor": "NLnet Labs",
"versions": [
{
"lessThan": "1.26.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "TaoFei Guo (Peking University)"
},
{
"lang": "en",
"type": "finder",
"value": "Yang Luo (Tsinghua University)"
},
{
"lang": "en",
"type": "finder",
"value": "JianJun Chen (Tsinghua University)"
}
],
"datePublic": "2026-10-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with \u0027unwanted-reply-threshold \u003e 0\u0027 configurations (not a default configuration). If a response-like UDP datagram reaches the upstream source port currently used by a recursive query, but its TXID does not match any pending query, Unbound counts the packet as an unwanted reply. When the accumulated count reaches the configured threshold, Unbound clears the worker\u0027s RRset cache and message cache. This cache clear action does not destroy the current upstream UDP pending query. Therefore, an external observer can distinguish whether a candidate port matches the current upstream source port by checking whether an existing cached item has been cleared. This is a cache side-channel vulnerability that can be used to probe the upstream source port. Although the attack is not feasible on default configurations and the suggested value (10 million) makes it an ureliable attack on a public resolver, in scenarios where the attacker can keep a concurrent query window alive, the attacker can first filter the source port and then perform birthday-style guessing against the TXID, making cache poisoning a feasible attack path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-205",
"description": "CWE-205: Observable Behavioral Discrepancy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T08:56:35.696Z",
"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"shortName": "NLnet Labs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-109125.txt"
}
],
"solutions": [
{
"lang": "en",
"value": "This issue is fixed starting with version 1.26.2"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-28T00:00:00.000Z",
"value": "Issue reported by TaoFei Guo"
},
{
"lang": "en",
"time": "2026-10-05T00:00:00.000Z",
"value": "NLnet Labs shares patch"
},
{
"lang": "en",
"time": "2026-10-06T00:00:00.000Z",
"value": "TaoFei Guo verifies patch"
},
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Fixes released with version 1.26.2"
}
],
"title": "Possible cache poisoning vulnerability via a cache side-channel exposed by \u0027unwanted-reply-threshold\u0027",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"assignerShortName": "NLnet Labs",
"cveId": "CVE-2026-109125",
"datePublished": "2026-10-21T08:56:35.696Z",
"dateReserved": "2026-10-14T09:16:14.087Z",
"dateUpdated": "2026-10-21T08:56:35.696Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101341 (GCVE-0-2026-101341)
Vulnerability from cvelistv5 – Published: 2026-10-14 10:56 – Updated: 2026-10-14 14:08
VLAI
EPSS
VEX
Title
Stack overwrite from specially formatted TXT-DATA RDATA field
Summary
Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which are written out by NSD itself, such for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 14:08 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
NLnet Labs
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-1… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NLnet Labs | NSD |
Affected:
4.10.0 , < 4.15.3
(semver)
|
Date Public
2026-10-14 12:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-101341",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T14:08:02.561206Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:08:20.283Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NSD",
"vendor": "NLnet Labs",
"versions": [
{
"lessThan": "4.15.3",
"status": "affected",
"version": "4.10.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Alwaleed Ashi (LXR) \u003cwaleed.9998@hotmail.com\u003e"
}
],
"datePublic": "2026-10-14T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which are written out by NSD itself, such for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system)."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "When reading zone files, a specially crafted and formatted resource record containing a series of strings (TXT, NINFO, SPF, AVC, RESINFO and WALLET) can cause an out of bounds stack overwrite which can be exploited for execution of arbitrary commands."
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T10:56:51.922Z",
"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"shortName": "NLnet Labs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101341.txt"
}
],
"solutions": [
{
"lang": "en",
"value": "This issue is fixed in 4.15.3 and all later versions."
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-23T15:40:00.000Z",
"value": "Issue reported by Alwaleed Ashi (LXR)"
},
{
"lang": "en",
"time": "2026-09-28T14:59:00.000Z",
"value": "NLnet Labs shares patch"
},
{
"lang": "en",
"time": "2026-09-30T12:46:00.000Z",
"value": "Alwaleed Ashi (LXR) verifies patch"
},
{
"lang": "en",
"time": "2026-10-14T12:00:00.000Z",
"value": "Fix released with version 4.15.3"
}
],
"title": "Stack overwrite from specially formatted TXT-DATA RDATA field",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"assignerShortName": "NLnet Labs",
"cveId": "CVE-2026-101341",
"datePublished": "2026-10-14T10:56:51.922Z",
"dateReserved": "2026-09-28T14:39:03.779Z",
"dateUpdated": "2026-10-14T14:08:20.283Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101339 (GCVE-0-2026-101339)
Vulnerability from cvelistv5 – Published: 2026-10-14 10:56 – Updated: 2026-10-14 14:08
VLAI
EPSS
VEX
Title
Stack overwrite from a specially crafted and formatted HIP RR
Summary
A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack with up to 191 bytes of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 14:08 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
NLnet Labs
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-1… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NLnet Labs | NSD |
Affected:
4.10.0 , < 4.15.3
(semver)
|
Date Public
2026-10-14 12:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-101339",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T14:08:37.264291Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:08:51.522Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NSD",
"vendor": "NLnet Labs",
"versions": [
{
"lessThan": "4.15.3",
"status": "affected",
"version": "4.10.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Qifan Zhang from Palo Alto Networks"
},
{
"lang": "en",
"type": "finder",
"value": "Alwaleed Ashi (LXR) \u003cwaleed.9998@hotmail.com\u003e"
}
],
"datePublic": "2026-10-14T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack with up to 191 bytes of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system)."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "When reading zone files, a specially crafted and formatted HIP resource record can cause an out of bounds stack overwrite which can be exploited for execution of arbitrary commands."
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T10:56:37.808Z",
"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"shortName": "NLnet Labs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101339.txt"
}
],
"solutions": [
{
"lang": "en",
"value": "This issue is fixed in 4.15.3 and all later versions."
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-13T08:12:00.000Z",
"value": "Issue reported by Qifan Zhang"
},
{
"lang": "en",
"time": "2026-08-13T08:12:00.000Z",
"value": "Issue reported by Alwaleed Ashi (LXR)"
},
{
"lang": "en",
"time": "2026-09-22T12:55:00.000Z",
"value": "NLnet Labs shares patch with Alwaleed Ashi (LXR)"
},
{
"lang": "en",
"time": "2026-09-23T15:40:00.000Z",
"value": "Alwaleed Ashi (LXR) verifies patch"
},
{
"lang": "en",
"time": "2026-09-27T15:03:00.000Z",
"value": "NLnet Labs shares patch with Qifan Zhang"
},
{
"lang": "en",
"time": "2026-09-28T21:21:00.000Z",
"value": "Qifan Zhang verifies patch"
},
{
"lang": "en",
"time": "2026-10-14T12:00:00.000Z",
"value": "Fix released with version 4.15.3"
}
],
"title": "Stack overwrite from a specially crafted and formatted HIP RR",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"assignerShortName": "NLnet Labs",
"cveId": "CVE-2026-101339",
"datePublished": "2026-10-14T10:56:37.808Z",
"dateReserved": "2026-09-28T14:39:03.778Z",
"dateUpdated": "2026-10-14T14:08:51.522Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101338 (GCVE-0-2026-101338)
Vulnerability from cvelistv5 – Published: 2026-10-14 10:56 – Updated: 2026-10-14 14:09
VLAI
EPSS
VEX
Title
Stack overwrite from a specially crafted and formatted SVCB or HTTPS RR
Summary
When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of unlimited size. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 14:09 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
NLnet Labs
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-1… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NLnet Labs | NSD |
Affected:
4.10.0 , < 4.15.3
(semver)
|
Date Public
2026-10-14 12:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-101338",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T14:09:10.026829Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:09:20.163Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NSD",
"vendor": "NLnet Labs",
"versions": [
{
"lessThan": "4.15.3",
"status": "affected",
"version": "4.10.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Qifan Zhang from Palo Alto Networks"
}
],
"datePublic": "2026-10-14T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of unlimited size. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system)."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "When reading zone files, a specially crafted and format SVCB or HTTPS record cancause an out of bounds stack overwrite which can be exploited for execution of arbitrary commands."
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T10:56:28.223Z",
"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"shortName": "NLnet Labs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101338.txt"
}
],
"solutions": [
{
"lang": "en",
"value": "This issue is fixed in 4.15.3 and all later versions."
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-13T08:12:00.000Z",
"value": "Issue reported by Qifan Zhang"
},
{
"lang": "en",
"time": "2026-09-27T15:03:00.000Z",
"value": "NLnet Labs shares patch"
},
{
"lang": "en",
"time": "2026-09-28T21:21:00.000Z",
"value": "Qifan Zhang verifies patch"
},
{
"lang": "en",
"time": "2026-10-14T12:00:00.000Z",
"value": "Fix released with version 4.15.3"
}
],
"title": "Stack overwrite from a specially crafted and formatted SVCB or HTTPS RR",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"assignerShortName": "NLnet Labs",
"cveId": "CVE-2026-101338",
"datePublished": "2026-10-14T10:56:28.223Z",
"dateReserved": "2026-09-28T14:39:03.778Z",
"dateUpdated": "2026-10-14T14:09:20.163Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101337 (GCVE-0-2026-101337)
Vulnerability from cvelistv5 – Published: 2026-10-14 10:56 – Updated: 2026-10-14 14:09
VLAI
EPSS
VEX
Title
Stack overwrite from specially formatted base64 RDATA field
Summary
When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 14:09 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
NLnet Labs
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-1… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NLnet Labs | NSD |
Affected:
4.10.0 , < 4.15.3
(semver)
|
Date Public
2026-10-14 12:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-101337",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T14:09:47.568694Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:09:58.370Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NSD",
"vendor": "NLnet Labs",
"versions": [
{
"lessThan": "4.15.3",
"status": "affected",
"version": "4.10.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Qifan Zhang from Palo Alto Networks"
},
{
"lang": "en",
"type": "finder",
"value": "Gaurang Maheta"
}
],
"datePublic": "2026-10-14T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system)."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "When reading zone files, a resource record with a base64 RDATA field in a specially crafted presentation format, can cause an out of bounds stack overwrite which can be exploited for execution of arbitrary command."
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T10:56:15.073Z",
"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"shortName": "NLnet Labs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-101337.txt"
}
],
"solutions": [
{
"lang": "en",
"value": "This issue is fixed in 4.15.3 and all later versions."
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-13T08:12:00.000Z",
"value": "Issue reported by Qifan Zhang"
},
{
"lang": "en",
"time": "2026-09-02T11:12:00.000Z",
"value": "Issue reported by Gaurang Maheta"
},
{
"lang": "en",
"time": "2026-09-02T11:43:00.000Z",
"value": "NLnet Labs shares patch with Gaurang Maheta"
},
{
"lang": "en",
"time": "2026-09-02T11:49:00.000Z",
"value": "Gaurang Maheta verifies patch"
},
{
"lang": "en",
"time": "2026-09-27T15:03:00.000Z",
"value": "NLnet Labs shares patch with Qifan Zhang"
},
{
"lang": "en",
"time": "2026-09-29T09:49:00.000Z",
"value": "NLnet Labs shares updated patch with Qifan Zhang"
},
{
"lang": "en",
"time": "2026-10-02T02:03:00.000Z",
"value": "Qifan Zhang verifies patch"
},
{
"lang": "en",
"time": "2026-10-14T12:00:00.000Z",
"value": "Fix released with version 4.15.3"
}
],
"title": "Stack overwrite from specially formatted base64 RDATA field",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"assignerShortName": "NLnet Labs",
"cveId": "CVE-2026-101337",
"datePublished": "2026-10-14T10:56:15.073Z",
"dateReserved": "2026-09-28T14:39:03.778Z",
"dateUpdated": "2026-10-14T14:09:58.370Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85501 (GCVE-0-2026-85501)
Vulnerability from cvelistv5 – Published: 2026-09-16 08:32 – Updated: 2026-09-16 14:12
VLAI
EPSS
VEX
Title
Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC
Summary
Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested domains, this results in significant computational overhead. NsecTrap, where responses with excessive invalid NSEC records compel the resolver to validate each one. AdditionalTrap, where Unbound by default would try to DNSSEC validate the ADDITIONAL section as well. This can be exploited to waste validation resources by malicious users.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 14:10 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
NLnet Labs
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.nlnetlabs.nl/downloads/unbound/CVE-20… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NLnet Labs | Unbound |
Affected:
0 , < 1.26.1
(semver)
|
Date Public
2026-09-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85501",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T14:10:48.623819Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:12:18.996Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Unbound",
"vendor": "NLnet Labs",
"versions": [
{
"lessThan": "1.26.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zuyao Xu (Nankai University, AOSP Lab)"
},
{
"lang": "en",
"type": "finder",
"value": "Xiang Li (Nankai University, AOSP Lab)"
},
{
"lang": "en",
"type": "finder",
"value": "Qifan Zhang (Palo Alto Networks)"
}
],
"datePublic": "2026-09-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term \u0027ReTrap\u0027. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested domains, this results in significant computational overhead. NsecTrap, where responses with excessive invalid NSEC records compel the resolver to validate each one. AdditionalTrap, where Unbound by default would try to DNSSEC validate the ADDITIONAL section as well. This can be exploited to waste validation resources by malicious users."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T08:32:25.398Z",
"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"shortName": "NLnet Labs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-85501.txt"
}
],
"solutions": [
{
"lang": "en",
"value": "This issue is fixed starting with version 1.26.1"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-05-24T00:00:00.000Z",
"value": "Issue reported by Zuyao Xu"
},
{
"lang": "en",
"time": "2025-05-28T00:00:00.000Z",
"value": "NLnet Labs shares some concerns about the testing methodology"
},
{
"lang": "en",
"time": "2025-08-14T00:00:00.000Z",
"value": "Zuyao Xu shares updated research results"
},
{
"lang": "en",
"time": "2025-08-26T00:00:00.000Z",
"value": "NLnet Labs shares patch with Zuyao Xu"
},
{
"lang": "en",
"time": "2025-09-03T00:00:00.000Z",
"value": "Zuyao Xu verifies patch"
},
{
"lang": "en",
"time": "2026-05-05T00:00:00.000Z",
"value": "Issue similar to TagTrap reported by Qifan Zhang"
},
{
"lang": "en",
"time": "2026-05-07T00:00:00.000Z",
"value": "NLnet Labs shares patch with Qifan Zhang"
},
{
"lang": "en",
"time": "2026-05-08T00:00:00.000Z",
"value": "Qifan Zhang verifies patch"
},
{
"lang": "en",
"time": "2026-09-16T00:00:00.000Z",
"value": "Fixes released with version 1.26.1"
}
],
"title": "Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"assignerShortName": "NLnet Labs",
"cveId": "CVE-2026-85501",
"datePublished": "2026-09-16T08:32:25.398Z",
"dateReserved": "2026-09-07T14:06:21.977Z",
"dateUpdated": "2026-09-16T14:12:18.996Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82720 (GCVE-0-2026-82720)
Vulnerability from cvelistv5 – Published: 2026-09-16 08:32 – Updated: 2026-09-16 14:14
VLAI
EPSS
VEX
Title
Use-after-free in DoH stream cleanup code path
Summary
NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--with-libnghttp2'. During failure code paths (i.e., RPZ drop query, jostle due to heavy traffic), a dropped DoH stream brings down the whole DoH session and does not account properly for other DoH streams in the same session. This leads to use-after-free in those code paths. If the prerequisites are satisfied (possible RPZ drop or heavy client traffic), a malicious actor can trigger the vulnerability with a single DoH connection and the appropriate traffic. Impact is limited as the reads are not user controlled and the use-after-free leads to early returns. However, a hardened allocator can catch the use-after-free and controllably terminate the process resulting to denial of service.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 14:13 UTC
CWE
- CWE-416 - Use After Free
Assigner
NLnet Labs
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.nlnetlabs.nl/downloads/unbound/CVE-20… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NLnet Labs | Unbound |
Affected:
1.12.0 , < 1.26.1
(semver)
|
Date Public
2026-09-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82720",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T14:13:03.616721Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:14:25.720Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Unbound",
"vendor": "NLnet Labs",
"versions": [
{
"lessThan": "1.26.1",
"status": "affected",
"version": "1.12.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuqi Qiu (Nankai University, AOSP Lab)"
},
{
"lang": "en",
"type": "finder",
"value": "Xiang Li (Nankai University, AOSP Lab)"
}
],
"datePublic": "2026-09-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with \u0027--with-libnghttp2\u0027. During failure code paths (i.e., RPZ drop query, jostle due to heavy traffic), a dropped DoH stream brings down the whole DoH session and does not account properly for other DoH streams in the same session. This leads to use-after-free in those code paths. If the prerequisites are satisfied (possible RPZ drop or heavy client traffic), a malicious actor can trigger the vulnerability with a single DoH connection and the appropriate traffic. Impact is limited as the reads are not user controlled and the use-after-free leads to early returns. However, a hardened allocator can catch the use-after-free and controllably terminate the process resulting to denial of service."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "Compiled with DNS-over-HTTPs support"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T08:32:10.359Z",
"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"shortName": "NLnet Labs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-82720.txt"
}
],
"solutions": [
{
"lang": "en",
"value": "This issue is fixed starting with version 1.26.1"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-11T00:00:00.000Z",
"value": "Issue reported by Yuqi Qiu"
},
{
"lang": "en",
"time": "2026-08-13T00:00:00.000Z",
"value": "NLnet Labs shares patch"
},
{
"lang": "en",
"time": "2026-08-14T00:00:00.000Z",
"value": "Yuqi Qiu verifies patch"
},
{
"lang": "en",
"time": "2026-09-16T00:00:00.000Z",
"value": "Fixes released with version 1.26.1"
}
],
"title": "Use-after-free in DoH stream cleanup code path",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"assignerShortName": "NLnet Labs",
"cveId": "CVE-2026-82720",
"datePublished": "2026-09-16T08:32:10.359Z",
"dateReserved": "2026-09-07T14:06:21.960Z",
"dateUpdated": "2026-09-16T14:14:25.720Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82717 (GCVE-0-2026-82717)
Vulnerability from cvelistv5 – Published: 2026-09-16 08:31 – Updated: 2026-09-16 14:15
VLAI
EPSS
VEX
Title
CNAME synthesis could lead to heap corruption
Summary
In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 14:15 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
NLnet Labs
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.nlnetlabs.nl/downloads/unbound/CVE-20… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NLnet Labs | Unbound |
Affected:
0 , < 1.26.1
(semver)
|
Date Public
2026-09-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82717",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T14:15:46.463136Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:15:55.295Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Unbound",
"vendor": "NLnet Labs",
"versions": [
{
"lessThan": "1.26.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ben Morris (Anthropic)"
}
],
"datePublic": "2026-09-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T08:31:59.417Z",
"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"shortName": "NLnet Labs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-82717.txt"
}
],
"solutions": [
{
"lang": "en",
"value": "This issue is fixed starting with version 1.26.1"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-23T00:00:00.000Z",
"value": "Issue reported by Ben Morris"
},
{
"lang": "en",
"time": "2026-07-23T00:00:00.000Z",
"value": "NLnet Labs shares patch"
},
{
"lang": "en",
"time": "2026-07-23T00:00:00.000Z",
"value": "Ben Morris verifies patch"
},
{
"lang": "en",
"time": "2026-09-16T00:00:00.000Z",
"value": "Fixes released with version 1.26.1"
}
],
"title": "CNAME synthesis could lead to heap corruption",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
"assignerShortName": "NLnet Labs",
"cveId": "CVE-2026-82717",
"datePublished": "2026-09-16T08:31:59.417Z",
"dateReserved": "2026-09-07T14:06:21.974Z",
"dateUpdated": "2026-09-16T14:15:55.295Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}