CVE-2026-42944: Heap overflow with multiple NSID, COOKIE, PADDING EDNS options
A vulnerability was found in Unbound that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options ('nsid', 'answer-cookie', 'pad-responses' (default)) need to be enabled for the vulnerability to be exploited.
Unbound 1.25.1 includes a fix to de-duplicate the EDNS options and a fix to prevent truncation of the EDNS field size calculation that also contributes to the heap overflow.
Other sources
Heap overflow with multiple NSID, COOKIE, PADDING EDNS options
— Microsoft
NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options ('nsid', 'answer-cookie', 'pad-responses' (default)) need to be enabled for the vulnerability to be exploited. An adversary who can query Unbound can exploit the vulnerability by attaching multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options to the query. A flaw in the size calculation of the EDNS field truncates the correct value which allows the encoder to overflow the available space when writing. Those two combined lead to a heap overflow write of Unbound controlled data and eventually a crash. Unbound 1.25.1 contains a patch with a fix to de-duplicate the EDNS options and a fix to prevent truncation of the EDNS field size calculation.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/unboundto a version that resolves this vulnerability.Fixed in 1.25.1-1 - Upgrade
Upgrade
Unboundto a version that resolves this vulnerability.Fixed in 1.25.1 - Compensating control
If you cannot upgrade to Unbound 1.25.1, prevent exploitation by ensuring the relevant EDNS options are not enabled/used: 'nsid', 'answer-cookie', and 'pad-responses' (default).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42944?
CVE-2026-42944 is classified as a high severity vulnerability due to its potential for causing a heap overflow.
How do I fix CVE-2026-42944?
To fix CVE-2026-42944, upgrade NLnet Labs Unbound to version 1.26.0 or later.
What software is affected by CVE-2026-42944?
CVE-2026-42944 affects NLnet Labs Unbound versions 1.14.0 through 1.25.0.
What types of attacks can exploit CVE-2026-42944?
CVE-2026-42944 can be exploited to execute arbitrary code or crash the application due to heap overflow.
Is CVE-2026-42944 being actively exploited in the wild?
As of now, there is no public information indicating that CVE-2026-42944 is being actively exploited.