CVE-2026-42959: Crash during DNSSEC validation of malicious content
Access of Uninitialized Pointer vulnerability in the DNSSEC validator of the Unbound DNS resolver. The flaw is caused by the use of incorrect counters when calculating write offsets for ADDITIONAL section rrsets in chase-reply messages. DNAME duplication can increase the ANSWER section count and authority filtering can decrease the AUTHORITY section count, creating an uninitialized array slot. The validator later dereferences this uninitialized pointer, causing an immediate process crash. An adversary controlling a DNSSEC-signed domain can trigger this bug with a single query by configuring a DNAME chain with unsigned CNAMEs and a response containing unsigned AUTHORITY records alongside signed ADDITIONAL glue records.
Other sources
Crash during DNSSEC validation of malicious content
— Microsoft
NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validator that can lead to a crash given malicious upstream replies. When Unbound constructs chase-reply messages for validation, the code uses the wrong counter to calculate write offsets for ADDITIONAL section rrsets. DNAME duplication could increase the ANSWER section count and authority filtering could decrease the AUTHORITY section count and create an uninitialized array slot. Combining these two, the validator later dereferences this uninitialized pointer, causing an immediate process crash. An adversary controlling a DNSSEC-signed domain can trigger this bug with a single query by configuring a DNAME chain with unsigned CNAMEs and a response containing unsigned AUTHORITY records alongside signed ADDITIONAL glue records. Unbound 1.25.1 contains a patch with a fix to use the proper counters to calculate the write offsets.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/unboundto a version that resolves this vulnerability.Fixed in 1.22.0-2+deb13u3Fixed in 1.25.1-1 - Upgrade
Upgrade
NLnet Labs Unbound DNS resolver (DNSSEC validator)to a version that resolves this vulnerability.Fixed in 1.25.1 - Configuration
Set 'val-clean-additional: no' to bypass the vulnerable code in vulnerable Unbound versions (non-default setting) while mitigating the DNSSEC validator DoS/crash.
Unbound DNS resolver val-clean-additional = no
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42959?
CVE-2026-42959 has a high severity rating due to the potential for denial of service through crashes during DNSSEC validation.
How do I fix CVE-2026-42959?
To fix CVE-2026-42959, upgrade NLnet Labs Unbound to version 1.26.0 or later.
What types of systems are affected by CVE-2026-42959?
CVE-2026-42959 affects NLnet Labs Unbound versions up to and including 1.25.0.
What can an attacker do with CVE-2026-42959?
An attacker can exploit CVE-2026-42959 to induce a crash of the Unbound DNS resolver through malicious upstream replies.
Is CVE-2026-42959 being actively exploited in the wild?
As of the latest updates, there are no confirmed reports of active exploitation of CVE-2026-42959 in the wild.