CVE-2026-44608: Use after free and crash under special conditions in RPZ code
Last updated 21 May 2026
Other sources
NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met (multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers) it could result in heap use-after-free and eventual crash. An adversary can exploit the vulnerability if conditions are first met on a vulnerable Unbound, i.e., multi-threaded, an RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers and an ongoing XFR for that RPZ zone. Local RPZ files do not trigger the vulnerability. If the timing is right and an XFR happens at the same time another thread needs to read that RPZ zone, the reader may not hold the lock long enough and the thread applying the XFR may free objects that the reader is about to walk causing the use-after-free. Unbound 1.25.1 contains a patch with a fix to the locking code.
— Launchpad
Use after free and crash under special conditions in RPZ code
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/unboundto a version that resolves this vulnerability.Fixed in 1.25.1-1 - Upgrade
Upgrade
NLnet Labs Unboundto a version that resolves this vulnerability.Fixed in 1.25.1 - Configuration
Mitigate by avoiding RPZ zones that use 'rpz-nsip'/'rpz-nsdname' triggering conditions, since the described vulnerability requires an RPZ zone with those triggers combined with RPZ XFR reload timing in multi-threaded Unbound.
RPZ configuration (Unbound) rpz-nsip / rpz-nsdname = Use only if required; avoid triggering RPZ NSIP/NSDNAME when not needed
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44608?
CVE-2026-44608 is considered a high severity vulnerability due to its potential to cause crashes under specific conditions.
How do I fix CVE-2026-44608?
To fix CVE-2026-44608, upgrade NLnet Labs Unbound to version 1.26.0 or later.
What versions of Unbound are affected by CVE-2026-44608?
CVE-2026-44608 affects all versions of NLnet Labs Unbound from 1.14.0 up to and including 1.25.0.
What are the potential impacts of CVE-2026-44608?
The potential impacts of CVE-2026-44608 include application crashes and denial of service under certain multi-threaded conditions.
Is CVE-2026-44608 related to RPZ code in Unbound?
Yes, CVE-2026-44608 specifically relates to a vulnerability in the RPZ code of NLnet Labs Unbound.