REDHAT-BUG-2458516: High severity Nlnet Labs Unbound vulnerability

Q: Does an attacker need to provide a valid DNSSEC signature to trigger this issue?

No. The affected parsing paths are reachable before RRSIG validation, so valid signatures are not required.

Q: What malformed DNSSEC data causes the affected resolver to loop?

An NSEC or NSEC3 bitmap window with bitmap_length set to 0 can leave both the remaining record length and parsing pointer unchanged, causing an infinite loop.

Q: Are there multiple affected parsing locations?

Yes. The issue occurs at two locations in dnssec.c, at lines 1290 and 1450. One location was coincidentally fixed in version 2.92, while the complete fix adds 2 bytes for the window header to both pointer advancement and remaining-length reduction.

Published Apr 14, 2026

Updated

NSEC/NSEC3 bitmap window iteration in dnssec.c advances by p[1] instead of p[1] + 2, missing the 2-byte window header. When bitmaplength=0, neither rdlen nor p change, creating an infinite loop. Two instances at dnssec.c:1290 and dnssec.c:1450. Reachable before RRSIG validation so no valid signatures are needed. One of the two sites was coincidentally fixed in 2.92. Fix: add +2 to both the pointer advance and rdlen decrement.

Affected Software

1 affected component

Nlnet Labs Unbound<2.92

Event History

Apr 14, 2026

Data Sourced

via Red Hat·10:39 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Does an attacker need to provide a valid DNSSEC signature to trigger this issue?

No. The affected parsing paths are reachable before RRSIG validation, so valid signatures are not required.

What malformed DNSSEC data causes the affected resolver to loop?

An NSEC or NSEC3 bitmap window with bitmap_length set to 0 can leave both the remaining record length and parsing pointer unchanged, causing an infinite loop.

Are there multiple affected parsing locations?

Yes. The issue occurs at two locations in dnssec.c, at lines 1290 and 1450. One location was coincidentally fixed in version 2.92, while the complete fix adds 2 bytes for the window header to both pointer advancement and remaining-length reduction.

REDHAT-BUG-2458516: High severity Nlnet Labs Unbound vulnerability

Affected Software

Event History

Frequently Asked Questions

Does an attacker need to provide a valid DNSSEC signature to trigger this issue?

What malformed DNSSEC data causes the affected resolver to loop?

Are there multiple affected parsing locations?

Company

Resources

Contact

Frequently Asked Questions

Does an attacker need to provide a valid DNSSEC signature to trigger this issue?

What malformed DNSSEC data causes the affected resolver to loop?

Are there multiple affected parsing locations?