REDHAT-BUG-2458517: High severity Nlnet Labs Unbound vulnerability
Published Apr 14, 2026
·Updated
In validaterrset() at dnssec.c:546, siglen is calculated as rdlen - (p - psav) without checking that rdlen is large enough to cover the fixed RRSIG fields and signer name. A crafted RRSIG with a short rdlen makes siglen go negative, which when passed as a size parameter becomes a huge unsigned value, causing a massive heap OOB read. Fix: check siglen <= 0 and return STATBOGUS before using it.
Affected Software
1 affected component
Nlnet Labs Unbound
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In validate_rrset() at dnssec.c:546, after computing sig_len as rdlen - (p - psav), add a check that sig_len <= 0 and immediately return STAT_BOGUS before passing sig_len as a size parameter to prevent huge unsigned wraparound and heap OOB reads.
dnssec.c (validate_rrset) sig_len bounds check = if (sig_len <= 0) return STAT_BOGUS before using sig_len as a size parameter
Event History
Apr 14, 2026
Data Sourced
via Red Hat·10:45 PM
DescriptionSeverityAffected Software