REDHAT-BUG-2458519: Medium severity Nlnet Labs Unbound vulnerability

Published Apr 14, 2026
·
Updated

In forward.c:724, processreply() calls checksource(header, plen, pheader, querysource) but plen at this point holds the OPT record length (~23 bytes), not the packet length n. With the wrong length, all bounds checks inside checksource() fail and the function unconditionally returns 1, bypassing RFC 7871 Section 9.2 ECS source validation entirely. Fix: change plen to n in the function call.

Affected Software

1 affected component
Nlnet Labs Unbound

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Configuration

    In forward.c at line 724 within process_reply(), change the call from check_source(header, plen, pheader, query_source) to check_source(header, n, pheader, query_source) so check_source() receives the correct packet length n and RFC 7871 Section 9.2 ECS source validation is not bypassed.

    forward.c (process_reply/check_source) plend-to-n argument in check_source() call = Use packet length n instead of plen (~OPT record length)

Event History

Apr 14, 2026
Data Sourced
via Red Hat·10:55 PM
DescriptionSeverityAffected Software

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203