REDHAT-BUG-2479774: High severity Nlnet Labs Unbound vulnerability

Q: Which configurations are exposed to this issue?

Exploitation requires relevant EDNS reply options to be enabled: nsid, answer-cookie, and/or pad-responses. The pad-responses option is enabled by default, so default configurations may be affected.

Q: What does an attacker need to trigger the vulnerability?

An attacker needs to cause Unbound to encode multiple NSID, DNS Cookie EDNS, and/or EDNS Padding options in a reply packet. The issue occurs during reply-packet encoding when the relevant options are enabled.

Q: What remediation is identified?

Unbound 1.25.1 includes fixes that de-duplicate EDNS options and prevent truncation in EDNS field-size calculation, addressing contributing conditions for the heap overflow.

Published May 19, 2026

Updated

A vulnerability was found in Unbound that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options ('nsid', 'answer-cookie', 'pad-responses' (default)) need to be enabled for the vulnerability to be exploited.

Unbound 1.25.1 includes a fix to de-duplicate the EDNS options and a fix to prevent truncation of the EDNS field size calculation that also contributes to the heap overflow.

Affected Software

1 affected component

Nlnet Labs Unbound<1.25.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Unbound to a version that resolves this vulnerability.
Fixed in 1.25.1
Configuration
Disable the 'nsid' option to prevent exploitation (vulnerability requires 'nsid' among the relevant options).
Unbound nsid = disable
Configuration
Disable the 'answer-cookie' option to prevent exploitation (vulnerability requires 'answer-cookie' among the relevant options).
Unbound answer-cookie = disable
Configuration
Disable 'pad-responses' (noting it is a default option) to prevent exploitation (vulnerability requires 'pad-responses' among the relevant options).
Unbound pad-responses = disable

Event History

May 19, 2026

Data Sourced

via Red Hat·10:09 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which configurations are exposed to this issue?

Exploitation requires relevant EDNS reply options to be enabled: nsid, answer-cookie, and/or pad-responses. The pad-responses option is enabled by default, so default configurations may be affected.

What does an attacker need to trigger the vulnerability?

An attacker needs to cause Unbound to encode multiple NSID, DNS Cookie EDNS, and/or EDNS Padding options in a reply packet. The issue occurs during reply-packet encoding when the relevant options are enabled.

What remediation is identified?

Unbound 1.25.1 includes fixes that de-duplicate EDNS options and prevent truncation in EDNS field-size calculation, addressing contributing conditions for the heap overflow.

REDHAT-BUG-2479774: High severity Nlnet Labs Unbound vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which configurations are exposed to this issue?

What does an attacker need to trigger the vulnerability?

What remediation is identified?

Company

Resources

Contact

Frequently Asked Questions

Which configurations are exposed to this issue?

What does an attacker need to trigger the vulnerability?

What remediation is identified?