CVE-2026-42944 is a heap overflow vulnerability in NLnet Labs Unbound DNS resolver versions 1.14.0 up to and including 1.25.0. The flaw arises from a numeric truncation error in the calculation of the size of the EDNS field when encoding multiple NSID, DNS Cookie EDNS, and EDNS Padding options in reply packets. If these EDNS options ('nsid', 'answer-cookie', 'pad-responses') are enabled, an attacker capable of sending queries with multiple such options can exploit this to overflow the heap with controlled data, leading to a crash. The vulnerability is addressed in Unbound 1.25.1 by implementing de-duplication of EDNS options and fixing the truncation error in size calculation. Red Hat has issued security advisories and patches for affected Red Hat Enterprise Linux 10 variants, providing updated unbound packages that remediate this issue.

Successful exploitation allows an unauthenticated attacker who can query the Unbound DNS resolver to cause a heap overflow, resulting in a crash (denial of service). The CVSS 4.0 base score is 8.7 (high severity), reflecting the network attack vector with no required privileges or user interaction. There is no confirmed exploitation in the wild. The impact is primarily denial of service due to heap overflow and crash.

A fix is available in Unbound version 1.25.1, which addresses the vulnerability by de-duplicating EDNS options and correcting the size calculation to prevent truncation. Red Hat has released updated packages for Red Hat Enterprise Linux 10 that include this fix. Users should apply these official patches promptly to remediate the vulnerability. Patch status is confirmed by vendor advisories. No additional mitigations are specifically required beyond applying the official update.